Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe
-
Size
1.7MB
-
MD5
fda3b583f9ce8e11896b603a1fbd2b6e
-
SHA1
8186d3d9599f9fab538ce25b0e86d4d15ab2f64c
-
SHA256
42c884f1595cdf0b00760519c9a63c404f628f8e773e3173f2a47e4393452b1a
-
SHA512
80fa14a42897f9120fc315743d8c2ece59577f65ea4a38bce7b015b4997213b0f71e23c76ab6211216a3cfbd8a81c38d3bf3172ca80c6359e32e3dd04f64f329
-
SSDEEP
49152:T4f65cTlG8mMHcn3obb0P8/snji6attJM:TSG8mM8wEnW6at
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2152 2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2404 2152 2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe 28 PID 2152 wrote to memory of 2404 2152 2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe 28 PID 2152 wrote to memory of 2404 2152 2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10_fda3b583f9ce8e11896b603a1fbd2b6e_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2152 -s 3322⤵PID:2404
-