Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30068388548...96.exe
windows10-2004-x64
1013243e4dd5...33.exe
windows10-2004-x64
10202040bebe...98.exe
windows10-2004-x64
103a1c464610...ff.exe
windows10-2004-x64
10556fc723a7...10.exe
windows10-2004-x64
75eb8ed45ba...01.exe
windows10-2004-x64
10663bf6b48c...37.exe
windows10-2004-x64
767dbedea2e...69.exe
windows10-2004-x64
107e4d47aad3...11.exe
windows10-2004-x64
10820ec15efb...db.exe
windows10-2004-x64
1088a5b8b09a...44.exe
windows10-2004-x64
109c0f7f6495...f7.exe
windows10-2004-x64
10bd0a957eae...c0.exe
windows7-x64
10bd0a957eae...c0.exe
windows10-2004-x64
10c8e229c276...39.exe
windows10-2004-x64
10ca2534058c...e4.exe
windows10-2004-x64
10d0c5f92763...68.exe
windows10-2004-x64
10d3f2262a94...31.exe
windows10-2004-x64
10d40527d1f8...ed.exe
windows10-2004-x64
10de4076a039...c9.exe
windows10-2004-x64
10f80bd79907...93.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
0068388548827b89762c020630c0e79519dedb7b7ff6c4f1c625aca59fbf5996.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
13243e4dd58e70de2748aff5360c6262fe2a6de7562acb1334b8a8adbb876f33.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
556fc723a7eab0f91113f11d7171070d3875bbfca8f5e2397500b5ee832c0310.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
5eb8ed45ba47d4135feaee11bbc17194ba1e8dfa693a293e370a7725fcfcd401.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
663bf6b48c7a6589e9a0bbabacbb8b22b1556f79bd63892788caae034d162437.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
67dbedea2ea23fd4fe189651241dd1489f71cf6bb5803d660d3d7ecd91ff5669.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
7e4d47aad3f9ebbd9422d69a7b96b1808810801c43b385031da5bd1472cbd411.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
88a5b8b09ad1e32abc7fce3415b25a2aa7be90802b17e91d650f6961ee4e8744.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
9c0f7f64959c0f4f98391ebbba925fb68cac09522971875cdbdf5e52983343f7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
c8e229c27623b0e1055a59f9b684a98468f33e92a47da3dcf5b041f74d4eca39.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
ca2534058cb45fd1c3c81407733fc01f8031c3b4f9d15b4210c762c631de25e4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
d0c5f927631e1bb113c5cb5f1178cddd83c9fa595df60b9ffc903fe23c0bcb68.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
d40527d1f87af48fe58a0377e98e5eafc8b6f2ba2f0023257f76d0c61f1096ed.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
de4076a0397d9f3a10c9a7ec7c19d95dd219e5330592bc236b71f5cea26f87c9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
f80bd799075b9e73bec4964dc911341456e6d8cb065c4ab30d36cb613faf6593.exe
Resource
win10v2004-20240508-en
General
-
Target
3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe
-
Size
2.6MB
-
MD5
c0bcbd6fc52faf83d90d164b9f48b136
-
SHA1
0735b86bbab76ed8e1930a049650bcac3b6a7c7b
-
SHA256
3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff
-
SHA512
370dd2f9cfff8104ad5bfc336b2e7c4e71ed3b8db7b4554278b2d2123cf406359643caa5304b5f60b607947992f86675560490dfd79368b812a817272a01c5b3
-
SSDEEP
49152:3MeeD89tUqsw3OHDAZzXrHxBvMrqL/MRjF6T9CJYNSKbyW3zV1OZoXmyd1Ouj2hg:d2ULVAUxvMrK/OjYRYKbyGzPOByd1Ou2
Malware Config
Extracted
risepro
193.233.132.51
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1ZH31tY0.exe -
Executes dropped EXE 4 IoCs
