Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
70323b4326b...02.exe
windows7-x64
100323b4326b...02.exe
windows10-2004-x64
100898a80dc2...92.exe
windows7-x64
100898a80dc2...92.exe
windows10-2004-x64
100aaecf7f77...91.exe
windows7-x64
100aaecf7f77...91.exe
windows10-2004-x64
10150e8ef3f1...02.exe
windows7-x64
7150e8ef3f1...02.exe
windows10-2004-x64
723e95ba676...7f.exe
windows7-x64
1023e95ba676...7f.exe
windows10-2004-x64
1028e7dc4aeb...33.exe
windows7-x64
1028e7dc4aeb...33.exe
windows10-2004-x64
350b0d6ae2...d7.exe
windows7-x64
1350b0d6ae2...d7.exe
windows10-2004-x64
33a6ebac4f8...ca.exe
windows7-x64
103a6ebac4f8...ca.exe
windows10-2004-x64
103fe801df14...4f.exe
windows7-x64
103fe801df14...4f.exe
windows10-2004-x64
1041367ad447...00.exe
windows7-x64
1041367ad447...00.exe
windows10-2004-x64
1048f4749f13...77.exe
windows7-x64
148f4749f13...77.exe
windows10-2004-x64
3499d936c22...82.exe
windows7-x64
10499d936c22...82.exe
windows10-2004-x64
104b5a6926ab...d1.exe
windows7-x64
34b5a6926ab...d1.exe
windows10-2004-x64
34bb0d8eb6b...81.exe
windows7-x64
104bb0d8eb6b...81.exe
windows10-2004-x64
5de3d5a337...ed.exe
windows7-x64
105de3d5a337...ed.exe
windows10-2004-x64
105e2b2fe65d...20.exe
windows7-x64
15e2b2fe65d...20.exe
windows10-2004-x64
1Resubmissions
25/12/2024, 03:42
241225-d9c21axjdn 1025/12/2024, 03:39
241225-d74ryawqfw 1025/12/2024, 03:37
241225-d6fzgswqbw 1025/12/2024, 03:21
241225-dwt4cswpdj 10Analysis
-
max time kernel
15s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 03:21
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
-
Size
321KB
-
MD5
04ba14a9828b000add142d0bcb42ac2d
-
SHA1
928a705a481384dee3aa9985bb2a9e1e6827902f
-
SHA256
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
-
SHA512
2fc56d6fdf360c0435f76822f3d99288c3b31462931eb128c7ed895bf93d88b00663801c1a5394b1ae5bb081ac76b004deaf46fdf2b0b9c027b2945a7c030909
-
SSDEEP
6144:ba4FsUiep6JzvI74kZO/+SJtwOW8HFBwK3SBDmhYfFQ:ba4Fs/7IfO/+SJFW8HF+KCIG
Malware Config
Extracted
F:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Ryuk family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe -
resource yara_rule behavioral12/memory/2476-0-0x0000000030000000-0x00000000303DF000-memory.dmp vmprotect behavioral12/memory/2476-1-0x0000000030000000-0x00000000303DF000-memory.dmp vmprotect behavioral12/memory/2476-3-0x0000000030000000-0x00000000303DF000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2916 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 82 PID 2476 wrote to memory of 2916 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 82 PID 2476 wrote to memory of 2916 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 82 PID 2476 wrote to memory of 3020 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 50 PID 2916 wrote to memory of 2932 2916 cmd.exe 84 PID 2916 wrote to memory of 2932 2916 cmd.exe 84 PID 2916 wrote to memory of 2932 2916 cmd.exe 84 PID 2476 wrote to memory of 3044 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 51 PID 2476 wrote to memory of 3076 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 52 PID 2476 wrote to memory of 3660 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 57 PID 2476 wrote to memory of 3840 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 58 PID 2476 wrote to memory of 3932 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 59 PID 2476 wrote to memory of 3996 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 60 PID 2476 wrote to memory of 4084 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 61 PID 2476 wrote to memory of 4240 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 62 PID 2476 wrote to memory of 4448 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 75 PID 2476 wrote to memory of 1660 2476 28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe 76
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3044
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3932
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3996
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4084
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4240
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4448
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:642⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:643⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804B
MD5cd99cba6153cbc0b14b7a849e4d0180f
SHA1375961866404a705916cbc6cd4915de7d9778923
SHA25674c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2
SHA5120c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda