Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe
Resource
win10v2004-en-20220113
General
-
Target
9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe
-
Size
112KB
-
MD5
990b689516914e33319296bf038b8d45
-
SHA1
c0de363450821deb850bed1a2b6880d84bd9ec3b
-
SHA256
9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f
-
SHA512
e0d42a48a286aa21415e3d5b1e6a4ce0f2947eb0b1de6b73fd13fbd450e141975d05e00a4c332349039f41fb2d71807d9242118b6c0c69392ff9bd0aa062085d
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
Extracted
C:\users\Public\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 524 FqjkICAzVlan.exe 576 RQMmrniXMlan.exe -
Loads dropped DLL 4 IoCs
pid Process 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 752 icacls.exe 748 icacls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2156 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe Token: SeIncreaseQuotaPrivilege 1068 WMIC.exe Token: SeSecurityPrivilege 1068 WMIC.exe Token: SeTakeOwnershipPrivilege 1068 WMIC.exe Token: SeLoadDriverPrivilege 1068 WMIC.exe Token: SeSystemProfilePrivilege 1068 WMIC.exe Token: SeSystemtimePrivilege 1068 WMIC.exe Token: SeProfSingleProcessPrivilege 1068 WMIC.exe Token: SeIncBasePriorityPrivilege 1068 WMIC.exe Token: SeCreatePagefilePrivilege 1068 WMIC.exe Token: SeBackupPrivilege 1068 WMIC.exe Token: SeRestorePrivilege 1068 WMIC.exe Token: SeShutdownPrivilege 1068 WMIC.exe Token: SeDebugPrivilege 1068 WMIC.exe Token: SeSystemEnvironmentPrivilege 1068 WMIC.exe Token: SeRemoteShutdownPrivilege 1068 WMIC.exe Token: SeUndockPrivilege 1068 WMIC.exe Token: SeManageVolumePrivilege 1068 WMIC.exe Token: 33 1068 WMIC.exe Token: 34 1068 WMIC.exe Token: 35 1068 WMIC.exe Token: SeBackupPrivilege 524 FqjkICAzVlan.exe Token: SeIncreaseQuotaPrivilege 1068 WMIC.exe Token: SeSecurityPrivilege 1068 WMIC.exe Token: SeTakeOwnershipPrivilege 1068 WMIC.exe Token: SeLoadDriverPrivilege 1068 WMIC.exe Token: SeSystemProfilePrivilege 1068 WMIC.exe Token: SeSystemtimePrivilege 1068 WMIC.exe Token: SeProfSingleProcessPrivilege 1068 WMIC.exe Token: SeIncBasePriorityPrivilege 1068 WMIC.exe Token: SeCreatePagefilePrivilege 1068 WMIC.exe Token: SeBackupPrivilege 1068 WMIC.exe Token: SeRestorePrivilege 1068 WMIC.exe Token: SeShutdownPrivilege 1068 WMIC.exe Token: SeDebugPrivilege 1068 WMIC.exe Token: SeSystemEnvironmentPrivilege 1068 WMIC.exe Token: SeRemoteShutdownPrivilege 1068 WMIC.exe Token: SeUndockPrivilege 1068 WMIC.exe Token: SeManageVolumePrivilege 1068 WMIC.exe Token: 33 1068 WMIC.exe Token: 34 1068 WMIC.exe Token: 35 1068 WMIC.exe Token: SeBackupPrivilege 576 RQMmrniXMlan.exe Token: SeBackupPrivilege 3344 vssvc.exe Token: SeRestorePrivilege 3344 vssvc.exe Token: SeAuditPrivilege 3344 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 524 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 27 PID 1588 wrote to memory of 524 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 27 PID 1588 wrote to memory of 524 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 27 PID 1588 wrote to memory of 524 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 27 PID 1588 wrote to memory of 576 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 30 PID 1588 wrote to memory of 576 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 30 PID 1588 wrote to memory of 576 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 30 PID 1588 wrote to memory of 576 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 30 PID 1588 wrote to memory of 692 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 32 PID 1588 wrote to memory of 692 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 32 PID 1588 wrote to memory of 692 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 32 PID 1588 wrote to memory of 692 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 32 PID 1588 wrote to memory of 820 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 31 PID 1588 wrote to memory of 820 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 31 PID 1588 wrote to memory of 820 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 31 PID 1588 wrote to memory of 820 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 31 PID 1588 wrote to memory of 540 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 35 PID 1588 wrote to memory of 540 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 35 PID 1588 wrote to memory of 540 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 35 PID 1588 wrote to memory of 540 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 35 PID 1588 wrote to memory of 1084 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 33 PID 1588 wrote to memory of 1084 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 