General
- Target RisxnExtreme.exe
- Size 2.2MB
- Sample260718-yd3yrsa15m
- SHA256 aba40c34459e5c0ab112e963e994d01019eeabdabd06c09c938798b6210dd902
- MD5 278e85ba604d717655a6bbe9a38617ca
- SHA1 ca458b41aff3797aab7beb16e2a7bd50601a2446
- SHA512 704353e92aa7c1dc1669513a26c6a7d1c8d35875829712e691aee12c38866f216b546d64a085eb3c0b2697b841003e2bee27b3cceff92f00bdd83073ae3d7e1f
- SSDEEP 24576:U4reX4hjui/FNM3kqjVnlqud+/2P+A94KQPUKQ9bNRh251UJ8tqsgta5aD7qZPAa:U4qn67M3kqXfd+/9Au5QpJ2n4XcAm
- TLSH T1ADA5E67D37C1EC40FFBC62B0A2A2CD211A21F9661D8151413CAB12F687979D32E9FB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RisxnExtreme.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
RisxnExtreme.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target RisxnExtreme.exe
- Size 2.2MB
- SHA256 aba40c34459e5c0ab112e963e994d01019eeabdabd06c09c938798b6210dd902
- MD5 278e85ba604d717655a6bbe9a38617ca
- SHA1 ca458b41aff3797aab7beb16e2a7bd50601a2446
- SHA512 704353e92aa7c1dc1669513a26c6a7d1c8d35875829712e691aee12c38866f216b546d64a085eb3c0b2697b841003e2bee27b3cceff92f00bdd83073ae3d7e1f
- SSDEEP 24576:U4reX4hjui/FNM3kqjVnlqud+/2P+A94KQPUKQ9bNRh251UJ8tqsgta5aD7qZPAa:U4qn67M3kqXfd+/9Au5QpJ2n4XcAm
- TLSH T1ADA5E67D37C1EC40FFBC62B0A2A2CD211A21F9661D8151413CAB12F687979D32E9FB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
UAC bypass
-
Checks whether UAC is enabled
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1