Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2024-11-06...uk.exe

windows7-x64

10

2024-11-06...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2024, 17:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe

  • Size

    3.6MB

  • MD5

    2efdd766c7ea80e938f375001d0b59c6

  • SHA1

    af40b328ebcb13496a1f1bc54ef21e04b15c0eac

  • SHA256

    dc182d5c9b26e7f6c54df8b516cf3b4b3a66895c85100accdc7f3751c3c60a76

  • SHA512

    5d82b9edd93cbefd6c811888b8831c2eea9f408c6e93b02f6340f4f4310222f186562b2d8bd009723d200fdb6026b1d3c1065a39b9269aa354e5454fd791b88a

  • SSDEEP

    24576:bw317sPycp8nCB3CbJE6rARaZvSn/DCQh2gqDDg0NzypyVmwXEWYdaBWmMYOLJVh:bByPnISnSuXg0VjpI2sLDkE

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

62.60.217.17

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    Carrier Agreement

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    1.048576e+06

  • port

    15666

  • self_destruct

    true

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza
  • Meduza Stealer payload 6 IoCs
  • Meduza family
    meduza
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
      C:\Users\Admin\AppData\Local\Temp\2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4776
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\system32\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1704

Network

  • flag-us
    DNS
    api.ipify.org
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    https://api.ipify.org/
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    Remote address:
    104.26.13.205:443
    Request
    GET / HTTP/1.1
    Accept: text/html; text/plain; */*
    Host: api.ipify.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Wed, 06 Nov 2024 17:22:11 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    cf-cache-status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8de6c3a36ffb9557-LHR
    server-timing: cfL4;desc="?proto=TCP&rtt=26292&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3274&recv_bytes=402&delivery_rate=179449&cwnd=253&unsent_bytes=0&cid=7262c533e2655182&ts=1465&x=0"
  • flag-us
    DNS
    17.217.60.62.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.217.60.62.in-addr.arpa
    IN PTR
    Response
    17.217.60.62.in-addr.arpa
    IN PTR
    assorted-clothaezanetwork
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    205.13.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.13.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    c.pki.goog
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.187.227
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    Remote address:
    142.250.187.227:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 06 Nov 2024 17:04:28 GMT
    Expires: Wed, 06 Nov 2024 17:54:28 GMT
    Cache-Control: public, max-age=3000
    Age: 1062
    Last-Modified: Mon, 07 Oct 2024 07:18:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    Remote address:
    142.250.187.227:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 06 Nov 2024 17:04:28 GMT
    Expires: Wed, 06 Nov 2024 17:54:28 GMT
    Cache-Control: public, max-age=3000
    Age: 1063
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    227.187.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    227.187.250.142.in-addr.arpa
    IN PTR
    Response
    227.187.250.142.in-addr.arpa
    IN PTR
    lhr25s34-in-f31e100net
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    102.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    102.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 62.60.217.17:15666
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    27.7MB
     264.5kB
     20698
    6509
  • 104.26.13.205:443
    https://api.ipify.org/
    tls, http
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    896 B
     4.1kB
     11
    8

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 142.250.187.227:80
    http://c.pki.goog/r/r4.crl
    http
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    556 B
     3.8kB
     7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    59 B
     107 B
     1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.13.205
    172.67.74.152
    104.26.12.205

  • 8.8.8.8:53
    17.217.60.62.in-addr.arpa
    dns
    71 B
     112 B
     1
    1

    DNS Request

    17.217.60.62.in-addr.arpa

  • 8.8.8.8:53
    205.13.26.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    205.13.26.104.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    c.pki.goog
    dns
    2024-11-06_2efdd766c7ea80e938f375001d0b59c6_ryuk.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.187.227

  • 8.8.8.8:53
    227.187.250.142.in-addr.arpa
    dns
    74 B
     112 B
     1
    1

    DNS Request

    227.187.250.142.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    219 B
     159 B
     3
    1

    DNS Request

    228.249.119.40.in-addr.arpa

    DNS Request

    228.249.119.40.in-addr.arpa

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    73.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    73.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    102.209.201.84.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    102.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4776-0-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4776-1-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4776-2-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4776-3-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4776-12-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4776-13-0x0000000140000000-0x000000014013E000-memory.dmp

    Filesize

    1.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.