Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 11:55

General

  • Target

    2024-06-16_dd2e8e3486daf07540ad9545be84c63c_cobalt-strike_ryuk.exe

  • Size

    516KB

  • MD5

    dd2e8e3486daf07540ad9545be84c63c

  • SHA1

    9cbae3987eeedafbe6fe8a4bb3d352ba013fcec5

  • SHA256

    e004d0f39e7046710c51e15308f23d828eab568d5fd0022f9725aff1391183c2

  • SHA512

    e8550c856d9838d4ece0abba85fdb64cb51c1f6560ee38e392c0030a6558b6b6c082cefab49c7e90501d8045c6eb9b68dcb568059a8c25beab6b1d093ae0826a

  • SSDEEP

    6144:uiBlwsmAQIPvTmaEVmP02yCUE+cw0wIceA4D55qv4t/uBmohChYgXP6RIeEdMw:uiBlwBAQIXqaE0yCgqwXeAVmoEAlEew

Score
7/10

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 2 IoCs
  • Modifies registry class 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_dd2e8e3486daf07540ad9545be84c63c_cobalt-strike_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_dd2e8e3486daf07540ad9545be84c63c_cobalt-strike_ryuk.exe"
    1⤵
    • Registers COM server for autorun
    • Modifies registry class
    PID:4312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads