Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 13:05
General
-
Target
Rusticaland-launcher.exe
-
Size
64.8MB
-
MD5
cf54cb776822a73090dc6b676e38782a
-
SHA1
f1ac2a51e35e30c07ed2df769135295d3a5a88bf
-
SHA256
fc93d7953819ec00809d4b231ce8b96d67d3a8cd46d13d0becb463fe16bde68f
-
SHA512
8cb5dcb036662939b45d4c6ef991291f6d5efbac5fff79a01c43181632acd081f68f6ffe4459aec1ee2c7d3880ef8fcd5e44b85e173491034ccb5945be89c081
-
SSDEEP
1572864:R9LHOdEv/78Bl9Bzs7hwOq/VE2kUC7dTiMuR34H8P7o92Zh:zjOU/e9FOIaLW1xP7o92Z
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rusticaland-launcher.exe"C:\Users\Admin\AppData\Local\Temp\Rusticaland-launcher.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD5fbff1229740ae7a2d80814ac4404c0c8
SHA1ae7c22aca87f90f3ef47d764e0d409dec5eb4a5b
SHA256ba3fbc7f29c93bc7fe7107645b57b1a88352ba2eae2ba6c3d530a38627b891e6
SHA512341e9540ffda91f9fab305baefd340921c1c1e3e57ac91ad5ccd12f990304e2844657d32f1cee5f93a1ed59436e0c31c2542b992cd67118fe750405a3b8a970e
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
156KB
MD51ba96800bad54c6019fdb6fe41fca592
SHA1b443b01719c3046d9107e93d181d5da38e6650aa
SHA256dcf3c4f6024313eeb6f775ed343265d73be1ce1d5dde2f92195dbc32310c7fc9
SHA512499764e2c75e9afb25e19941312221d3fce7c058ffac8293db5986a6a9b8dd77c45bf93311858470bec9afbd64dc3068b3d9a26d3e01051b9d51c02b1c2484c2
-
Filesize
5.0MB
MD5ecc578e589d671109bbc291268e24854
SHA12c7153ad8b0464c679cf28344f787bab713ba878
SHA256ddf635d42349620ecf288b1b2bc4006f9a4849c5b136847c9c5e44651790dc6a
SHA5129b1691a7236be5c0a04421f65fdd91b3bdbf283879c92e8076f11c50bacafcd6faa746e743e73c65b971ce9678098630daac0d88a52ed2c2ba1af4f51d60a998
-
Filesize
8KB
-
Filesize
64.8MB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
112KB
-
Filesize
12.9MB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
19.4MB
-
Filesize
5.1MB
-
Filesize
760KB
-
Filesize
48KB
-
Filesize
432KB
-
Filesize
712KB
-
Filesize
864KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
280KB
-
Filesize
1.9MB
-
Filesize
4.5MB
-
Filesize
7.7MB
-
Filesize
920KB
-
Filesize
944KB
-
Filesize
6.6MB
-
Filesize
3.6MB
-
Filesize
3.0MB
-
Filesize
48KB
-
Filesize
2.1MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
128KB
-
Filesize
10.8MB
-
Filesize
8.4MB
-
Filesize
3.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
680KB
-
Filesize
10.8MB