Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 06:36
General
-
Target
2024-04-15_d5bcd89afbcdfeca8227aa6690740f94_ryuk.exe
-
Size
1.8MB
-
MD5
d5bcd89afbcdfeca8227aa6690740f94
-
SHA1
67822b55cc961e7ec2f8e3bd25ef9989f59a9625
-
SHA256
50f474c6ac44ed96dd24c86c595e7708c78416d25c1bdb42d32992d7d96347b8
-
SHA512
776c4e7c0f1daafa9d690d0772569bd3d7906a0789018c1961fdb6b24aa5672cf840497c18891c9b0336087e21bb95fe794a8c694fcbb54d722eb68cbff2b9f3
-
SSDEEP
49152:VKX0DzOswXkfymHQlIuQppFMREuX19FZO2:fXNOkfjqI9paGuF9FZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5bcd89afbcdfeca8227aa6690740f94_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_d5bcd89afbcdfeca8227aa6690740f94_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5b9d8bbf5f5fcf578eeefaca4ad53b946
SHA11948ba0553af84427aca421db78c430b84002d58
SHA2560b7ed69bc3afe41de340bcecec09cbedd95aa85a1ef9c9b2db804e61db5518ac
SHA512ef1d3a378a7e40a24351db76ef3532364efbd3f4cc1fcfa5603d038b70fe11d3be47ae68fd7e0a341d529ae42d596ed25cddea0069a2c840d738f688a5ef037b
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB