Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 05:21
General
-
Target
2024-03-15_24ea757250b141e1098f1216becf294d_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
24ea757250b141e1098f1216becf294d
-
SHA1
2148887aaeab2ab9fa9ef4183d43f36ebd27b840
-
SHA256
868a43855b2808ca01d17d9ea192cd6156a9fe3b00ce6aab22c3d46fe2bff8a8
-
SHA512
bb533d315169c961026a32145e55eaaab0a33783de24ea90d2d7e8986dff6373c61b5d0f5bb4279c14701b63c90d455f107cd5618bd0ac9f0d303f706eb929f4
-
SSDEEP
12288:cXDCAZzP/w24lhjPStDCf7O4TsH+mGadTSdZKKQWOs5NgsPjYc+igyjj6n4zaY:fANw243jbpT0rdwQWOwN7PPpgyqn4zb
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_24ea757250b141e1098f1216becf294d_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_24ea757250b141e1098f1216becf294d_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB