Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/01/2024, 23:48
General
-
Target
2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
f88efafa2a031ef0fc39e8a0c3635a2e
-
SHA1
8e1fa51deecc0f9465d65715e286420d3ce88401
-
SHA256
5622250df6633625db61a3fd6c28fb0af0905a52293ed3ada98c7e556dacb21a
-
SHA512
cf84f0457973aefb803b44e55b78b8def818912c2cd3c528da41be8e31750f4d3175ff741f38bf74c91c8493f835d88bdea4a207db0a87e27a6d0f5813dd4879
-
SSDEEP
24576:LANw243oVqIi2lObXobHAEW9INFJY0au:Lew2Bw7x03jY0a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
601KB
MD56698a30ebc5b97e8341ed83f3a927712
SHA188a38c3db3731b0dac60bc3d5dc9fd240341ff2c
SHA2567fd499192c8ddf568656252af3ade875b270229e69560d0a84da50e37d012acf
SHA512b8613513f78ca136bcea5b9a425cf2e051b0ca3c0a1cd28dabf73a5bac0046c0544bc0aaae5c9dbd6d9847ecd0f6ee939c6032631399d9c686194747f94882e1
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
680KB
-
Filesize
680KB