General
- Target RisxnExtreme.zip
- Size 1.0MB
- Sample260620-eej3hac13k
- SHA256 2f7ce52ca4c007abdbdb155f68870e9a6a7ce9957a27f0b58148020233ba0dba
- MD5 ef3fed49f0e4c3d506d24d3b468b0fe9
- SHA1 6a899d3d115211d13fde7a38c054549a33a5cfc1
- SHA512 d004397c56254ca00745bb60e89ad6815bd6960d86f268ef23ae4eff67d845c8c62b004606eefc0f266dc8dbceba4f8fb2e61f3bf9244dab2d4cf547e026f823
- SSDEEP 12288:Ruz34lhTUvl3Zi2hzutXaP4rXOCytvOkHQvHci5PSI8nFg+SahbqqA2xmetv4Ka6:ALkTU18uxtmkwVlz8ndVA8raIhJmzg
- TLSH T10A2533D5A4AFC7E142E13FE08C65A3592CE322E5AF4849094D672773FECC289531B5A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RisxnExtreme.zip
Resource
win11ltsc2024-20260618-en
12 signatures
600 seconds
Malware Config
Targets
-
- Target RisxnExtreme.zip
- Size 1.0MB
- SHA256 2f7ce52ca4c007abdbdb155f68870e9a6a7ce9957a27f0b58148020233ba0dba
- MD5 ef3fed49f0e4c3d506d24d3b468b0fe9
- SHA1 6a899d3d115211d13fde7a38c054549a33a5cfc1
- SHA512 d004397c56254ca00745bb60e89ad6815bd6960d86f268ef23ae4eff67d845c8c62b004606eefc0f266dc8dbceba4f8fb2e61f3bf9244dab2d4cf547e026f823
- SSDEEP 12288:Ruz34lhTUvl3Zi2hzutXaP4rXOCytvOkHQvHci5PSI8nFg+SahbqqA2xmetv4Ka6:ALkTU18uxtmkwVlz8ndVA8raIhJmzg
- TLSH T10A2533D5A4AFC7E142E13FE08C65A3592CE322E5AF4849094D672773FECC289531B5A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
UAC bypass
-
Modifies boot configuration data using bcdedit
-
Loads dropped DLL
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1