Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3220f464b76...f3.exe
windows10-2004-x64
102743aa58ac...22.exe
windows7-x64
32743aa58ac...22.exe
windows10-2004-x64
102ce9158850...93.exe
windows10-2004-x64
102d1e7e578c...8f.exe
windows7-x64
32d1e7e578c...8f.exe
windows10-2004-x64
106a183f77b9...7d.exe
windows10-2004-x64
107727481721...74.exe
windows7-x64
37727481721...74.exe
windows10-2004-x64
10951f93d281...f8.exe
windows7-x64
3951f93d281...f8.exe
windows10-2004-x64
109bba18a180...52.exe
windows10-2004-x64
10a467111c1a...4b.exe
windows10-2004-x64
10b6b30a924e...0b.exe
windows10-2004-x64
10bdacff51fa...2b.exe
windows10-2004-x64
10c37c4fe673...eb.exe
windows10-2004-x64
10d0f3f32b61...38.exe
windows7-x64
3d0f3f32b61...38.exe
windows10-2004-x64
10d353176614...e5.exe
windows10-2004-x64
10d49811a818...06.exe
windows7-x64
3d49811a818...06.exe
windows10-2004-x64
10db044599ba...af.exe
windows7-x64
3db044599ba...af.exe
windows10-2004-x64
10e3c9a1721d...3b.exe
windows10-2004-x64
10ea47879989...93.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
220f464b76f6cb53d1ee73c2d90b0ada5c8cc5d2a80bd9d4fed4a544d73721f3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe
Resource
win7-20240508-en
Behavioral task
behavioral3
Sample
2743aa58ac87e72c969f8baff90a46df51144db6b46e42137bec8f8ffe030422.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
2ce9158850627f9719e666b3f93a1508443159828dcc0aab91110d608c67b893.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
2d1e7e578c80b8d8058a776542e88f81546a3603e80751bef11e72c2329d748f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
6a183f77b983e6c003810991feea77693c5603a5e5ebca149d3e4ecfdcc2827d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
77274817210948a1fbb7d40ad1a99460ad22b9558203091765c377ab9b074874.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
951f93d281b72cbee616455728a3885d88e2ce7083c529de95ab9de3efe14ff8.exe
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
951f93d281b72cbee616455728a3885d88e2ce7083c529de95ab9de3efe14ff8.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
9bba18a18011c572ee6b56cde220be7a07f51e4e0f2cdf0a4ebaf3bd06feca52.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
a467111c1a7dd3af8188b3fd8536d689b84b136a58f62e8366f78d309b1bad4b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
b6b30a924e3f969aba356b4a964cb4abb9fddd40a9a6d9068144b799e997a80b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
bdacff51fa5404ce6f24b89ee15c9de1591f3b0671ffcdead018c8136b56522b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
c37c4fe673daf8c4e8e21c607e393cc10eaf650294d08cb4f702da5fa23f0eeb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
d0f3f32b61b9e8c20cd73d28b21a5e034041570a81ffd7bddcd760bc2f8a5538.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
d0f3f32b61b9e8c20cd73d28b21a5e034041570a81ffd7bddcd760bc2f8a5538.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
d353176614b7dd329d9f436d6a34f007c32540fac4c5f4e3f2884d89ed599fe5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
d49811a818845606218cd8436043886ebf6fa2d750248ad4f7f09d197c31db06.exe
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
d49811a818845606218cd8436043886ebf6fa2d750248ad4f7f09d197c31db06.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
db044599ba62c9a98e024ecd1f465c8f39790d7683b22c64327635e0d2c0b4af.exe
Resource
win7-20240215-en
Behavioral task
behavioral23
Sample
db044599ba62c9a98e024ecd1f465c8f39790d7683b22c64327635e0d2c0b4af.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
ea47879989afdae64e6a2fd1bdd521ed8a7eee7611d92cfa24311d7f31d22c93.exe
Resource
win10v2004-20240508-en
General
-
Target
e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe
-
Size
1.1MB
-
MD5
4c57105730828c98c61e10949fc25950
-
SHA1
b018b8964a21ec971d7a8e3480ce28976012374c
-
SHA256
e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b
-
SHA512
ead8b5fc20e1a9f2125f2f7338edc844f80415ef768f02753dcdc51140b811ae2fb60f0d77226418a433746a28c81296f1a8b41333eb6b7c59c9f52f82e1f378
-
SSDEEP
24576:8yqOw0U5IPpj5uiUgnhUaO6O/xaGRxr01X:rq50U5gpJUD6lGRp
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Qe51ov4.exe -
Executes dropped EXE 2 IoCs
pid Process 4724 Ll7AZ90.exe 3916 1Qe51ov4.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1Qe51ov4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Ll7AZ90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4820 schtasks.exe 3468 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4724 4660 e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe 83 PID 4660 wrote to memory of 4724 4660 e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe 83 PID 4660 wrote to memory of 4724 4660 e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe 83 PID 4724 wrote to memory of 3916 4724 Ll7AZ90.exe 84 PID 4724 wrote to memory of 3916 4724 Ll7AZ90.exe 84 PID 4724 wrote to memory of 3916 4724 Ll7AZ90.exe 84 PID 3916 wrote to memory of 4820 3916 1Qe51ov4.exe 85 PID 3916 wrote to memory of 4820 3916 1Qe51ov4.exe 85 PID 3916 wrote to memory of 4820 3916 1Qe51ov4.exe 85 PID 3916 wrote to memory of 3468 3916 1Qe51ov4.exe 88 PID 3916 wrote to memory of 3468 3916 1Qe51ov4.exe 88 PID 3916 wrote to memory of 3468 3916 1Qe51ov4.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe"C:\Users\Admin\AppData\Local\Temp\e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ll7AZ90.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ll7AZ90.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Qe51ov4.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Qe51ov4.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:4820
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:3468
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1005KB
MD580766f346a1033b1abfeeabc7180a880
SHA12568f835441d53bc785a4ddf8537814826e3d064
SHA25686a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62
SHA512029d53c19dd434b410eb61158e8a653c3d3725b50de9e5bb7dd766baed93a37574b3171509ee7e968d18158d89082029e74881630fb852c37b305053ec5c87aa
-
Filesize
1.5MB
MD52554335d1d5d65d601b4d45a6e8aced2
SHA1db8d862c2eff246f13eb5a676fa15815f66673dd
SHA256f94b4a944d16a12fe45ec0e2c779607c1418dd789462e40d83dcf190496d4f80
SHA512a073dc2387ffd84143466136b0fd5c12ccd6a5d0bd67aa6d648d3f3790ee79028edd5d2ed8897437d794674dd46334d6cade72c91a0103d617285f5018c22fcb