Analysis
-
max time kernel
435s -
max time network
1157s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
26-10-2024 17:09
General
-
Target
Rise 6.1.31/start.cmd
-
Size
41B
-
MD5
d81f3f20ef2eda780a107a9b50cc718b
-
SHA1
6fe33901c94fe7005d27af5d4ce9de2bc9a3e908
-
SHA256
d9cff4ea291d91d405dfb8ec36e2ce7f85bd0c00d37efa1da29f8ca5c872d0c9
-
SHA512
1960a59230fb721045cdc232446c45f56ac60762be96e555db119184c1526b6af785d8a14a934f440bf12e385a94c8cb9d9b767271abf42444dd98ea8f8c98df
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Rise 6.1.31\start.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar Rise.jar2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729963761525.tmp3⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729963761525.tmp" /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729963761525.tmp" /f4⤵
- Adds Run key to start application
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5a779eb6d2f7e5970cd5b28c266af3ded
SHA1d996612fdb4751724ea3ada7467fccb65faeeb5f
SHA256b30140b9fa218b71b4b90d2b512343cabb7c912d9743ee5a2c8a901445bed591
SHA5123faa2e2cf18fe500cb58b582159181bca4c4e07f3158fc559bff721818400048333d9c5fdce7a9982f08322b46de7f5f278f3d19720ce95cab08e470d9a57057
-
Filesize
67KB
MD55166d5ab693e728f291cae413fd64f14
SHA1b6fdffc6fbe3a5700a0fc04ed45c38ec5e385bdd
SHA256e4ca8e23b366ce75e8f3e90bc707f1ade1cdcbba8545e800a614e688c19b0b91
SHA512564f442bae39342e4522d557e4e21ed593ce685a58b2637467cba0ec8e793f291e74e9204f3329e2c0f1979d812f5161e9e751296caed91504449975ac6f5d72
-
Filesize
26KB
MD5263e0356bb950798118d6aba0325eeed
SHA15d2a83e058f07a18eac0e9aadde1e0930610928a
SHA256d2a3e36fe18eca1975f787d7575d02f158f37229794925695f34278978bec763
SHA5128c3f94ca0df7cd0a3d5cc1bf12870364c56bd645ceff0d241bb5204029312da9cf0e82e2a2a23c806421303bfa794a605921f442cec9ca6a02ab4daba953db94
-
Filesize
51KB
MD5ab7b65c471b1b5f9531555dfce3b45e6
SHA16674397b7f66ab89f1a5590afe8a4666e3c9d175
SHA256affdb16e49bb6f60bd8192782a5616930c56d2958b22db82f42c1206f3f6b46e
SHA5127815db4c0a6176842d4f655921ff895c72dd05d63d4d17692a8b76ef2a8c0f8f96bfd28e8bde559c3829ee1012a6d3ae6b3bfbc941cd35d1eca50e7a43d56b31
-
Filesize
73KB
MD5260fde20df4b5a6efe1b51c5d8b3e441
SHA17470c635ac563d58105a5d63d1b1db6c6fb410cc
SHA2566392718429b14e98bacfbece27b5bc080f8472bc1a98ac7a31a7d7b78e84772b
SHA512558965320ed16df98807afc1e89f243b5011bf520ada3a5c4a4e5745703a220d98b112c75d090b283194d997818815abbba05311e5de6786ff660a283a705b39
-
Filesize
11.7MB
MD562e3fbd568560b6b3ceeeb7f15befcf3
SHA1499c81be40a7a5a7cdde84d9989a20f19039e9f5
SHA256905de877c30480cee378952ac08624c62740c6ba168187842e980639ab531d7c
SHA5123ed369cf87b209ea690163093e53b863d417288391e7133459227c48acad54fce88344c6de0cef0321048a1e8c05cea9ebe8659074f2fe474a70989b5019829c
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB