Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
81s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10/08/2024, 19:14
General
-
Target
Rainway_Install.exe
-
Size
1.7MB
-
MD5
ad4754db135f7eda022c773a4f11964e
-
SHA1
99772e856db59c805fd8b89655c58f7774b18401
-
SHA256
db1e4d06304ed0691430743df480a697818b8b280433010991e07e1462a27e5f
-
SHA512
1fcf59e62a530c31f740f5ea132fdf0532f7bec7373ff9923e123771fecab6b2e274b5034bfd6f7953fb8259fb47f51d0c8d4cc15f87ff9dde736c5c71777853
-
SSDEEP
24576:h7FUDowAyrTVE3U5FrBhJN/4QRdZ+Ile0d4JnlfJQzT3Nr1WRB0t9nC6kzPG:hBuZrEUP/RdFgo4JlBUTh4vrdzPG
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rainway_Install.exe"C:\Users\Admin\AppData\Local\Temp\Rainway_Install.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7MUOJ.tmp\Rainway_Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-7MUOJ.tmp\Rainway_Install.tmp" /SL5="$B02F8,882176,0,C:\Users\Admin\AppData\Local\Temp\Rainway_Install.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Rainway Inc\Rainway\Rainway.exe"C:\Program Files (x86)\Rainway Inc\Rainway\Rainway.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Rainway Inc\Rainway\Rainway.exe"C:\Program Files (x86)\Rainway Inc\Rainway\Rainway.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD563fa7f73aec46c60f6eebbb359faa77e
SHA165c30d226fb4b0ac36f4164b1a2b19a45afb34ba
SHA256bbaacd4552aec4788e09564f37c960d9662fe0a65ace1b0425f06763e1f18a53
SHA512f149577314076a10131465ab180dcd626755c7a011ff2a941d5e659631a0b2412bc0fd0d91b826a36f28eafa0c7d31d25b87d3e26cf945450d14a49e308c46aa
-
Filesize
5.0MB
MD5806d33a8300e885c3c1a00c6107af8eb
SHA1123fe310d1d035932b65fac5006209c4dcd692bf
SHA2569c20fb2ad86a760b0c6aebd9301c9009891d02ae14720a93926c0b535b8ad09b
SHA51267f10d63e09a19a1110c2c4f4abf057083757045cc8e7b08e94a9d8c46142b7e2ab01cde8783ee02a85fbb912ff9d06541f1117c1df182762207efbb7289c6bb
-
Filesize
3.1MB
MD533a23ada2b7453bb28ec9718d03b2264
SHA19cc6196f387f974a71e3edbba47d7c0e623f8830
SHA256c8adab156d15a6f8cdeb85524bbaa39c274e2b29b2fd2669e5a831e1b9bcc8d4
SHA5122d02fc1116bd6d6c0df7195a8db7b3c3d4c3e29b970854ba4feb98fba2e1e88f76d502625869ee37cd58674af4c72de3be7e78213744c1b24b2cf12630280974
-
Filesize
61.8MB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
61.8MB
-
Filesize
61.8MB
-
Filesize
916KB
-
Filesize
916KB
-
Filesize
728KB
-
Filesize
916KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB