Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23/03/2021, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
784754123687.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
784754123687.bin.exe
Resource
win10v20201028
General
-
Target
784754123687.bin.exe
-
Size
637KB
-
MD5
a96c22902a9a7c5d4fc3282473297db7
-
SHA1
66ee46d73644bc77bb8eabd8bbc3382524e35cff
-
SHA256
1f41de97656b9567db858082699fb516514a1c7ac2cb3c047543ca71566cea98
-
SHA512
492030abb306b48611ad5af6b9f53257e0152fe96e7c5912c348f867808b783f8ab52376d395890db5df98b05fece9a53e744d85503d300b18d6c51cd818ed6d
Malware Config
Extracted
C:\bootmgr.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\BOOTNXT.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\BOOTSECT.BAK.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2010_x64.log.html.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2019_x64_000_vcRuntimeMinimum_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
C:\vcredist2019_x64_001_vcRuntimeAdditional_x64.log.txt
https
http://diehard4uty2z5cs.onion/
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
8p<@MrL3
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cougolio.js 784754123687.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1052 784754123687.bin.exe