Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
29/04/2024, 19:45
General
-
Target
2024-04-29_007a607737b9f1efbd4aac7aeae98182_ryuk.exe
-
Size
5.4MB
-
MD5
007a607737b9f1efbd4aac7aeae98182
-
SHA1
b43c9e0b31ee959ba90aeb77a1aa54eec2a62ec2
-
SHA256
ffda88dd06b6d7ba0aaf2a55476445fa48391c8e63e9faa67c62eb61a0a09677
-
SHA512
4f2607a00fb9f176c50a1d01ab94a18debc3d6a6b2c470b904a9d4cf6c52d8a1e2bb176d2f9b32224fb35909d43829be5c8cd0fc94494449b2ade54aaf029ea2
-
SSDEEP
49152:bjGsFUrZsi/kUOarU8IB5hcbrYhCv9D9vhEmMWPBaiiO+MB67zXXCPodXtzXRJER:b6snaJIFyYgB0JtzDBlbZy2FWnBHJ
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_007a607737b9f1efbd4aac7aeae98182_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_007a607737b9f1efbd4aac7aeae98182_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_007a607737b9f1efbd4aac7aeae98182_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-04-29_007a607737b9f1efbd4aac7aeae98182_ryuk.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.70 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7c5e0f854,0x7ff7c5e0f860,0x7ff7c5e0f8702⤵
-