Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe
Resource
win10v2004-en-20220113
General
-
Target
4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe
-
Size
188KB
-
MD5
d2d3d877e06b0181b67c6e610b40c44c
-
SHA1
6a0dd2ab04d5b0b6869d5b7d9b4eb591087bace9
-
SHA256
4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539
-
SHA512
320cc4f1862425d706c4d369fa5f13a62cc9f3454dae91b239a28440c14dd92972b8d1cfa4fea699dc996e67c3a4db49b4c4ed6e63329492ee6cf8f4f7059cf0
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
pid Process 520 JukCrnS.exe -
Loads dropped DLL 2 IoCs
pid Process 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 520 JukCrnS.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 520 JukCrnS.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 520 JukCrnS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe Token: SeBackupPrivilege 520 JukCrnS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 520 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 27 PID 1916 wrote to memory of 520 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 27 PID 1916 wrote to memory of 520 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 27 PID 1916 wrote to memory of 520 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 27 PID 1916 wrote to memory of 320 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 28 PID 1916 wrote to memory of 320 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 28 PID 1916 wrote to memory of 320 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 28 PID 1916 wrote to memory of 320 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 28 PID 320 wrote to memory of 548 320 net.exe 30 PID 320 wrote to memory of 548 320 net.exe 30 PID 320 wrote to memory of 548 320 net.exe 30 PID 320 wrote to memory of 548 320 net.exe 30 PID 1916 wrote to memory of 536 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 31 PID 1916 wrote to memory of 536 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 31 PID 1916 wrote to memory of 536 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 31 PID 1916 wrote to memory of 536 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 31 PID 536 wrote to memory of 1516 536 net.exe 33 PID 536 wrote to memory of 1516 536 net.exe 33 PID 536 wrote to memory of 1516 536 net.exe 33 PID 536 wrote to memory of 1516 536 net.exe 33 PID 1916 wrote to memory of 928 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 34 PID 1916 wrote to memory of 928 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 34 PID 1916 wrote to memory of 928 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 34 PID 1916 wrote to memory of 928 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 34 PID 928 wrote to memory of 512 928 net.exe 36 PID 928 wrote to memory of 512 928 net.exe 36 PID 928 wrote to memory of 512 928 net.exe 36 PID 928 wrote to memory of 512 928 net.exe 36 PID 1916 wrote to memory of 860 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 37 PID 1916 wrote to memory of 860 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 37 PID 1916 wrote to memory of 860 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 37 PID 1916 wrote to memory of 860 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 37 PID 860 wrote to memory of 1452 860 net.exe 39 PID 860 wrote to memory of 1452 860 net.exe 39 PID 860 wrote to memory of 1452 860 net.exe 39 PID 860 wrote to memory of 1452 860 net.exe 39 PID 520 wrote to memory of 2544 520 JukCrnS.exe 40 PID 520 wrote to memory of 2544 520 JukCrnS.exe 40 PID 520 wrote to memory of 2544 520 JukCrnS.exe 40 PID 520 wrote to memory of 2544 520 JukCrnS.exe 40 PID 2544 wrote to memory of 2568 2544 net.exe 42 PID 2544 wrote to memory of 2568 2544 net.exe 42 PID 2544 wrote to memory of 2568 2544 net.exe 42 PID 2544 wrote to memory of 2568 2544 net.exe 42 PID 1916 wrote to memory of 2700 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 48 PID 1916 wrote to memory of 2700 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 48 PID 1916 wrote to memory of 2700 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 48 PID 1916 wrote to memory of 2700 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 48 PID 1916 wrote to memory of 1456 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 45 PID 1916 wrote to memory of 1456 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 45 PID 1916 wrote to memory of 1456 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 45 PID 1916 wrote to memory of 1456 1916 4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe 45 PID 1456 wrote to memory of 9400 1456 net.exe 49 PID 1456 wrote to memory of 9400 1456 net.exe 49 PID 1456 wrote to memory of 9400 1456 net.exe 49 PID 1456 wrote to memory of 9400 1456 net.exe 49 PID 2700 wrote to memory of 9408 2700 net.exe 50 PID 2700 wrote to memory of 9408 2700 net.exe 50 PID 2700 wrote to memory of 9408 2700 net.exe 50 PID 2700 wrote to memory of 9408 2700 net.exe 50 PID 520 wrote to memory of 9468 520 JukCrnS.exe 51 PID 520 wrote to memory of 9468 520 JukCrnS.exe 51 PID 520 wrote to memory of 9468 520 JukCrnS.exe 51 PID 520 wrote to memory of 9468 520 JukCrnS.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe"C:\Users\Admin\AppData\Local\Temp\4b5b08346e369b59cae2120fcdc16b720bf2f2ec74115045cfafc24eecccb539.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\JukCrnS.exe"C:\Users\Admin\AppData\Local\Temp\JukCrnS.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:2568
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵PID:9468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:9492
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵PID:23592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:23632
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:548
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1516
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:512
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9400
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9408
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:24528
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:24568
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:24520
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:23568
-
-