Risxn's Process Lowering Pack V4[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Risxn's Process Lowering Pack V4.rar
Size 508KB
Sample260715-cb3dkab14x
SHA256 c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d
MD5 ce70aa1f6fa1cc0a14e079fc56b65970
SHA1 b58671b63bb764f285896a824f5020c314e651fa
SHA512 0034f6177a6af1305903d554a4611c8c7a0e77bb511ceb0b9cb3c767a2febc113ce372ac9643637ca4181cb124f7e99c02ddee6c472b9069b35f6869431263bf
SSDEEP 12288:MfYoh0Bs57nrMWRQKnjBF1Z04MZAbD/0aBrn6zwiGVd:MtKBQ7rdRQKnVF1Zffco
TLSH
T122B423D6673A1E183CEA36FB0CA3D66FA2519CC2DC5335770633917F2C0A4A5B06CA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Risxn's Process Lowering Pack V4.rar

.rar 508KB
Risxn's Process Lowering Pack V4/1. Create Restore Point.lnk

.lnk 1KB
Risxn's Process Lowering Pack V4/2. System Configuration.lnk

.lnk 1KB
Risxn's Process Lowering Pack V4/3. autoruns.exe

.exe 1.7MB
Risxn's Process Lowering Pack V4/4. Task Manager.lnk

.lnk 1KB
Risxn's Process Lowering Pack V4/Risxn's Process Panel V4.bat

.bat .vbs 40KB
Risxn's Process Lowering Pack V4/Use Restore Point.lnk

.lnk 1KB

Risxn's Process Lowering Pack V4.rar

SHA256 c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d
MD5 ce70aa1f6fa1cc0a14e079fc56b65970
SHA1 b58671b63bb764f285896a824f5020c314e651fa
SHA512 0034f6177a6af1305903d554a4611c8c7a0e77bb511ceb0b9cb3c767a2febc113ce372ac9643637ca4181cb124f7e99c02ddee6c472b9069b35f6869431263bf
SSDEEP 12288:MfYoh0Bs57nrMWRQKnjBF1Z04MZAbD/0aBrn6zwiGVd:MtKBQ7rdRQKnVF1Zffco
TLSH
T122B423D6673A1E183CEA36FB0CA3D66FA2519CC2DC5335770633917F2C0A4A5B06CA91
MD5 SHA1 SHA512 SSDEEP TLSH

Risxn's Process Lowering Pack V4/3. autoruns.exe

IMPHASH ee7d0ec49c38d4f4d12574e449f1a355
SHA256 6111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb
MD5 17bd13edd536269c417ba8e1b4534fbe
SHA1 22470bb3a4c37a0c612ff7ad2596306065ac0c9b
SHA512 00d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455
SSDEEP 12288:5nhZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5b8:s0qQhMIX0e8uOR2xZnkiYWZk3
TLSH
T133854AE321DA842AC87D4530012486BE06FF6E7E5BE348DB92C77E2957704CD6E32A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

bf:30:20:a0:42:0e:26:5e:60:73:43:49:b4:41:b7:ed:c7:d8:97:fa:20:fc:38:12:03:a5:93:53:98:4e:0d:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 27, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

519821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\1\s\Win32\Release\Autoruns.pdb

kernel32

ReadConsoleInputW SetConsoleMode GetConsoleMode GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetConsoleCP ExitProcess VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount GetCPInfo GetSystemTimeAsFileTime FlushFileBuffers QueryPerformanceCounter LCMapStringEx InitOnceBeginInitialize InitOnceComplete AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetFullPathNameW GetNativeSystemInfo IsWow64Process GetFileTime QueryDosDeviceW GetLogicalDrives SearchPathW K32GetMappedFileNameW WaitForMultipleObjects CreateSemaphoreW CreateEventW SetEnvironmentVariableW FindClose FindNextFileW FindFirstFileW ReleaseSemaphore SetEvent UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize FileTimeToLocalFileTime TrySubmitThreadpoolCallback CreateThreadpoolTimer CloseThreadpoolTimer SetThreadpoolTimer GetWindowsDirectoryW GetSystemWow64DirectoryW GetSystemWindowsDirectoryW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadFile WriteConsoleW LocalAlloc GetFileType GetStdHandle GetVersionExW GetTickCount64 GetSystemDirectoryW TerminateThread CreateThread WaitForSingleObject WideCharToMultiByte OpenProcess Sleep ExpandEnvironmentStringsW GetStartupInfoW CreateProcessW GetCommandLineW VerifyVersionInfoW GetComputerNameW lstrcmpW LocalFree VirtualQuery GetCurrentProcessId VerSetConditionMask MoveFileW SetFileAttributesW RemoveDirectoryW CreateDirectoryW GetNumberFormatEx GetLocaleInfoW GetTimeFormatW GlobalAlloc GetDateFormatW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetFileInformationByHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime MultiByteToWideChar lstrcmpiW LoadLibraryExW ReadConsoleW SetThreadPriority GetCurrentThread DecodePointer SetCurrentDirectoryW FormatMessageW GetModuleHandleExW GetModuleFileNameA DebugBreak lstrlenW MulDiv LoadLibraryW FreeLibrary GetThreadId CloseHandle GetTempPathW WriteFile GetTempFileNameW DeleteFileW CreateFileW GetModuleFileNameW GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RaiseException GetPrivateProfileStringW GetPrivateProfileIntW GetFileAttributesW GetProcAddress GetModuleHandleW GetCurrentProcess FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GlobalLock GlobalUnlock

