Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/01/2024, 05:55
General
-
Target
2024-01-11_183e40a711af9f2e798a430e2809a1d0_ryuk.exe
-
Size
2.1MB
-
MD5
183e40a711af9f2e798a430e2809a1d0
-
SHA1
2efa036f6e7f6e19bc7b162d9cbb40b150944b1b
-
SHA256
c70cbd05d70131009292d88c51242e738829c00b7e9579e2c68ff504fa0f9983
-
SHA512
b4c907320d8db41d0449a52f52835eeeb325005ede9a53babd0745c8701bd8e3a509d958f675771b16ac714418b15b5ca2a776227c409092cbd9c6d1fbf10749
-
SSDEEP
49152:+XWtcDcoUYXPtSjeJgEjTmucjzaB0zj0yjoB2:+SFYXPwtEjEj+B2Yyjl
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1712 -s 3281⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-01-11_183e40a711af9f2e798a430e2809a1d0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-11_183e40a711af9f2e798a430e2809a1d0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB