Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
19/03/2024, 20:25
General
-
Target
2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe
-
Size
4.9MB
-
MD5
100df7e482ba8ae971b6b672d4371e04
-
SHA1
c981257b0cb79811690453eee6e197bc06ebecb5
-
SHA256
f81dcb0c4e066d914fb489331a2e7ba7e6036a23a887a2e979c9f8bb9735f6be
-
SHA512
dc2169087b790a3aacd64564c683874fad04eb702138285e7685e7079fdcea36d9cea022f54ce307a473fe2da9d0709bba0993843b88d74c07cd24c3e3c899a4
-
SSDEEP
98304:Kv3vuL2Y21b4MmrthsZFix0J4J/YzlvM:M3vuCYf/rthsDU0zlvM
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"1⤵
- Modifies firewall policy service
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"2⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5af8333488115dc47a6bf55af04449137
SHA1c034157a45c49a88c1bacd98c27cd2adb557c6f7
SHA2560825b7870225d5a882eba6362dd51304e8c0ee899e139a3fdaabf789651a3288
SHA512bc6249c838b2961808921e2675b61cc119fadffbe5f25f1e22bb423bc94813c0bf0fbb3531a3f2831b50bc1f51cbb865affb7cb5a5b1ea069a35c363a8430557
-
Filesize
2.6MB
MD5e83b88637169ce7b18eeb8884a3b2d5d
SHA127ce0aa554a3c7e0ebb2611348fb6819292a9ead
SHA2565c408e16a8a0d6a65b25806e4ea2124cdb6c3f9fdaf2a5072ef489b8486c82c9
SHA5128100b7f7e5a0ea4149a264ddeaf0c655e832cb4d6e27e9190577ac75865631f67adc99e9157b4073f5fe33a86ceebd2ac769cd33d993c6052e79481924ce17fc
-
Filesize
12B
MD535f4c78ddcf2808dd67d5a20617fd7f0
SHA1da9a8c19f1e539aee9dd0160b3f06c499f993b8f
SHA25699eacd1d0c50ee8d0be66fe334ce0cb0a24bbfddf0b2f24360ffdfc1e0151b08
SHA512a1d64d98e3d361ad223d0b0d402bc632e475cb35064e798736be88a63f3c5e50f69f40d7980bdcff09c74a5cfb9ea8a31c6f9139f8ddef2d5eb56ef44187089a
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4.9MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB