Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-09-15...uk.exe

windows7-x64

7

2024-09-15...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 00:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe

  • Size

    3.0MB

  • MD5

    8811c4e1059f777427499d52e475bddb

  • SHA1

    3a5d39a67f46afbb7642868f52cb98be0c467ac0

  • SHA256

    31b4c9317ee5f1d80b2e9ed56798d735311944d78ae26e33b527388b460c2e68

  • SHA512

    792f74d016b3ceef9bef0bb6ab607fdf22c5b55c5b3953f87168402beafd8b94bd60e1ca5ac990c0e0a86c76699f8a5d40b7393693c468150954e4bc52867338

  • SSDEEP

    98304:Kj0zPu9LbmxCb6ib4WraIox9XcQiNE6ZHopCFeUg:KjpBBWIox9XcAqHUCDg

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-15_8811c4e1059f777427499d52e475bddb_ryuk.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3704
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\StartAllBackCfg.exe
        StartAllBackCfg.exe /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Auto.exe
    Filesize

    846KB

    MD5

    149034d4a5d59769062fb576f051d092

    SHA1

    8e4fce741e80828d4af046f1980186b7d652c0f6

    SHA256

    02213a2e40dd90a251b27566b7ffb25155368a418b67047096924aafec918cd9

    SHA512

    2b51f9c16db5947f9a6e822582b36da2e0d6eb74431a9f843c30a406ad3b1756324f0e3dc3e44525fb6dd832c2aa573ed678f5f71627f6d9362717c311bac809

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\StartAllBackCfg.exe
    Filesize

    3.3MB

    MD5

    2e3d22d3ae68c0e91f33cd38bc102431

    SHA1

    7dc71b170c93b998cbf3392776f33d452e529171

    SHA256

    b2ef66bd88251361c327d85d5b4ba25ddca942e391e854ac5121687c52a97706

    SHA512

    57bb448a12529f523e0f0b8e4b417cd98584aa0fab62fed202410c8c4fd72e208468a878fdcced7605046a9338cf48fa26479cb6e769af846df4294396957c49

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\StartAllBackX64.dll
    Filesize

    1016KB

    MD5

    96d52d4473352f108c5d68e3be3d7e85

    SHA1

    af891af17e18894a25f119136282aea38056df62

    SHA256

    c4de824fa579e00d95a26cd2761dba85e2306b90724f32b6f6cf994ba2a51f61

    SHA512

    b6116d3380a6682c7b6d25d4e93556e4dc4e4f0203803a1fc0a8cdd6c45136b2b97559ed875740c2d3b3c2b4539576bbf4f529c71f578eb68bfe2980a1977519

    Download Submit

  • memory/456-137-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

    Download