33 PID 1588 wrote to memory of 1084 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 33 PID 1588 wrote to memory of 1084 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 33 PID 1588 wrote to memory of 752 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 36 PID 1588 wrote to memory of 752 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 36 PID 1588 wrote to memory of 752 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 36 PID 1588 wrote to memory of 752 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 36 PID 1588 wrote to memory of 748 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 40 PID 1588 wrote to memory of 748 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 40 PID 1588 wrote to memory of 748 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 40 PID 1588 wrote to memory of 748 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 40 PID 1588 wrote to memory of 1156 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 46 PID 1588 wrote to memory of 1156 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 46 PID 1588 wrote to memory of 1156 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 46 PID 1588 wrote to memory of 1156 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 46 PID 1588 wrote to memory of 288 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 41 PID 1588 wrote to memory of 288 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 41 PID 1588 wrote to memory of 288 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 41 PID 1588 wrote to memory of 288 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 41 PID 692 wrote to memory of 1068 692 cmd.exe 42 PID 692 wrote to memory of 1068 692 cmd.exe 42 PID 692 wrote to memory of 1068 692 cmd.exe 42 PID 692 wrote to memory of 1068 692 cmd.exe 42 PID 820 wrote to memory of 2156 820 cmd.exe 47 PID 820 wrote to memory of 2156 820 cmd.exe 47 PID 820 wrote to memory of 2156 820 cmd.exe 47 PID 820 wrote to memory of 2156 820 cmd.exe 47 PID 1588 wrote to memory of 2256 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 50 PID 1588 wrote to memory of 2256 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 50 PID 1588 wrote to memory of 2256 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 50 PID 1588 wrote to memory of 2256 1588 9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe 50 PID 1156 wrote to memory of 2264 1156 net.exe 49 PID 1156 wrote to memory of 2264 1156 net.exe 49 PID 1156 wrote to memory of 2264 1156 net.exe 49 PID 1156 wrote to memory of 2264 1156 net.exe 49 PID 288 wrote to memory of 2272 288 net.exe 48 PID 288 wrote to memory of 2272 288 net.exe 48 PID 288 wrote to memory of 2272 288 net.exe 48 PID 288 wrote to memory of 2272 288 net.exe 48 PID 2256 wrote to memory of 2352 2256 net.exe 52 PID 2256 wrote to memory of 2352 2256 net.exe 52 PID 2256 wrote to memory of 2352 2256 net.exe 52 PID 2256 wrote to memory of 2352 2256 net.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe"C:\Users\Admin\AppData\Local\Temp\9a8f9a28040bf69a7179de263382b29d1b6da12efc330ada1f983e9fe9b56c7f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\FqjkICAzVlan.exe"C:\Users\Admin\AppData\Local\Temp\FqjkICAzVlan.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:524
-
-
C:\Users\Admin\AppData\Local\Temp\RQMmrniXMlan.exe"C:\Users\Admin\AppData\Local\Temp\RQMmrniXMlan.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "WMIC.exe shadowcopy delete"2⤵
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC.exe shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bootstatuspolicy ignoreallfailures"2⤵PID:1084
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "bcdedit /set {default} recoveryenabled No & bcdedit /set {default}"2⤵PID:540
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Qþ2⤵
- Modifies file permissions
PID:752
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Qþ2⤵
- Modifies file permissions
PID:748
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2272
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2264
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2352
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:2408
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2440
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:9332
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:9356
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:9380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9404
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:9420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9444
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2780
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344