e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671

General

Target

RisxnBoost.exe
Size

13KB
MD5

bc0042fdab4b082ce767ed9a9f08b492
SHA1

837ee6acbc279292da3f8bf5ba2b0e60e897b2ed
SHA256

e6e927973d20d6a1734c4b2588d0e8393c7372cf632f7938cfc5baabfbe0f671
SHA512

aba843c53255d5268eaa40d7c4cf3bbd7b298981b1f11cfaccbb759896ee8aebd33b8b8d9ce99fa075374684db8f4e0987ddd5ae0c51d4d84e26466777fa83e7
SSDEEP

384:9DMu9YLDZWi7W/dCHaNJawcudoD7UqkkO+Ozu:pMu8WkL6nbcuyD7U

Score

10^/10

discovery evasion execution trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RisxnBoost.exeb2e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RisxnBoost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

Processes:

b2e.exe

pid process

2912 b2e.exe

pid	process
2912	b2e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2260-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2260-10-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4352 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4352	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exechcp.comRisxnBoost.exeb2e.exereg.exereg.exereg.exepowershell.exereg.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RisxnBoost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4352 powershell.exe
4352 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4352 powershell.exe

pid	process
4352	powershell.exe
4352	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4352	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

RisxnBoost.exeb2e.execmd.exe

description	pid	process	target process
PID 2260 wrote to memory of 2912	2260	RisxnBoost.exe	b2e.exe
PID 2260 wrote to memory of 2912	2260	RisxnBoost.exe	b2e.exe
PID 2260 wrote to memory of 2912	2260	RisxnBoost.exe	b2e.exe
PID 2912 wrote to memory of 1920	2912	b2e.exe	cmd.exe
PID 2912 wrote to memory of 1920	2912	b2e.exe	cmd.exe
PID 2912 wrote to memory of 1920	2912	b2e.exe	cmd.exe
PID 1920 wrote to memory of 4524	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 4524	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 4524	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 3704	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 3704	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 3704	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1816	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1816	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1816	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1640	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1640	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 1640	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 2396	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 2396	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 2396	1920	cmd.exe	reg.exe
PID 1920 wrote to memory of 4352	1920	cmd.exe	powershell.exe
PID 1920 wrote to memory of 4352	1920	cmd.exe	powershell.exe
PID 1920 wrote to memory of 4352	1920	cmd.exe	powershell.exe
PID 1920 wrote to memory of 4908	1920	cmd.exe	chcp.com
PID 1920 wrote to memory of 4908	1920	cmd.exe	chcp.com
PID 1920 wrote to memory of 4908	1920	cmd.exe	chcp.com

C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe
"C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\8368.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\8368.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8368.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\RisxnBoost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\855C.tmp\batchfile.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1816
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4352
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8368.tmp\b2e.exe

Filesize
16KB

MD5
dd91a1046be6aa01ca5234044ec98b61

SHA1
d81a3442289b83214f5c2033d991a657a8f31704

SHA256
89deecad9df7521c3ff747cb56f10aaceb41f32ecda72fb06624280e45d21e7d

SHA512
bdc79f7906f739c75add8d4dc6ba90f7c38ede0400db3b2b5b6f47fb217cd13ec0ba8dea77053112ea8de768ad7dc137eb54a893b6024d4dc181dad4d7c28fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\855C.tmp\batchfile.bat

Filesize
7KB

MD5
5a95e2ef57f88ba9d2615eb9bdda1bae

SHA1
3172110f628a747a5b1468d79c3337d10d6ee005

SHA256
905aff32847ecf10d10b85ec7affdfb52109815ee2e93f5681440bf1cd210aef

SHA512
ddc5484de715449f6802054dc4733d4884aa368e704f66fac1530b77e05b12fd92c4afeb93dbea166f4deaae1335aa3d24bbf8710ba57d28a737fe4a82e12f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ffjv4xm.fxh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2260-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2260-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2912-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2912-38-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4352-18-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/4352-17-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

Filesize
136KB

Download
memory/4352-19-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/4352-16-0x0000000004F90000-0x00000000055B8000-memory.dmp

Filesize
6.2MB

Download
memory/4352-29-0x0000000005A00000-0x0000000005D54000-memory.dmp

Filesize
3.3MB

Download
memory/4352-30-0x0000000005E70000-0x0000000005E8E000-memory.dmp

Filesize
120KB

Download
memory/4352-31-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

Filesize
304KB

Download
memory/4352-32-0x00000000063E0000-0x0000000006476000-memory.dmp

Filesize
600KB

Download
memory/4352-33-0x0000000006370000-0x000000000638A000-memory.dmp

Filesize
104KB

Download
memory/4352-34-0x0000000006E40000-0x0000000006E62000-memory.dmp

Filesize
136KB

Download
memory/4352-35-0x0000000007420000-0x00000000079C4000-memory.dmp

Filesize
5.6MB

Download
memory/4352-15-0x00000000048D0000-0x0000000004906000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads