Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
27/03/2024, 03:50
General
-
Target
2b05b86709f4f4f335b334803682644f87b2a7c3b122e53312b8c640d9721b5c.exe
-
Size
2.9MB
-
MD5
886ef069a6a8f22bfa268bb7ac3435de
-
SHA1
53947574433edd9f3edf03c7290386cf8369fc76
-
SHA256
2b05b86709f4f4f335b334803682644f87b2a7c3b122e53312b8c640d9721b5c
-
SHA512
a030949d71d0209cd3d49483b1fe3b6ca4cfec8bd2562547e63efea73ba75c1248edb4c6b673e06d58a8c8c06c841fdd06cab6e9a704dbb21bf3f004266678b2
-
SSDEEP
49152:T41mc5eSjiV7+zOw3w0cnvyVaaIfli+h9Xfu2vFxmbjOu5UWxcU5pFCoEfdG:MCSY+zOw3w0cnvyVaaIY+hmD5e
Malware Config
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b05b86709f4f4f335b334803682644f87b2a7c3b122e53312b8c640d9721b5c.exe"C:\Users\Admin\AppData\Local\Temp\2b05b86709f4f4f335b334803682644f87b2a7c3b122e53312b8c640d9721b5c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB