Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-04-17...uk.exe

windows7-x64

7

2024-04-17...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe

  • Size

    6.6MB

  • MD5

    690421984e7876f89af2d11b911d195b

  • SHA1

    65f1ad87f06f1b95696fe15c183a4030ce362ec8

  • SHA256

    af577ca05d50aebaab5f0d70dd217bb17941f51e7836ae195e0084af21158fb4

  • SHA512

    050660466dae2eb56ba1ca1434ef6e4f559ad189026de7906eab8891a1e675825b200c021a0c908b1619f2f4ad1ebffe502d19f119cc52163af133e383864df0

  • SSDEEP

    196608:YSAFuDe9xY+JA6nuj8xE2U+X2iZKhORcd8SEW1D25hMqe:auq9xY+JA6n/zyh37s5ne

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:3440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\VCRUNTIME140.dll
    Filesize

    83KB

    MD5

    0c583614eb8ffb4c8c2d9e9880220f1d

    SHA1

    0b7fca03a971a0d3b0776698b51f62bca5043e4d

    SHA256

    6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

    SHA512

    79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\_ctypes.pyd
    Filesize

    124KB

    MD5

    1ec6d919a90fe611fcad86555b20bdbc

    SHA1

    783365a6563026eaf8312f1ba2479c74d19b285e

    SHA256

    059e6d79776d5081ec6342e62d63725b07f0388787c5d7b250481729f63341f8

    SHA512

    cf91e0a5aa4e714a1667dfbed81d0931606c64a1e7885bdf9adde96d2540700834a64352a4d2b4d571072e0b47044af92669149560161f446bda86425448b6da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\base_library.zip
    Filesize

    764KB

    MD5

    cb7d57935e7eabffcb7d94bbaeaa27cc

    SHA1

    e22478d7c1907ddd723c7f1db6bbaef236debce9

    SHA256

    f4257d927a242c15e88791b82231b6796b4133e070bea15d079a74dd9123c426

    SHA512

    601d23a5af46ce2b58fbedaa82688f801411bfff04a5756bc411a2e324463fd470d4d7b40447aa9031e0128c1baf90b303c12bac8bebecb6268095a7e16e0c72

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\file_arranger.exe.manifest
    Filesize

    1KB

    MD5

    7858c9ea1b0cac02b59baadb00a5f59f

    SHA1

    0f115347831a0c24846a64fe51811b4fd473b2fc

    SHA256

    0e1a52e30609e02276469241bc386e8b5ab285c144d4601780de61459a974ed6

    SHA512

    1f6880744df359ed5c43eb75b34654f8f285e746b13b9e2bb984ece65d50d0dabf0764c5a3778088bf739a906eace4595db023472ff93f5bcc399278de74f9ad

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\python37.dll
    Filesize

    3.6MB

    MD5

    0b321720d7fb6769ec046f2060ba1747

    SHA1

    3d2a45c42f3ebedb9d7175385ee48b7c808fe3a5

    SHA256

    e57fe2c5a107df01fcffe1f3753e0e670c9f1623a77cab5a2b1d3c8dac1c8cee

    SHA512

    736afe1bbbe9d62b6f3117748c8d712c84ba887de44f2ecd25d22938ce7765160b50eaa6183ea54767f0cff4b28d2e3ca9653d737d0cddf5efdc07296c22be8e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI12722\ucrtbase.dll
    Filesize

    992KB

    MD5

    0e0bac3d1dcc1833eae4e3e4cf83c4ef

    SHA1

    4189f4459c54e69c6d3155a82524bda7549a75a6

    SHA256

    8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

    SHA512

    a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

    Download Submit