Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-05-12...uk.exe

windows7-x64

7

2024-05-12...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 00:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-12_c454a98a5e82bf24f5dc260cda04c8b5_ryuk.exe

  • Size

    12.5MB

  • MD5

    c454a98a5e82bf24f5dc260cda04c8b5

  • SHA1

    1b2ce7e0c5bb302b765a6ec6d040512487331248

  • SHA256

    f35f324ffcea8d20cf0793e434deef6290df897d059a94ad1843cdf98fa2e63d

  • SHA512

    892c29ea72cf087914998cf2d9e59d0fb0209a0d32fe6d28d39d3772b8b73a395f03cafacba5e5e57e9453b20bf149e0cfc6a19569e973f1352e04ed0f45450f

  • SSDEEP

    393216:FanZGhd9vqZQ35ShR4uwKBBGZTijDBZBrfI:FemQ2mTKiXBLfI

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-12_c454a98a5e82bf24f5dc260cda04c8b5_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-12_c454a98a5e82bf24f5dc260cda04c8b5_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\2024-05-12_c454a98a5e82bf24f5dc260cda04c8b5_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-05-12_c454a98a5e82bf24f5dc260cda04c8b5_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\VCRUNTIME140.dll
    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_bz2.pyd
    Filesize

    87KB

    MD5

    429ad9f0d7240a1eb9c108b2d7c1382f

    SHA1

    f54e1c1d31f5dd6698e47750daf48b9291b9ea69

    SHA256

    d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

    SHA512

    bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_ctypes.pyd
    Filesize

    130KB

    MD5

    985d2c5623def9d80d1408c01a8628be

    SHA1

    317c298cb2e1728f9c7f14de2f7764c9861be101

    SHA256

    7257178f704cd43e68cd7bc80f9814385b2e5d4f35d6e198ae99dce9f4118976

    SHA512

    be6a9d3465a5e00e6752a4b681fb8ef75126b132965624d4373b8817d68ed11337b068034ebedcfe59fb9486b86a03e67e81badc29375a776f366bf7f834f0dc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_hashlib.pyd
    Filesize

    38KB

    MD5

    d61618c28373d7bbdf1dec7ec2b2b1c1

    SHA1

    51f4bab84620752aedf7d71dcccb577ed518e9fd

    SHA256

    33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

    SHA512

    ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_lzma.pyd
    Filesize

    251KB

    MD5

    5e7a6b749a05dd934ee4471411420053

    SHA1

    fcd1e54011b98928edbb3820a5838568b9573453

    SHA256

    4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

    SHA512

    ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\_socket.pyd
    Filesize

    74KB

    MD5

    7c5c5e6e4ed888dd26c7aa063bb9f88e

    SHA1

    a7a3694739b27c3d34beb1a9730fc3dcbae6744a

    SHA256

    2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

    SHA512

    9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-core-file-l1-2-0.dll
    Filesize

    18KB

    MD5

    31e207b01e67b6563d2cf9110d06a1d2

    SHA1

    f12832e055c0f0d70fc44b4cb0215c17aa948332

    SHA256

    6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1

    SHA512

    8a19324c8719ad6e7509de44fe79c6614c064daa47c4206a2b6ba4124b45bc4d8785cd51b8877c9ae5a1e0768ee1bba8f98e8d8c17b700aa8dadbd2801035a92

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-core-file-l2-1-0.dll
    Filesize

    18KB

    MD5

    f2d12342c68e51aa748d4937f3ec7ded

    SHA1

    22368cebce89feb929004f73bd0f7236f7050e36

    SHA256

    6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e

    SHA512

    1e1440c97237716a6ac63e038d932edd0e7962230bfd6956b8aafa378b344daf92da696f0d1a57b0d71fef3722296b0d02f59b0fc9551e7944c445cc6b2b26a4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    20KB

    MD5

    9b43f5733a98e5c6095996916f889987

    SHA1

    01ba4d84cb2adf3536c31b1c41375d141dcd2ba1

    SHA256

    2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341

    SHA512

    b3497f31c155049c68b18d2f28383843bd8b8c078db119c07d63ec1900a6204e266a3bc1503734fd85c3766bddb25029880291e4f6060afe5df82717af6ae092

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    18KB

    MD5

    95b0eb891b1e869568a2bf9ab67eab0f

    SHA1

    09cf1cbb3089fc418eb933d1b4611cca0d4ad327

    SHA256

    5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00

    SHA512

    7b2a74278fb7e51242006dc1e60d0e7cc3ed763eb4e7ed7e9da87797ea81fdb05857de838b745fac03468f85c755fe86331746466c30f87f127172de5524f057

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    18KB

    MD5

    69d1c46b9927d1c7cad8dfb5e18ab7ab

    SHA1

    1917be91adb466085678ebe036643cb187a7f4d5

    SHA256

    23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282

    SHA512

    365dbc3811b9bc2417937e433b7b748080c3ca1f4fc1b361117db46fd9dcfe49d948407dca33ca75d307b0e7f7919cc3550caa16e6950f10b0f46d16cbd36172

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    22KB

    MD5

    e3495c380c381670908355181787d7ea

    SHA1

    30b2d379cf483e3394a462a5824092e555974f26

    SHA256

    b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923

    SHA512

    be973074be09fb0e11d4819c0a04d07daad5bf82d3b2c689ab9a5a6d74d39bd24cf526bcfd926f69f5986f0dbfce2d3b4e21a2449ad8e6e9a8a2cfd52b572868

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-environment-l1-1-0.dll
    Filesize

    18KB

    MD5

    5746d1dc01f0a069f009ecd7f8738c41

    SHA1

    5d8696c5cfab3b9c91806a95c9a84d539a4500a3

    SHA256

    325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457

    SHA512

    c73d63216f0bfda185928172b737aa652ba30d88471b22c5161b162bd5d68d7b60c3b90af648cc7c1c2b409af416383db106abf8366733ba4c61f3f104c8db41

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    20KB

    MD5

    c8211d9a8f2595c9ee6f75c9b6d5cb29

    SHA1

    f90ee7350a2d922f5ab614a43c81a42604a86306

    SHA256

    b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41

    SHA512

    846583349a448d2df8b4a9957a72b6734b0e394135cef6b03bdf197c6752c9e688e47c7d51ce4825f20f47d933ff9133b481b4daec6b0ec729a739b157617377

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    19KB

    MD5

    28579ca40c9e19cc6dc23dfb8b6871cd

    SHA1

    804cdccdb65ad15e016072b5d6f9843096140864

    SHA256

    a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4

    SHA512

    9489cdc3d5df75dd2686ea82dd689aae0a4fd503d2831091c10bc53820320b4947cd9f321501448d258b219516e5d9aaf6790f13189248835ba20b2f86674b9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    18KB

    MD5

    4140ee5c6ea9f933c483615141fd54fe

    SHA1

    3ef9da0df943f56f1838853fc5406280b2823516

    SHA256

    29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc

    SHA512

    1cc86a050dcd1619e9e2cc9aa37c76da21e4a4d8f1700916c5ff6ed883d3c4218df17b1980a4875c803f5a5de5b80b45ebe5f0fd20b38726fe6cd8d8039d49a2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    26KB

    MD5

    6c7d9c87af17330357fdb7f39751080b

    SHA1

    3a1dd4a6290d0c9764e43f430bb447ae4cce674d

    SHA256

    6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6

    SHA512

    d03b8c177b81dd7d55cb1c2dc76301d52ff6d0cbef61398bffd9d113814fa64801196414abefb2f635cbc3e28de3960a47f4b6d6170fe252ac0642701de75d27

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    21KB

    MD5

    f576fd38085005b4ab2ff1dacd293c48

    SHA1

    75074cfc7543b34f0bcace916370413055dee2ae

    SHA256

    6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582

    SHA512

    3887ba832965e3bbe248002e926b0ea8374b4755e6b736c25850088287790e20052d3334000eb7afc2c86fd2a14ba05d5e564c1bd811d8baa8e524f4f7fcfc25

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    24KB

    MD5

    1cec55e31418a818093c73e96bd41973

    SHA1

    69a57fb9c17ccfd607749d8e9c8e80792904ea44

    SHA256

    513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3

    SHA512

    31f0e1f4ec0e8b94f4fe403f182596839c916f5d810b8d81c1f399868d18c68192a1362f03f9983d92cb7b7c8575421da12c345838321c95d056c20517ee9b55

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    24KB

    MD5

    e730cd977ac7f60f0824775e39c8fd2c

    SHA1

    fdfaf759a360293687bd2838b7d9feb628edaf5b

    SHA256

    63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31

    SHA512

    d6a30e82a061f7e5f27aaa928819ebefff2bb5963ab7d4be33d41e0099576b1e7d0c671082fa08ce0e1bd8e89c4dc8ae427a22f0162ac05b8a0259392bb50fe8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-utility-l1-1-0.dll
    Filesize

    18KB

    MD5

    6bc85715c6a0006cdeff1b3d7ffd796f

    SHA1

    fac4bdf44990b06c7a1c2ffed214ebd710264b3f

    SHA256

    7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c

    SHA512

    a8ed5d78d973efd248971795dc1e3a6e27421746d2c7d47740e846a7e19f3153e7a7e508327a20edf9a2354dbc82da6985e1e212474a066c905a00a32de99bc7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\base_library.zip
    Filesize

    766KB

    MD5

    08a5862cf49e3f4c2a8b6ed50e8058da

    SHA1

    98824c0fa12b83e22ed600054ff7bf38542299b6

    SHA256

    5ba4117164909e254e5abb98ca3b6fcd421738af5e3ccb535fec0ab03a1d3c7e

    SHA512

    bf4bff6985ce7bd10f137a5ae90a9700c938ad921feac2ba854a780c3ed391a6afad723cb5546783500888761e909a89148a9429c40e2ea51278d313284334dc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\libcrypto-1_1-x64.dll
    Filesize

