Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe
-
Size
1.0MB
-
MD5
49f40837020f9f3e5019cb78b0035c6d
-
SHA1
5c253896d336c0413cf0a308cf135b487d629bfa
-
SHA256
8bae363947aefc7bdb75bfdd6ba2ca49cf875a781bc76c8b2d57901cbca49320
-
SHA512
cae16b096042efd9b6dbc7e53dd83ae9d5b16f1ec7c09d1a4300b515f133c2afd29afd2de1203dcd8ca1c0e3a6dfb347e4b6189026997dca1503578737026101
-
SSDEEP
24576:ynJbzRAULg/nMl7QED9/9ADC0A8y48LihTJVIVNf07+:ynJbzRnLg/UQa9/S1AX4phTJVIHm
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2748 2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3508 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3508 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_49f40837020f9f3e5019cb78b0035c6d_ryuk.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2748
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x46c 0x4d41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3508
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189B
MD577fb254fae75edc9775b6061390caa3a
SHA1b0bd7bddfa8e86470e5975c937e888810f9b2a3b
SHA25665fde51ae69a86c0a3b2b2ab6de8bd593386d6b78e27f20d2f11e561e4d11c45
SHA512d169923de03e0cda28562075804165cf654a042df553eb8c3ecbd520001371537f95dc1373a15a875b6b5c88da8ace5012a6b2d287582d3e5e4a64a7c668b16d