Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 15:03
General
-
Target
Photoshop-beta-crack.exe
-
Size
58.2MB
-
MD5
eaa91e08d8ad9385a08bc9e31f7d683c
-
SHA1
8f0326f98fb2edd1b4f0c11ce8cc6edd1bcd935b
-
SHA256
2d0b685eeb9a5e23b50b9e88ccc6d9aa53ca2fc1e935f30dec40c170f20fac70
-
SHA512
475699b63078596f7953791a7ce63859e293d83a6bcd33ded49630169fc1beba1a56e13e5e733e008ff13929e915c3991a1b5f0642592ca302fee04bd81e39db
-
SSDEEP
393216:UcZDIFlplNv+n9hep/9D9lpAJCHkgzZVlWwo5NdL8ae5+:GlpEM/9D9A0HkgzZVpo5X3s+
Score
10/10
Malware Config
Extracted
Family
risepro
C2
193.233.255.91
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 7 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\""1⤵
-
C:\Users\Admin\AppData\Local\Temp\Photoshop-beta-crack.exe"C:\Users\Admin\AppData\Local\Temp\Photoshop-beta-crack.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\driver3.exeC:\Users\Admin\AppData\Roaming\driver3.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\driver2.exeC:\Users\Admin\AppData\Roaming\driver2.exe2⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\driver1.exeC:\Users\Admin\AppData\Roaming\driver1.exe2⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "SXONTKFN"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "SXONTKFN"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "SXONTKFN" binpath= "C:\ProgramData\wjgsweqztysh\khzowafudydl.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
-
-
C:\ProgramData\wjgsweqztysh\khzowafudydl.exeC:\ProgramData\wjgsweqztysh\khzowafudydl.exe1⤵
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
22.8MB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
22.8MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
12KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
412KB
-
Filesize
9.6MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
22.8MB
-
Filesize
22.8MB
-
Filesize
512KB
-
Filesize
7.6MB
-
Filesize
64KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
152KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB