Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2024, 00:51

General

  • Target

    2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe

  • Size

    3.0MB

  • MD5

    8811c4e1059f777427499d52e475bddb

  • SHA1

    3a5d39a67f46afbb7642868f52cb98be0c467ac0

  • SHA256

    31b4c9317ee5f1d80b2e9ed56798d735311944d78ae26e33b527388b460c2e68

  • SHA512

    792f74d016b3ceef9bef0bb6ab607fdf22c5b55c5b3953f87168402beafd8b94bd60e1ca5ac990c0e0a86c76699f8a5d40b7393693c468150954e4bc52867338

  • SSDEEP

    98304:Kj0zPu9LbmxCb6ib4WraIox9XcQiNE6ZHopCFeUg:KjpBBWIox9XcAqHUCDg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1560
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\StartAllBackCfg.exe
        StartAllBackCfg.exe /install
        3⤵
        • Executes dropped EXE
        PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe

    Filesize

    846KB

    MD5

    149034d4a5d59769062fb576f051d092

    SHA1

    8e4fce741e80828d4af046f1980186b7d652c0f6

    SHA256

    02213a2e40dd90a251b27566b7ffb25155368a418b67047096924aafec918cd9

    SHA512

    2b51f9c16db5947f9a6e822582b36da2e0d6eb74431a9f843c30a406ad3b1756324f0e3dc3e44525fb6dd832c2aa573ed678f5f71627f6d9362717c311bac809

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\StartAllBackCfg.exe

    Filesize

    3.3MB

    MD5

    2e3d22d3ae68c0e91f33cd38bc102431

    SHA1

    7dc71b170c93b998cbf3392776f33d452e529171

    SHA256

    b2ef66bd88251361c327d85d5b4ba25ddca942e391e854ac5121687c52a97706

    SHA512

    57bb448a12529f523e0f0b8e4b417cd98584aa0fab62fed202410c8c4fd72e208468a878fdcced7605046a9338cf48fa26479cb6e769af846df4294396957c49