30272a85129992962333d3e558077da7f72f14593bcd979a8adabbeaa5874dfb | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-08-07...uk.exe

windows7-x64

1

2024-08-07...uk.exe

windows10-2004-x64

7

Sharing

General

Target

2024-08-07_6746c63ee2eebbece4804049c7abbcf2_ryuk
Size

1.5MB
Sample

240807-ypvfrswgra
MD5

6746c63ee2eebbece4804049c7abbcf2
SHA1

a9883f3de4c41aa2b7f3310342a195642153d729
SHA256

30272a85129992962333d3e558077da7f72f14593bcd979a8adabbeaa5874dfb
SHA512

8a476a44e81561d1067a062a1fa013e47cdbdb44cb49bf56be43fabf7c97e51bb87e9b3dd352e17e9239e7b85ff5518734f44fc219070b964b227c94c2e50f99
SSDEEP

24576:J3oH6mhNF4Xx7AmsqjnhMgeiCl7G0nehbGZpbD:5oHRFEBAqDmg27RnWGj

Score

7^/10

persistence privilege_escalation spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2024-08-07_6746c63ee2eebbece4804049c7abbcf2_ryuk.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

2024-08-07_6746c63ee2eebbece4804049c7abbcf2_ryuk.exe

Resource

win10v2004-20240802-en

persistence privilege_escalation spyware stealer

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024-08-07_6746c63ee2eebbece4804049c7abbcf2_ryuk
- Size
  
  1.5MB
- MD5
  
  6746c63ee2eebbece4804049c7abbcf2
- SHA1
  
  a9883f3de4c41aa2b7f3310342a195642153d729
- SHA256
  
  30272a85129992962333d3e558077da7f72f14593bcd979a8adabbeaa5874dfb
- SHA512
  
  8a476a44e81561d1067a062a1fa013e47cdbdb44cb49bf56be43fabf7c97e51bb87e9b3dd352e17e9239e7b85ff5518734f44fc219070b964b227c94c2e50f99
- SSDEEP
  
  24576:J3oH6mhNF4Xx7AmsqjnhMgeiCl7G0nehbGZpbD:5oHRFEBAqDmg27RnWGj
Score

7^/10

persistence privilege_escalation spyware stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

persistenceprivilege_escalationspywarestealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.