    2.4MB

    MD5

    8c75bca5ea3bea4d63f52369e3694d01

    SHA1

    a0c0fd3d9e5688d75386094979171dbde2ce583a

    SHA256

    8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

    SHA512

    6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\main.exe.manifest
    Filesize

    1KB

    MD5

    440abd8fe61825e4f5ad7f37380eaca1

    SHA1

    b589d453c5e22d115bcc5e68f26d7aae84007291

    SHA256

    5f0d0e9a129b94b6743da89dcdd4cb3a05c20e4b16a7561c1b0334e95b1801ea

    SHA512

    6beeccdee89b044212006e90712458f5e16c1d8fa17e89302e0b2bf2373bc1e8f8d0d628ac051c89de85a023f1f5ebdae509df1ca0671f6dc8a516aee11e6a15

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\pyexpat.pyd
    Filesize

    195KB

    MD5

    a045432966523928d20b7dce4537c776

    SHA1

    0869868b4548ec7b0bddf7539b6022185bc3f6da

    SHA256

    d4ca4589c6c8ff5a9f71da2f63c1d214bfeb8662375b42ee201b7c9e07c586a6

    SHA512

    bdab5104b9cc278608cdc6662f38855c3a7c348d372034790c120209cbdf9730bbcece9dd1a59f8060d3dc29f5f193b988c9273b6eec5987bddc94cc28a9bc9b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\python37.dll
    Filesize

    3.6MB

    MD5

    28f9065753cc9436305485567ce894b0

    SHA1

    36ebb3188a787b63fb17bd01a847511c7b15e88e

    SHA256

    6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

    SHA512

    c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\pywintypes37.dll
    Filesize

    136KB

    MD5

    6d932e5bcb97cd88becc29d74aa6c5fd

    SHA1

    8acd48adac80ad77e6a5e0bcad274ad650651d68

    SHA256

    dfa36240a39757f676eb5636ed32f28f23f09d81c47e6fca0ee51dfa94074e0f

    SHA512

    fed93d1d9624f08d4aa6f6d0e194d9d43ad19e1209b8944fad0347f80e24e20f4ba7c7274437eadada782760b3e1c7904d702115688e4ebb3b1b4ba5aa821635

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\select.pyd
    Filesize

    26KB

    MD5

    1650617f3378c5bd469906ae1256a54c

    SHA1

    dd89ffd426b6820fd79631e4c99760cb485d3a67

    SHA256

    5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

    SHA512

    89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27802\ucrtbase.dll
    Filesize

    977KB

    MD5

    5b1c91b53ac3c3026d50de8c05aba139

    SHA1

    b9c2d160b1ce856d9904a340362236473a3d559c

    SHA256

    d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7

    SHA512

    8e01056830e65320d684245bf055305e03ef136545efb51aad484a5b1b006f7d534c30b7973da8628f49c31710ae23d3420f941156c941172b97efe9e1ef9a1f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-conio-l1-1-0.dll
    Filesize

    19KB

    MD5

    3f14aadfaf34257f399ddb6c554d8a51

    SHA1

    695f7a5d42fd16109ad744a2b215dbd4543e2b84

    SHA256

    edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774

    SHA512

    002a34bb9210401270f321eb973afd1fd807a3dc395fcd69adbcabca413d77ea748f78f70c61818da52902a74d38ffc9a5b655887d9336a02355072b421cae22

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-process-l1-1-0.dll
    Filesize

    19KB

    MD5

    7c1742b5617456344965156c650af627

    SHA1

    4b83cae841ca3360ed998c48816ec4ea71cb86f7

    SHA256

    e31fd2a662773f4b2d84d29dc312d5614992b8e1b700840a2f5ae539ad9a21c2

    SHA512

    9fe82e00b1921e9566ae07226b7c4305aebacd169e8cae4a286183acdb70391ce64ca62fb029dff10a280775218ff0772e3fc953fc31b7fa2ace518904cd5ed8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27802\api-ms-win-crt-time-l1-1-0.dll
    Filesize

    20KB

    MD5

    090027e2a3ef8d8ebf9ced36fdc7b492

    SHA1

    bc75462090e7b95a44c9d22ddec394da30d4b6e4

    SHA256

    803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd

    SHA512

    4ba291e44be86ab8e2f3619155ad503d68e65f84eab0870844c23893b5c169a1fe85fb1feb6cd0ba692373d84b40db3e8fcec3ad231899a0f3ffbecc971fe48b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27802\win32api.pyd
    Filesize

    129KB

    MD5

    5bb26a51ae46c298bc41453eb0ae9018

    SHA1

    87e7cce7774c9327d747f279cf04c3e22f92f91e

    SHA256

    6afd5bbfe14cc756b59013a7beb8d23729a6c71f848b8975813b08ed4789694b

    SHA512

    bdfc78737ae22ed1358bc261bce0bb363a19bf429a2f191cc24559f206dd032322ec265f74179b1b45e7de747362d4bbfd6c314c167d052b7b60890ce032f340

    Download Submit