user32

CloseClipboard SendMessageW SetClipboardData EmptyClipboard IsRectEmpty EnumDisplaySettingsW FindWindowExW FindWindowW SetForegroundWindow WaitForInputIdle IsDlgButtonChecked CheckDlgButton EnableWindow GetDlgItemTextW DestroyMenu SetMenuItemInfoW GetSysColor LoadImageW DialogBoxIndirectParamW OpenClipboard DrawIconEx DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW SetFocus GetFocus SetTimer KillTimer DrawTextW BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect MonitorFromPoint IsDialogMessageW CheckMenuRadioItem GetWindowThreadProcessId GetDesktopWindow SetRectEmpty SetRect WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos MessageBeep AdjustWindowRectEx SetMenuDefaultItem GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenuEx DeleteMenu RemoveMenu ModifyMenuW AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu EnableMenuItem CreatePopupMenu GetMenuStringW SetMenu GetMenu TranslateAcceleratorW ReleaseCapture SetCapture GetCapture GetKeyState GetActiveWindow CharLowerW GetDlgCtrlID DialogBoxParamW CreateDialogParamW SetWindowPlacement GetWindowPlacement IsMenu PostQuitMessage GetMessagePos DrawFrameControl DrawEdge TrackMouseEvent RegisterWindowMessageW LoadStringA EnumChildWindows MessageBoxW LoadMenuW LoadAcceleratorsW CharNextW DestroyWindow IsWindow PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW LoadIconW GetDlgItem GetWindow MapWindowPoints GetWindowRect SetDlgItemTextW EndDialog GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW GetScrollInfo SetScrollInfo DestroyIcon CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongW PtInRect OffsetRect InflateRect CopyRect FrameRect FillRect DrawFocusRect ScreenToClient ShowScrollBar SetScrollPos RedrawWindow ReleaseDC GetWindowDC GetDC UpdateWindow GetSystemMetrics IsWindowEnabled IsZoomed IsWindowVisible SetWindowPos MoveWindow ShowWindow IsChild PostMessageW GetSysColorBrush LoadCursorW GetParent SetWindowLongW GetWindowLongW

gdi32

SetBkColor SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt ExtTextOutW SetViewportOrgEx CreateFontIndirectW SetBkMode SetTextColor GetObjectW CreateSolidBrush CreatePen GetDeviceCaps GetStockObject GetTextExtentPoint32W LineTo Rectangle SetTextAlign MoveToEx TextOutW Polyline CreateBitmap CreatePatternBrush ExcludeClipRect PatBlt CreateDIBSection SetBrushOrgEx SetMapMode StartDocW EndDoc StartPage EndPage Polygon GetCurrentObject

comdlg32

PrintDlgW ChooseFontW FindTextW GetOpenFileNameW GetSaveFileNameW

advapi32

RegEnumKeyExW CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam RegLoadMUIStringW LookupPrivilegeValueW AdjustTokenPrivileges QueryServiceConfig2W GetServiceDisplayNameW CryptDestroyHash RegGetValueW RegOpenKeyW RegCreateKeyW RegRenameKey RegEnumValueW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle ConvertStringSidToSidW LookupAccountSidW RegCopyTreeW RegDeleteTreeW RegQueryValueExW ConvertSidToStringSidW RegLoadKeyW IsValidSid GetTokenInformation GetLengthSid CopySid OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey CryptReleaseContext

shell32

ShellExecuteW SHEvaluateSystemCommandTemplate SHGetStockIconInfo ExtractIconExW SHGetKnownFolderPath ExtractAssociatedIconW CommandLineToArgvW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance StringFromGUID2 CLSIDFromString CoTaskMemFree CoTaskMemRealloc StgCreateStorageEx StgOpenStorageEx CoTaskMemAlloc

oleaut32

SysStringLen VariantClear VarUI4FromStr SysFreeString SysAllocString VariantInit

shlwapi

SHCreateStreamOnFileW SHAutoComplete

comctl32

ImageList_Destroy ImageList_DrawIndirect ImageList_GetImageCount ImageList_Create ImageList_WriteEx ImageList_Read ImageList_GetIcon ImageList_ReplaceIcon InitCommonControlsEx ImageList_GetIconSize ImageList_Duplicate ImageList_DrawEx CreateStatusWindowW ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_AddMasked ImageList_Draw

uxtheme

IsThemeActive SetWindowTheme IsAppThemed

msimg32

GradientFill

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

dwmapi

DwmSetWindowAttribute DwmDefWindowProc

winhttp

WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpConnect

crypt32

CertGetNameStringW