pid Process 1916 CL4eW53.exe 636 RT9RT92.exe 1872 qc6eQ33.exe 2324 1ZH31tY0.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" CL4eW53.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" RT9RT92.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" qc6eQ33.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1ZH31tY0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy 1ZH31tY0.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 1ZH31tY0.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 1ZH31tY0.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 1ZH31tY0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3352 schtasks.exe 4088 schtasks.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 400 wrote to memory of 1916 400 3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe 84 PID 400 wrote to memory of 1916 400 3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe 84 PID 400 wrote to memory of 1916 400 3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe 84 PID 1916 wrote to memory of 636 1916 CL4eW53.exe 86 PID 1916 wrote to memory of 636 1916 CL4eW53.exe 86 PID 1916 wrote to memory of 636 1916 CL4eW53.exe 86 PID 636 wrote to memory of 1872 636 RT9RT92.exe 87 PID 636 wrote to memory of 1872 636 RT9RT92.exe 87 PID 636 wrote to memory of 1872 636 RT9RT92.exe 87 PID 1872 wrote to memory of 2324 1872 qc6eQ33.exe 88 PID 1872 wrote to memory of 2324 1872 qc6eQ33.exe 88 PID 1872 wrote to memory of 2324 1872 qc6eQ33.exe 88 PID 2324 wrote to memory of 3352 2324 1ZH31tY0.exe 90 PID 2324 wrote to memory of 3352 2324 1ZH31tY0.exe 90 PID 2324 wrote to memory of 3352 2324 1ZH31tY0.exe 90 PID 2324 wrote to memory of 4088 2324 1ZH31tY0.exe 94 PID 2324 wrote to memory of 4088 2324 1ZH31tY0.exe 94 PID 2324 wrote to memory of 4088 2324 1ZH31tY0.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe"C:\Users\Admin\AppData\Local\Temp\3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CL4eW53.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CL4eW53.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RT9RT92.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RT9RT92.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qc6eQ33.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qc6eQ33.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ZH31tY0.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ZH31tY0.exe5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:3352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:4088
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD505acdfc80dbcf5ac3f40294b3aa6f5ec
SHA18ae3d21572f7e317b2c4ea35ddbf33ea942df8e5
SHA25640cbb6539b781edd97ade6a4846a4d4d9c105367cadeeb00e5105004c47be9ec
SHA51247a25f025ff9b69fb6c410ca8371d3ea3c5bcb06b2cd23fa2c84e67c71798c652a09b28d1d664f626fa96e3a0b2c8c4abb5bf97d7d271c7145b8b23dccc7e462
-
Filesize
1.7MB
MD552f1a5a4f61c3f6098f1df2288f511c3
SHA109c6a5ce1f16283d92e65f806ba7e37250a39203
SHA256748d2edd2e1bbe69ee2bccfc67903e1b6775ac333e8ca8afd6de2949a719ca89
SHA512fbec49f1e7fcc61eebdddbc725c977291b03fb095ec5cc078ad291e5ab9193564a350945b227639385d8a9b48b586b28747eed1eefe575294fa593660c3d0a28
-
Filesize
789KB
MD511d7499a2428770fbebfb1a10f6bc1fb
SHA1f05c3a1a6d7254ab01db1fc6e38710051d70ef76
SHA2560147759dab08d7c00348cfe786bd8da8d589b616c79f46c22869b3f19afd7659
SHA512e4809ba5085a100daed9c809e14cf39116b1152e1e5b9fe2cf0bec24e6e4655e3379c8d153e8e8e35f1b2e8d5931fac6df34a47e1c3c483bb25c06015fcd508e
-
Filesize
1.6MB
MD542d689b61fbe0c66f6e045d8919f75fd
SHA1ce10a2580c451b944897bcfcdd437ca38e2916f0
SHA25647cfd364fc08ab5f450e907c5c76147033d3dc2854bd6db7184496783474eba7
SHA51280e8dc66bd36ac041461936f224ecfd8ebdb7a7f409e64858bc639bdd101cf65234cb184fe1e0bb289e96c5572330941f6d0f156c6fbd76df45023fd339d139f