aba40c34459e5c0ab112e963e994d01019eeabdabd06c09c938798b6210dd902

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
43s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RisxnExtreme.exe
Size 2.2MB
Sample260718-yd3yrsa15m
SHA256 aba40c34459e5c0ab112e963e994d01019eeabdabd06c09c938798b6210dd902
MD5 278e85ba604d717655a6bbe9a38617ca
SHA1 ca458b41aff3797aab7beb16e2a7bd50601a2446
SHA512 704353e92aa7c1dc1669513a26c6a7d1c8d35875829712e691aee12c38866f216b546d64a085eb3c0b2697b841003e2bee27b3cceff92f00bdd83073ae3d7e1f
SSDEEP 24576:U4reX4hjui/FNM3kqjVnlqud+/2P+A94KQPUKQ9bNRh251UJ8tqsgta5aD7qZPAa:U4qn67M3kqXfd+/9Au5QpJ2n4XcAm
TLSH
T1ADA5E67D37C1EC40FFBC62B0A2A2CD211A21F9661D8151413CAB12F687979D32E9FB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RisxnExtreme.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RisxnExtreme.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RisxnExtreme.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3120	cscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
924	powershell.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
3684	cmd.exe
5996	cmd.exe
4320	cmd.exe
4100	cmd.exe
3680	cmd.exe
2836	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
924	powershell.exe
924	powershell.exe
924	powershell.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe
3472	RisxnExtreme.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3472	RisxnExtreme.exe
Token: SeDebugPrivilege	924	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4160	3472	RisxnExtreme.exe	90
PID 3472 wrote to memory of 3684	3472	RisxnExtreme.exe	93
PID 3684 wrote to memory of 4348	3684	cmd.exe	95
PID 3472 wrote to memory of 5996	3472	RisxnExtreme.exe	96
PID 3472 wrote to memory of 4320	3472	RisxnExtreme.exe	98
PID 4320 wrote to memory of 3120	4320	cmd.exe	100
PID 3472 wrote to memory of 3124	3472	RisxnExtreme.exe	101
PID 3472 wrote to memory of 4100	3472	RisxnExtreme.exe	103
PID 4100 wrote to memory of 924	4100	cmd.exe	105
PID 3472 wrote to memory of 3680	3472	RisxnExtreme.exe	108
PID 3472 wrote to memory of 2836	3472	RisxnExtreme.exe	110
PID 2836 wrote to memory of 1956	2836	cmd.exe	112

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RisxnExtreme.exe

C:\Users\Admin\AppData\Local\Temp\RisxnExtreme.exe
"C:\Users\Admin\AppData\Local\Temp\RisxnExtreme.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3472
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\AutoRun.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:4348
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0C
  2⤵
  - Executes a command shell one-liner
  PID:5996
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cscript //nologo "C:\temp\popup.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\temp\popup.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c del "C:\temp\popup.vbs"
  2⤵
  PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'>nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:924
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c color 0B
  2⤵
  - Executes a command shell one-liner
  PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mode 160,125
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\mode.com
    mode 160,125
    3⤵
    PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3380

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tmp6112.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6112.tmp
Size 2KB
SHA256 ffbb88f2a28f7fe28155218c803228ec889a81496a0c00eda7466bf79867285f
MD5 bf2b1c7dfa7d05fc7ce978fd6f1a8410
SHA1 4507fba824c88e36f568c7adc8f84ea05ce093b8
SHA512 1af95e162bc599ec9b257d3fa82314ea666241dac470f455feb53bed233f5dabcabfd787ab82b2a0e9ba8af73785668cebc0c4549b46f34790ccd21d6a087a91
TLSH
T12B5109ABA5AE60E97E2CAF95B55D0E435EC0C34390C1221F36741E160ABD36CF5FC926
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3472-20-0x000000001E760000-0x000000001E812000-memory.dmp

Download

memory/3472-23-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-6-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-1-0x0000000000990000-0x0000000000BBA000-memory.dmp

Download

memory/3472-16-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-17-0x000000001E140000-0x000000001E362000-memory.dmp

Download

memory/3472-18-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-19-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-21-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-0-0x00007FFE4128F000-0x00007FFE41290000-memory.dmp

Download

memory/3472-5-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-24-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-22-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-27-0x0000000020F90000-0x0000000020FB2000-memory.dmp

Download

memory/3472-28-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-29-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-30-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-31-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-32-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-33-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp

Download

memory/3472-37-0x000000001DD40000-0x000000001DD50000-memory.dmp

Download