e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RisxnBoost.exe
Size

13KB
MD5

bc0042fdab4b082ce767ed9a9f08b492
SHA1

837ee6acbc279292da3f8bf5ba2b0e60e897b2ed
SHA256

e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671
SHA512

aba843c53255d5268eaa40d7c4cf3bbd7b298981b1f11cfaccbb759896ee8aebd33b8b8d9ce99fa075374684db8f4e0987ddd5ae0c51d4d84e26466777fa83e7
SSDEEP

384:9DMu9YLDZWi7W/dCHaNJawcudoD7UqkkO+Ozu:pMu8WkL6nbcuyD7U

Score

10^/10

discovery evasion execution trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	b2e.exe

Loads dropped DLL 2 IoCs

pid	Process
1620	RisxnBoost.exe
1620	RisxnBoost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1620-12-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2832	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RisxnBoost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2832	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	30
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	30
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	30
PID 1620 wrote to memory of 2324	1620	RisxnBoost.exe	30
PID 2324 wrote to memory of 796	2324	b2e.exe	31
PID 2324 wrote to memory of 796	2324	b2e.exe	31
PID 2324 wrote to memory of 796	2324	b2e.exe	31
PID 2324 wrote to memory of 796	2324	b2e.exe	31
PID 796 wrote to memory of 484	796	cmd.exe	33
PID 796 wrote to memory of 484	796	cmd.exe	33
PID 796 wrote to memory of 484	796	cmd.exe	33
PID 796 wrote to memory of 484	796	cmd.exe	33
PID 796 wrote to memory of 2236	796	cmd.exe	34
PID 796 wrote to memory of 2236	796	cmd.exe	34
PID 796 wrote to memory of 2236	796	cmd.exe	34
PID 796 wrote to memory of 2236	796	cmd.exe	34
PID 796 wrote to memory of 2744	796	cmd.exe	35
PID 796 wrote to memory of 2744	796	cmd.exe	35
PID 796 wrote to memory of 2744	796	cmd.exe	35
PID 796 wrote to memory of 2744	796	cmd.exe	35
PID 796 wrote to memory of 2820	796	cmd.exe	36
PID 796 wrote to memory of 2820	796	cmd.exe	36
PID 796 wrote to memory of 2820	796	cmd.exe	36
PID 796 wrote to memory of 2820	796	cmd.exe	36
PID 796 wrote to memory of 2804	796	cmd.exe	37
PID 796 wrote to memory of 2804	796	cmd.exe	37
PID 796 wrote to memory of 2804	796	cmd.exe	37
PID 796 wrote to memory of 2804	796	cmd.exe	37
PID 796 wrote to memory of 2832	796	cmd.exe	38
PID 796 wrote to memory of 2832	796	cmd.exe	38
PID 796 wrote to memory of 2832	796	cmd.exe	38
PID 796 wrote to memory of 2832	796	cmd.exe	38
PID 796 wrote to memory of 2616	796	cmd.exe	41
PID 796 wrote to memory of 2616	796	cmd.exe	41
PID 796 wrote to memory of 2616	796	cmd.exe	41
PID 796 wrote to memory of 2616	796	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe
"C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\C2A3.tmp\batchfile.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:484
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2236
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2832
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C2A3.tmp\batchfile.bat

Filesize
7KB

MD5
5a95e2ef57f88ba9d2615eb9bdda1bae

SHA1
3172110f628a747a5b1468d79c3337d10d6ee005

SHA256
905aff32847ecf10d10b85ec7affdfb52109815ee2e93f5681440bf1cd210aef

SHA512
ddc5484de715449f6802054dc4733d4884aa368e704f66fac1530b77e05b12fd92c4afeb93dbea166f4deaae1335aa3d24bbf8710ba57d28a737fe4a82e12f4f

Download Submit
\Users\Admin\AppData\Local\Temp\C207.tmp\b2e.exe

Filesize
16KB

MD5
dd91a1046be6aa01ca5234044ec98b61

SHA1
d81a3442289b83214f5c2033d991a657a8f31704

SHA256
89deecad9df7521c3ff747cb56f10aaceb41f32ecda72fb06624280e45d21e7d

SHA512
bdc79f7906f739c75add8d4dc6ba90f7c38ede0400db3b2b5b6f47fb217cd13ec0ba8dea77053112ea8de768ad7dc137eb54a893b6024d4dc181dad4d7c28fcf

Download Submit
memory/1620-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1620-5-0x0000000000250000-0x0000000000255000-memory.dmp

Filesize
20KB

Download
memory/1620-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2324-13-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2324-32-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download