Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 20:25
General
-
Target
2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe
-
Size
4.9MB
-
MD5
100df7e482ba8ae971b6b672d4371e04
-
SHA1
c981257b0cb79811690453eee6e197bc06ebecb5
-
SHA256
f81dcb0c4e066d914fb489331a2e7ba7e6036a23a887a2e979c9f8bb9735f6be
-
SHA512
dc2169087b790a3aacd64564c683874fad04eb702138285e7685e7079fdcea36d9cea022f54ce307a473fe2da9d0709bba0993843b88d74c07cd24c3e3c899a4
-
SSDEEP
98304:Kv3vuL2Y21b4MmrthsZFix0J4J/YzlvM:M3vuCYf/rthsDU0zlvM
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"1⤵
- Modifies firewall policy service
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"2024-03-19_100df7e482ba8ae971b6b672d4371e04_ryuk.exe"2⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD59511ab05f3633f3bfff9ae4ad6df5a0f
SHA1ae05a40598f6e9a809f533f1294dee85764b873c
SHA256a60b46d2871cb5e97104362a92023267cd989fb464f5717dabaaabf775c80cb4
SHA512e25ba285a6744a54c8900784a2208621fbd2160268b4e7ea068fe61be6446caf16030000613594e7ff21b7e09f976e9caaa67f2df41bfe9fd83823dbceb63403
-
Filesize
792KB
MD5f793510b7d2c7df5ec6a11925429457a
SHA15263761a182e50fb467389ffb1de477475163d89
SHA2565013079678e676c8faad849d96047bec6bcf96e779797c46c1ab5843e639a4c9
SHA51266ff6f454228409dce08c5d60fe52d84778b6698c469ef5f8300f971bf86c91ff9f611ff46d01c7d2f81d134f981d654bc7e3d9e167b7aa2683469febaf0a5ca
-
Filesize
12B
MD535f4c78ddcf2808dd67d5a20617fd7f0
SHA1da9a8c19f1e539aee9dd0160b3f06c499f993b8f
SHA25699eacd1d0c50ee8d0be66fe334ce0cb0a24bbfddf0b2f24360ffdfc1e0151b08
SHA512a1d64d98e3d361ad223d0b0d402bc632e475cb35064e798736be88a63f3c5e50f69f40d7980bdcff09c74a5cfb9ea8a31c6f9139f8ddef2d5eb56ef44187089a
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4.9MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB