Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 09:34

General

  • Target

    2024-07-09_e03c99b51dd7fc394638ee49f854a2bb_ryuk.exe

  • Size

    940KB

  • MD5

    e03c99b51dd7fc394638ee49f854a2bb

  • SHA1

    2651d2b9f4fc3af041b9e6d475613d6619255632

  • SHA256

    3481992582bb3a0531eb5a3e8d4b46d5e1f0c0f9fca2c53f74755140786a83fe

  • SHA512

    29b039e4fbf6cdd7d6ff1adc63e05dd7ba4efe7ca01bfd2fb40e4dc3660f280d9189b6c9d58b43a3a70107bc3e5e057f9121a83b8afab2e465af5346ad0d048d

  • SSDEEP

    12288:6Ob9A4LWOsvAYFTNGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:rpL3UTwt/sBlDqgZQd6XKtiMJYiPU

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-09_e03c99b51dd7fc394638ee49f854a2bb_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-09_e03c99b51dd7fc394638ee49f854a2bb_ryuk.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/344-0-0x0000000140000000-0x0000000140102000-memory.dmp

    Filesize

    1.0MB

  • memory/344-7-0x00000000020C0000-0x0000000002120000-memory.dmp

    Filesize

    384KB

  • memory/344-2-0x00000000020C0000-0x0000000002120000-memory.dmp

    Filesize

    384KB

  • memory/344-11-0x00000000020C0000-0x0000000002120000-memory.dmp

    Filesize

    384KB

  • memory/344-12-0x0000000140000000-0x0000000140102000-memory.dmp

    Filesize

    1.0MB