Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NEAS.2023-...uk.exe

windows7-x64

7

NEAS.2023-...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2023, 20:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe

  • Size

    9.4MB

  • MD5

    89b004c7fd22ee3c694b442b83eca3c5

  • SHA1

    663af89d077684000c2e9301e28eae1ba076b653

  • SHA256

    bea52432905bab98832d4cb31939dc5d8ed3c5327654bd9eef320cb7742f654b

  • SHA512

    29e2d902acbcc7203ba1a231ff799e68085079eeecec5dbf36663bbaf980f6c39b76f5e67683b0507cf72fa67b42104251b0c99fa3342dab30bedd599fde7923

  • SSDEEP

    196608:YS4P+GIxr9onJ5hrZERlyiU8AdZYJERS48RmU/3ZlsPvarTJQg8C3T2Lqb56:bPt9c5hlERJAdZYygtN3ZWar9RTk

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-29_89b004c7fd22ee3c694b442b83eca3c5_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\Calculadora-Obfuscated.exe.manifest
    Filesize

    1KB

    MD5

    4357d96c0b2f23798e58e78e4d8bd8e0

    SHA1

    326d0c781992a0826405cd5851f7e7b9a155abc0

    SHA256

    88a6715840b58a1aa768b01be38e6dfc7baa6e678fff42e6f59ecca60adf8f1f

    SHA512

    9538815f9bc7c27e83a42ee200d827542360190f993c30e7472c8d1c8a3b07bceb8e64ab767639aa1ed8b0c3ea379237ebed53b1a8ad2f4057de53cb5c6bc6fb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\VCRUNTIME140.dll
    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\VCRUNTIME140.dll
    Filesize

    99KB

    MD5

    8697c106593e93c11adc34faa483c4a0

    SHA1

    cd080c51a97aa288ce6394d6c029c06ccb783790

    SHA256

    ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

    SHA512

    724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\_ctypes.pyd
    Filesize

    122KB

    MD5

    29da9b022c16da461392795951ce32d9

    SHA1

    0e514a8f88395b50e797d481cbbed2b4ae490c19

    SHA256

    3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

    SHA512

    5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\_ctypes.pyd
    Filesize

    122KB

    MD5

    29da9b022c16da461392795951ce32d9

    SHA1

    0e514a8f88395b50e797d481cbbed2b4ae490c19

    SHA256

    3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

    SHA512

    5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\_socket.pyd
    Filesize

    77KB

    MD5

    f5dd9c5922a362321978c197d3713046

    SHA1

    4fbc2d3e15f8bb21ecc1bf492f451475204426cd

    SHA256

    4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

    SHA512

    ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\_socket.pyd
    Filesize

    77KB

    MD5

    f5dd9c5922a362321978c197d3713046

    SHA1

    4fbc2d3e15f8bb21ecc1bf492f451475204426cd

    SHA256

    4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

    SHA512

    ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\base_library.zip
    Filesize

    767KB

    MD5

    01074e238ce58c0c206f324feac33082

    SHA1

    44122785cc3b59177f5359caf327ad6810c9aa91

    SHA256

    f62a2af7f4fa10d91194ae70bf4f52ea165ed991a277307706555cf950f16820

    SHA512

    b1015e3f40edc49e1ffbfdd3f27063290b6385871eb340a96c6ce020254d86dd90c7ce095d33bd65136ed6cd645c117c25c98183e6577c332aa46257d9ca838c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\python39.dll
    Filesize

    4.3MB

    MD5

    11c051f93c922d6b6b4829772f27a5be

    SHA1

    42fbdf3403a4bc3d46d348ca37a9f835e073d440

    SHA256

    0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

    SHA512

    1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\python39.dll
    Filesize

    4.3MB

    MD5

    11c051f93c922d6b6b4829772f27a5be

    SHA1

    42fbdf3403a4bc3d46d348ca37a9f835e073d440

    SHA256

    0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

    SHA512

    1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\select.pyd
    Filesize

    26KB

    MD5

    7a442bbcc4b7aa02c762321f39487ba9

    SHA1

    0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

    SHA256

    1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

    SHA512

    3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI32122\select.pyd
    Filesize

    26KB

    MD5

    7a442bbcc4b7aa02c762321f39487ba9

    SHA1

    0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

    SHA256

    1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

    SHA512

    3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

    Download Submit