Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/06/2024, 21:32

General

  • Target

    e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7.exe

  • Size

    2.3MB

  • MD5

    fbe1e19b44ace48a53280d58c72f467a

  • SHA1

    fecd828a89404345e449686d80ecad9f1d80e491

  • SHA256

    e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7

  • SHA512

    0d6927e807de4305fa4f2714bb632e0ed9d2754cf7264f431021859e3430a514626df86a781d07cd86edf35a1dcf0f19ff0df38cb79ff6945c31a4f771adf1d3

  • SSDEEP

    49152:7+aeusaqYD7V+264A+Qo65PB77+3puBR2jkKM3zX:2usaDe+QowP5+3puBJKM

Score
10/10

Malware Config

Extracted

Family

risepro

C2

77.91.77.66:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7.exe
    "C:\Users\Admin\AppData\Local\Temp\e638bb3b6847c02f7a19ebbfc0f92c2f893b9dff7cb4a8867a7282f36626f6a7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1620-0-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-1-0x0000000077814000-0x0000000077816000-memory.dmp

    Filesize

    8KB

  • memory/1620-2-0x0000000000CC1000-0x0000000000D6D000-memory.dmp

    Filesize

    688KB

  • memory/1620-3-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-4-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-5-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-6-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-7-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-8-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-9-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-10-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-11-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-12-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-13-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-14-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-15-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-16-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-17-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-18-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-19-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-20-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB

  • memory/1620-21-0x0000000000CC0000-0x00000000012AF000-memory.dmp

    Filesize

    5.9MB