Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
24/04/2024, 01:05
General
-
Target
2024-04-24_f0c88992abb592a34c6ba259a7820ea0_ryuk.exe
-
Size
2.2MB
-
MD5
f0c88992abb592a34c6ba259a7820ea0
-
SHA1
b2a8500101af50bea9530c1d2b20aace41dec6f8
-
SHA256
2cdadc5fe5d9a2e272546dc6c737fe4f7014637ee7f58511d5d0fbdf1a3f74f4
-
SHA512
eebcbcd520217a5db63868808b7da489b77e495e27e7f355aed3ca599eae29cd2fe77138e182b2fc0d2a67b711db1b0bbe5b8896fffaf67de46907532af47e6d
-
SSDEEP
49152:kNl7soq7sQCc1kyG2xHywRfHIO2Ts4bvDV6ZU6CENlc7dpJLrQWd:wD2311kaxp9qV69CEN6rV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_f0c88992abb592a34c6ba259a7820ea0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_f0c88992abb592a34c6ba259a7820ea0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d269cea6ef294a982029776f7970bde7
SHA1695ba7be57d445f0bea86047e20b78652687916f
SHA2562c81259d2be9942524933a342a091a55cf93d6542cb69f77447597ec8c359063
SHA5126c0b6a50b662e3f14787af42a20173b0fe13421b1ca9adf8d7c8f1c2e574c2b1001723c96e9ed4d72a9aa02acd2d9415027d772f1a95a84f88462680781e6253
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB