Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/11/2024, 07:04 UTC
General
-
Target
2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exe
-
Size
4.1MB
-
MD5
7c7d0d6b2de056f86ca95d9baaf6c44e
-
SHA1
6663f7513688f1a346e9e928799fa893ab015fb2
-
SHA256
f8f269c80e6cfd9f4e72c56afb40d79294e82443b9c9688988f0cb60e312efca
-
SHA512
84afb96c9c436edfbd54f46e19156780c04d6618f6d5b5728f9e9d83b35005d84c02a8f0b2c8724123c1436e40ba95c9d17eab1382b1b709a59691104dd396f2
-
SSDEEP
49152:/xGK0l3e3uF0cqW/bXtq3pDu5k/DcU87rwGFo9MmihiHzG97r3SZ:/xGK09yuiZ
Score
10/10
Malware Config
Extracted
Family
meduza
C2
109.107.181.162
Attributes
-
anti_dbg
true
-
anti_vm
true
-
build_name
592
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Signatures
-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload 46 IoCs
-
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exeC:\Users\Admin\AppData\Local\Temp\2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exe2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2024-11-23_7c7d0d6b2de056f86ca95d9baaf6c44e_ryuk.exe"3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30004⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN A104.26.12.205api.ipify.orgIN A172.67.74.152api.ipify.orgIN A104.26.13.205 -
GEThttps://api.ipify.org/Remote address:104.26.12.205:443RequestGET / HTTP/1.1
Accept: text/html; text/plain; */*
Host: api.ipify.org
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 23 Nov 2024 07:04:24 GMT
Content-Type: text/plain
Content-Length: 14
Connection: keep-alive
Vary: Origin
cf-cache-status: DYNAMIC
Server: cloudflare
CF-RAY: 8e6f4e122d496542-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=63157&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3278&recv_bytes=402&delivery_rate=67933&cwnd=253&unsent_bytes=0&cid=c52fc3b83561046a&ts=624&x=0"
-
DNSc.pki.googRemote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.200.3
-
GEThttp://c.pki.goog/r/gsr1.crlRemote address:142.250.200.3:80RequestGET /r/gsr1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 1739
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 23 Nov 2024 06:16:20 GMT
Expires: Sat, 23 Nov 2024 07:06:20 GMT
Cache-Control: public, max-age=3000
Age: 2884
Last-Modified: Mon, 07 Oct 2024 07:18:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
-
GEThttp://c.pki.goog/r/r4.crlRemote address:142.250.200.3:80RequestGET /r/r4.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 436
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 23 Nov 2024 06:16:33 GMT
Expires: Sat, 23 Nov 2024 07:06:33 GMT
Cache-Control: public, max-age=3000
Age: 2871
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS162.181.107.109.in-addr.arpaRemote address:8.8.8.8:53Request162.181.107.109.in-addr.arpaIN PTRResponse162.181.107.109.in-addr.arpaIN PTRdeluxe-quicksandaezanetwork
-
DNS205.12.26.104.in-addr.arpaRemote address:8.8.8.8:53Request205.12.26.104.in-addr.arpaIN PTRResponse
-
DNS3.200.250.142.in-addr.arpaRemote address:8.8.8.8:53Request3.200.250.142.in-addr.arpaIN PTRResponse3.200.250.142.in-addr.arpaIN PTRlhr48s29-in-f31e100net
-
DNS68.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS56.163.245.4.in-addr.arpaRemote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS140.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
DNS90.160.77.104.in-addr.arpaRemote address:8.8.8.8:53Request90.160.77.104.in-addr.arpaIN PTRResponse90.160.77.104.in-addr.arpaIN PTRa104-77-160-90deploystaticakamaitechnologiescom
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
109.107.181.162:15666 -
104.26.12.205:443https://api.ipify.org/tls, http
HTTP Request
GET https://api.ipify.org/HTTP Response
200 -
142.250.200.3:80http://c.pki.goog/r/r4.crlhttp
HTTP Request
GET http://c.pki.goog/r/gsr1.crlHTTP Response
200HTTP Request
GET http://c.pki.goog/r/r4.crlHTTP Response
200
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
104.26.12.205172.67.74.152104.26.13.205
-
8.8.8.8:53c.pki.googdns
DNS Request
c.pki.goog
DNS Response
142.250.200.3
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:53162.181.107.109.in-addr.arpadns
DNS Request
162.181.107.109.in-addr.arpa
-
8.8.8.8:53205.12.26.104.in-addr.arpadns
DNS Request
205.12.26.104.in-addr.arpa
-
8.8.8.8:533.200.250.142.in-addr.arpadns
DNS Request
3.200.250.142.in-addr.arpa
-
8.8.8.8:5368.159.190.20.in-addr.arpadns
DNS Request
68.159.190.20.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:5356.163.245.4.in-addr.arpadns
DNS Request
56.163.245.4.in-addr.arpa
-
8.8.8.8:53140.71.91.104.in-addr.arpadns
DNS Request
140.71.91.104.in-addr.arpa
-
8.8.8.8:5390.160.77.104.in-addr.arpadns
DNS Request
90.160.77.104.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB