Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
-
submitted
05/05/2024, 12:32
General
-
Target
b977c58c6bb2082a0e5a432f73fe63639486b22ae22eaa56d3230916655883cc.exe
-
Size
2.3MB
-
MD5
9709a18d8199ba0f821849f6b538a3c2
-
SHA1
33ce40b6542869396bff404d04ae5f1efd603f89
-
SHA256
b977c58c6bb2082a0e5a432f73fe63639486b22ae22eaa56d3230916655883cc
-
SHA512
72a8c8b1c28bd4b240e0fa37b7c5edd3b3102d8cec06b56ba8041996e13bee4d5346157113dc80ba59fe8fa449e70d083ce5129868fdccf38594eb2181dee5d4
-
SSDEEP
49152:qTs9zpYo556eURBCmONCMZUeii/8mU+QdCJ+FzRmIy8v82JqPfl:q49SoqrRBCmOrUy8x+GC8T3kl
Malware Config
Extracted
risepro
147.45.47.93:58709
Signatures
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b977c58c6bb2082a0e5a432f73fe63639486b22ae22eaa56d3230916655883cc.exe"C:\Users\Admin\AppData\Local\Temp\b977c58c6bb2082a0e5a432f73fe63639486b22ae22eaa56d3230916655883cc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB