Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 01:08
Behavioral task
behavioral1
Sample
2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe
-
Size
12.7MB
-
MD5
4d3ab23846b9dedc7b0ed695e873fced
-
SHA1
82e6b2fca15eb28accaba9541b08dba74c19fb43
-
SHA256
05214e5aa2516af0f07882ab92a4c9e7a565e721e16eb96c7fda7bd2f980dfbf
-
SHA512
05114eec1919e473b2c0342c76be05caae90105720df0f9c5c0f338cc1cbcc7fa6f9beeef681a7ff2ef7878c662f2ce98b35eca8caf2e8462d9841591db5b1c8
-
SSDEEP
393216:nl4Dgt/xPBgn9c5hlERsMRFJzFcguYtN3ZWqg2j:l4UQEhksqZtN3dg
Malware Config
Extracted
C:\Users\Admin\Pictures\README.txt
demonware
https://keys.zeznzo.nl
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL 37 IoCs
pid Process 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 3060 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3060 3008 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 85 PID 3008 wrote to memory of 3060 3008 2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_4d3ab23846b9dedc7b0ed695e873fced_ponmocup_ryuk.exe"2⤵
- Loads dropped DLL
PID:3060
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD59fb7daedd82bdde61d467b7a568bf577
SHA18772a438d9735498be7ed4d566bb0439361aaa56
SHA256cf235e8f929568ee0c24c676be7fb15e6a8820cb8437cd06bee1e038b80deb2b
SHA512456db61224d9f3ee5786173be2998ecd54d05bc29919ec8e1a7a917eb5f42fbb3edb1aee374d9b97b4db94591be440f58ddbd0f32aab1a2977db28573223e806
-
Filesize
13KB
MD503c703a8f4c2a1443cccc8316af8940c
SHA1046d8c846d9393e472064aa1250826994a785577
SHA256ca09e03d93f3a330a467afd7fb998ad81dfd75fa7a1c2e202d6898f229c269d4
SHA512a65bf31452e984de1f951a3bca97c9dc27ac113e5fd4e0d29fa2b67e6c1b24d48ba6513d1e2ceaa7617e92305171e9675379a0e97980a3ceec209c49cd687329
-
Filesize
13KB
MD56f1d3ed33d7dfeae5642406d76ff2084
SHA1014cfee7d754564928ed2df2fef933aeda915918
SHA256f5918822781473d44f69030a9b32bcaeffa8671f1328c48085c9671f140d1273
SHA512e55f57ef9411979ab164d5c3faca609856ddaa273ee817225ba77a12ddad02da464378ca0cbd98ddec708aeac96845ab8c718d35edc88b0ab06bb14ed53647ca
-
Filesize
14KB
MD5c04554cf7f89e2d360ebcc39f85a2970
SHA142ac403bd2a854d7f6ac60a299594a9c4a793f35
SHA256264ed03313efc36ef0794e3c716319e0aa4774c3d0a26c522dcfa7be1f46349f
SHA512668928abb8510d36dcc2e9ff7cd10353c3cbc10af199ca4c909770921fdcbe4aeedc5dfb106c91cf480c86a2ab78e2da6278d859aae93cb72bc50de432411ed9
-
Filesize
11KB
MD5d4535f5b8683cd4b523d1f97232d3772
SHA11a6ce4eeb5acd1762f629478db14dfe8e361967f
SHA256a8bd1b23f25393b26570a23f3083227dca1e2a6c4422581ff3e46cea3c4ac4ad
SHA512447c9b1772f4a4f91961268e1b87c3576415f5257197db16336a3be8601dcfc8cd01dd1bb0676403633c58b8593aa9f558bbd53ccd994f5702df38c265358730
-
Filesize
12KB
MD5b537c5216bd68311d50b10d62d02b9bb
SHA1eb613bdabc18ee0f43afa4a13e684d0f8bc57817
SHA2562b4fefd3688f5e92b1c3ef745d3463d44d9c071b9e2e190a7179191cd3b1e3a5
SHA5121a3a8e9454646d7ac87f0acc34092da9c3873e4912ea8cb7c335d58a1bf7336d370dda9da13fdc6148ebfe93e3b75ceebc0684a5ee7b4ae24e8e2b5d053afe38
-
Filesize
15KB
MD52101eb8948ad5b50feeceb0865169d48
SHA1fd55a3553d0c0416cd733ae732361685c0d23c59
SHA256962a6e4baf1fe8579b815c059abd924563835fc2139fa16d4ba191c291d033ec
SHA512122c8ba5df3d3c2b6ddb6de8415634c02c296285e629f780e1f9d9a4afaf1ef3bef0863f83748f2ad5847385e349b4d39c4c54ed7d4246f502603080c5b973e4
-
Filesize
16KB
MD57b4db40a5af596c7b685b1bff8c85a63
SHA1bdc1ca3a817731ab89fcc0ff8f9ed540b8fe016d
SHA256938aa6f71988f899c605dfe09a0882403af0564eb1937316bf50bda5b63659af
SHA5128d995a342eecbb4278ea02ca84b0c5d3446b06952c1ce29e3d3eb1aa95c7b31cbd88976bd6bdb2c92c4e5e25103d392aa911a5f718cca3cb6e9e0c2d9e8695fb
-
Filesize
19KB
MD5abc7d549b8974a93e441b45b118a3f8e
SHA11b78c6022f03550ca48a67aa2b2edc0add3a5fd7
SHA256059e3b26c6816c5f2e3a3d6fdfcc0298077221cd8ae8a17fc9fe6d67ef2bfc3a
SHA5128ac63714eebbe6c4ff7da73ebe1e03be1aaee194d635df068108956bf009b872bad1357a5c41e5780d053903784c10797d417f90f941e362f3d3774e91bbb98e
-
Filesize
21KB
MD54c16bb062911f8d38d881022dba921dc
SHA1fed09bcb06fa5bb604bfb81d4aecbd012548f5f9
SHA256d72174d81ef9e6c8c9c2b2c9a0392e85195a1fde81757a8fa61e7561b8689f84
SHA5122ca19b324011f1957f2182b6d57a687cff1805e94c27118452d7b579ea4dc9bdf2f409c03cb97b71e312593c41312bd278c25d52cac1cf0eecc72ce79ba0d08d
-
Filesize
13KB
MD5fdd4207ea3c8938d4c1150a9a15b5987
SHA12f4b87a20474a825c5b4c45d0bec15b1911f54ce
SHA256f7ce5ed7d00bed3c9c9f41a75d616930bc06973a86f721aaebe1529719c48a0f
SHA5124b6d8b76edbd4a4bb0b6e704c8ef58474975f4b2c09e7ca0364d40f154ba1e1d2511b5d4757071fbcb0b98f0a39dd182bc05ee1118deb7fd8ce9f47428bd6fcb
-
Filesize
13KB
MD52c9b60c7800d640ddbfa6f2aad83c41e
SHA14778df5386fa9e676cec84f6a144212323eb5817
SHA256a6c6e4735cc74b83bb97a94452bcbdd46e825ba485d9ab5cf2f134e7addaa48f
SHA51238e3993a4e63abb47fbfd266925ca8c588f553cd46799910ea337d00b29240a412bf33fc5486760c3e4d87577d836bdf1b45395cdba8fecc3bec4da92b2bf8b6
-
Filesize
11KB
MD57178bf889c059dd34240c73a87d7e2c8
SHA13c8a3bcd0c60c33b74719536b42323cb183bb05f
SHA25604d50a58068b32790015186c55cc83d204dbfb94e245eae131806576f2d4da24
SHA51215539b3ef516eca7823884ffbca61cb0cac9143d9ff39778985d1e980da0184f85c38ebd627935aa332c7f55e87216ff9040b21b61664f454dce630621dd9e35
-
Filesize
11KB
MD5c718722a0c7e48a91b492b604ca15125
SHA16fa5b7da8366bfd7ae575452d389d01bfa25e6b4
SHA256248962dbfabfd47f79df23f22754e6644404ccd10f152420a639de12215a615f
SHA512953aa4827746ad544e799976724f657a56337407bebcc0c721b926caa74fae6bfc42acbd194c4220f3e0e4edc5e325674be3f0773859f9ed40ad943a359058dd
-
Filesize
2.5MB
MD5c66d257279177dee61c361915692cc7c
SHA16c1e096368e486fb135eed1f4b8a3aca5bd641ef
SHA256a12143791b0afdd56cf213eafe826119932a52bd41569def6d9fe001f0379dbc
SHA5121aea89ec2cb5b2757c06f0e9225ebdf88f05beb5e5c1f73363058f5c0925637a17c463f8e8dead470aba38ac4906ed777182907a4bc8c188c2c54870a0e9d0a1
-
Filesize
99KB
MD518571d6663b7d9ac95f2821c203e471f
SHA13c186018df04e875d6b9f83521028a21f145e3be
SHA2560b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f
SHA512c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21
-
Filesize
84KB
MD5fc0d862a854993e0e51c00dee3eec777
SHA120203332c6f7bd51f6a5acbbc9f677c930d0669d
SHA256e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863
SHA512b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f
-
Filesize
123KB
MD58adb1345c717e575e6614e163eb62328
SHA1f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3
SHA25665edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8
SHA5120f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae
-
Filesize
173KB
MD54d1c727663b949fa6aba4f9a71693dc9
SHA1fe77deb2b1da2bd30206e50d48d67ac8b9c84fd6
SHA256bcd6f366a7125de7e33ade6f20032cb134e530883c5af9fca74fcdfa2151648a
SHA512df51023da0de97624b354451829b2b2c6bb9d90db5c022dd3d38cdb5e3d4c329c5250e2c34879e95af2e270d454e4bc599a52b4ebaf8ca023f5d60f1a1537ffe
-
Filesize
45KB
MD55fa7c9d5e6068718c6010bbeb18fbeb3
SHA193e8875d6d0f943b4226e25452c2c7d63d22b790
SHA2562e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155
SHA5123104aa8b785740dc6a5261c27b2bdc6e14b2f37862fa0fba151b1bc1bfc0e5fb5b6934b95488fa47c5af3fc2b2283f333ff6517b6f8cf0437c52cf171da58bf5
-
Filesize
158KB
MD560e215bb78fb9a40352980f4de818814
SHA1ff750858c3352081514e2ae0d200f3b8c3d40096
SHA256c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806
SHA512398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230
-
Filesize
77KB
MD51d53841bb21acdcc8742828c3aded891
SHA1cdf15d4815820571684c1f720d0cba24129e79c8
SHA256ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b
SHA5120266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9
-
Filesize
62KB
MD57577b428063ea0eda1e0937f4976b078
SHA16256415033aae978835fe3dc4523a462d5932873
SHA2567fdbb5a713a3de7413564a2ec15c8715f3ba203bfe2b944c9cda610155c511d1
SHA512a36e09535579e5cc2fcc86659ae60fa7a779bfd577b6dc9d27fec78e8be1e095f52320fe0822fcb080b96d71729e97c6f07c8728565e8aea708426289485147c
-
Filesize
767KB
MD5a57bf309a834af323f02f9fc86f6041f
SHA1cbce0d3a238afe0d9c12b5315f31622922bacf69
SHA256124e2bf84d69508ebbb9a0e02dea974799cc886ee65e8cb7a8cfd46831fe0842
SHA512e69bf1ff46bf34d2cdc1dfe1ee8d0fb28aa2e5b0e3af150f2a0dffeb3e277249459cb57f67cc45b2ac28acf86adb20cb594b5546ae6c4c51fc0374a511332e5b
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
1KB
MD5dd599af0347cd04ed71a484ac5e5ce8c
SHA10fb19ed1e1a753e6d4ce08a0abce998e7c15d862
SHA256b3a30939dfb1abd2bdd1e06b9a0fb9dd1752984c42a0815ccfbb4f5541fc7455
SHA512aed0715386cf78a76a2e98487ca624df00c6a8ff1f0620efb183a5955196ebe82f7f184e3708d7d9c8877c4f947abf4a2cb7a692a912832b8c8b6ca05293566f
-
Filesize
184KB
MD511a886189eb726d5786926cc09f9e116
SHA1d94295368a1285681fb03bac0553eb1495d43805
SHA256dc38bdbe10cfaa99799e0c87aa8444fc062d445b87686d6593ffca46cc938031
SHA512405c56487a91ad1209029ca6ea125642076251f0a8c069eef0e30ce484381db7bf24d2f5cd74b83d1c8c1358f92f35fa6ed7b75601ace611cf36bb2331588684
-
Filesize
4.0MB
MD51f2688b97f9827f1de7dfedb4ad2348c
SHA1a9650970d38e30835336426f704579e87fcfc892
SHA256169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc
SHA51227e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503
-
Filesize
26KB
MD5a2ab334e18222738dcb05bf820725938
SHA12f75455a471f95ac814b8e4560a023034480b7b5
SHA2567ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7
SHA51272e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
1.4MB
MD5fdc8a5d96f9576bd70aa1cadc2f21748
SHA1bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA2561a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
SHA512816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
-
Filesize
977KB
MD55b1c91b53ac3c3026d50de8c05aba139
SHA1b9c2d160b1ce856d9904a340362236473a3d559c
SHA256d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7
SHA5128e01056830e65320d684245bf055305e03ef136545efb51aad484a5b1b006f7d534c30b7973da8628f49c31710ae23d3420f941156c941172b97efe9e1ef9a1f
-
Filesize
577B
MD5827f7da7ad47cb8c6647c0478042301e
SHA17e45a7f3bdc0eb7e98bab2dfd020cb796efd8d84
SHA25635e838bc9daeb0357da9211c4da95d3e557a9600d986cf6e74deabd1ac8db839
SHA512370a5b6e2622945353ae12b5d25ae0be7baa7cf19006e4dba68e8fe629e284d062a3ba9911aa4243de837de921c97eab008524b3d2122f41f9a24401eb0a45b0