Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
330b55fc29e...75.exe
windows10-2004-x64
104f6b8faa68...86.exe
windows10-2004-x64
1068c37c8307...6a.exe
windows10-2004-x64
10699bfc597d...1d.exe
windows10-2004-x64
10844b5b7693...ab.exe
windows10-2004-x64
1086a6beb680...62.exe
windows10-2004-x64
109cf3d2bf3c...cb.exe
windows10-2004-x64
10ca9f078739...a4.exe
windows10-2004-x64
10d0ab8687e3...e2.exe
windows10-2004-x64
10fb468a211d...c3.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
30b55fc29eb4d6ba84b1f82bbfa69faa222f2bc6d243a759a624fbb454475275.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
4f6b8faa6814b26627c6c8eac0bc9c5237229efaec31a93ac5634db12970f986.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
699bfc597d56fb4ed7153a5a4fe2851361b9e27b9b8c3109277f0c5a54afbe1d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
9cf3d2bf3c4df3cc22948e45de303aec0f5ffce78a74c453774be0f6f060f6cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
ca9f07873920ecd0518ecf148ae1351a8ecb3ce1fe033aa44b45de07f87202a4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
d0ab8687e34a8f0343980bddd26689960bc998ce3537a995751d70b47f6b24e2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
fb468a211d9a74c5355215200cc2031ec364c8d8a99456c4a189cfea35cb72c3.exe
Resource
win10v2004-20240426-en
General
-
Target
86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe
-
Size
1005KB
-
MD5
80766f346a1033b1abfeeabc7180a880
-
SHA1
2568f835441d53bc785a4ddf8537814826e3d064
-
SHA256
86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62
-
SHA512
029d53c19dd434b410eb61158e8a653c3d3725b50de9e5bb7dd766baed93a37574b3171509ee7e968d18158d89082029e74881630fb852c37b305053ec5c87aa
-
SSDEEP
12288:VMrry90H6OndYa8eQHWFiUDhbkYuuDu6rtRHvb6sCIoxV+pY62N7198r3GJnWIi:KypOnDiU9Pyyhj6sUx+07cSkN
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Qe51ov4.exe -
Executes dropped EXE 1 IoCs
pid Process 1308 1Qe51ov4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1Qe51ov4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1316 schtasks.exe 2444 schtasks.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1308 4864 86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe 83 PID 4864 wrote to memory of 1308 4864 86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe 83 PID 4864 wrote to memory of 1308 4864 86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe 83 PID 1308 wrote to memory of 1316 1308 1Qe51ov4.exe 84 PID 1308 wrote to memory of 1316 1308 1Qe51ov4.exe 84 PID 1308 wrote to memory of 1316 1308 1Qe51ov4.exe 84 PID 1308 wrote to memory of 2444 1308 1Qe51ov4.exe 86 PID 1308 wrote to memory of 2444 1308 1Qe51ov4.exe 86 PID 1308 wrote to memory of 2444 1308 1Qe51ov4.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe"C:\Users\Admin\AppData\Local\Temp\86a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Qe51ov4.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:1316
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52554335d1d5d65d601b4d45a6e8aced2
SHA1db8d862c2eff246f13eb5a676fa15815f66673dd
SHA256f94b4a944d16a12fe45ec0e2c779607c1418dd789462e40d83dcf190496d4f80
SHA512a073dc2387ffd84143466136b0fd5c12ccd6a5d0bd67aa6d648d3f3790ee79028edd5d2ed8897437d794674dd46334d6cade72c91a0103d617285f5018c22fcb