Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/06/2024, 08:39
General
-
Target
2024-06-15_fbe294f29bf57a9403c5d2410b1df7c6_ryuk.exe
-
Size
1.8MB
-
MD5
fbe294f29bf57a9403c5d2410b1df7c6
-
SHA1
35b305c7961b4bbfe9f7c25e369f051fbaa44c78
-
SHA256
c3fb78c47525efccee0bbe2f49b468b0b0ecaedb4de1113007a088ea98347af1
-
SHA512
2136c0e6b69355ef7a2cf351d611e9112dc6c8a30cb652abbb0b05c41058e7efcf59a7336b1c41cc102776ed497e51fdcf897c59e245450fca05e845e62c7721
-
SSDEEP
49152:wKfuPS3ELNjV7SZxEfOfOgwf0H11tmlNQ2ayVup3:Hm9OZxwgX11wlNQ1ya
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_fbe294f29bf57a9403c5d2410b1df7c6_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_fbe294f29bf57a9403c5d2410b1df7c6_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2524 -s 3322⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5ea8c2c22c3fdc9ec533129a6461791f6
SHA14762b99d5a00804befba495233b2bcd682d3a37d
SHA2568b6207ba56eb61991515a1abee759d0c79e4325d92f8707fc2cff5d4f2e956d9
SHA512a6b59f101ec857b9d63c4dedab3019d6215c9f7e80cb2a0027a2079e13600f5f470091c5f4161bcf7968396cd9bae2a3598dc1af5df330f34a094d5c66a911cb
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB