Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 01:51
Behavioral task
behavioral1
Sample
2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe
-
Size
11.3MB
-
MD5
c35b83af72f31da5a90ac85bc206286b
-
SHA1
5252ae7ea2493786456ebaac71619a7adae37397
-
SHA256
0ad70ccda65a7543b19290e288c255d093dff9fb315d6c17902b56e0648c1b30
-
SHA512
5c4761656b709c7f222c8e93530288f4f5addcb1b8f394de5602ca43e455db951d0ad1eba07867d3586f22101b978bafcf10b9141d69332ea1cbb49d74b86c7c
-
SSDEEP
196608:ZOgEmz555jYu/mmWeeOuWJysVYvsOFDeECRl2Ewf8jI48RmU/3ZlsPv+dv68CDOG:Emz51TWeeDWJVHykUtN3ZWMFG
Malware Config
Extracted
C:\Users\Admin\Desktop\README.txt
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL 52 IoCs
pid Process 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 652 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 652 2720 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 30 PID 2720 wrote to memory of 652 2720 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 30 PID 2720 wrote to memory of 652 2720 2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-22_c35b83af72f31da5a90ac85bc206286b_ryuk.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:652
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD570398840c51be1f97b011b0d5f6116e2
SHA1bb303242a812444e14900724574f115601820b9b
SHA256ca0adeb0602b3574b93f17a2c2d7c0c0046ea26a46ee8046149ec2bf2ad80ef2
SHA512968d7a8075c09b5969044fd6258aa81a7f00cd901a172c8cbd45147621c8902f787a5eba6c6f8a010aa4db8bc211db769c94d71edb8b3c12907180859ed8bac0
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
87KB
MD58b40a68ae537c0aab25a8b30b10ab098
SHA11c8ac1f7f5c3697c457dd98f05296c2354ff7f55
SHA2560b86ef4810d53e79f1d934b427fdbacf3792eebb37ed241bc89148238af763fa
SHA512620ad61ff05c73adee4ac8f4b88a3880c11893eaac77ccca4e88edb29b492366a5bcf813d18628f005730f7e45ce373af9275776ea768b67b8d0e3bc62949229
-
Filesize
74KB
MD50ea1df6137ee3369546a806a175aecf4
SHA195fd1ad45892cb9e655bfa62ca1be80a0b9b2d43
SHA2566fcc31573ae6b380db1d4e23731755465fd2cee0856e7a6c0e396759bcbf73b5
SHA5126497fdb86ac69f6551a7794c090ca695bf22eb647b7a503fa23d7944ad375f061429f17e2ea043c809460e7cb9fc3df77c7bfe0b64f00ddd65de1aa744d3adcb
-
Filesize
11KB
MD503dd721008f2c381d5d5c7cf57509d23
SHA1b45a754cbda6d47b9df564fa61246ea7b4f405c4
SHA25677059cc0036311541ddb7f5182c0a3e81fd19f262de8306f84373e9b5b2854b6
SHA512652df41311ba3c1137faff51723b8ecb403fbceb1e07a3d034a7c0cacd97e392d72e77f3e74ce3ba54b355074bbd2511fd0d4e151c67a8928769a8aa6cbf908e
-
Filesize
11KB
MD5217ca9b1f7e0c141cfc7f00f17b76ca0
SHA1ce2245c649ec9356b8379c3c0472e3a82a3cd61c
SHA256380d5872d01f3bd52a5e9094f0f855db18306bd6215a02e134be970f0c0d9c77
SHA5122cbd037d45bdac48f6b8f2298d105b28cfe6f07134a07894a5603826dfc05ed862ddeb91d7f1fb416d2496d48d705417c6d6608d52281d8b878102d9523e17f3
-
Filesize
13KB
MD5561211c711778a0d17b5b00d5debd5e9
SHA13430979d10342c923f72c2703dd69e3ab8b7f08b
SHA2565ae2d370948811935300bf4ded67c21aab8137e1365c419b2c27d11e91dc591f
SHA5123f782130a59aeb722065509933eeeaf0ec7368e6c082ceb0d3435de74c5e680696a2271a1198388da9fff7d9ee285abadbffc6808f1d773ec4b1a29d86067670
-
Filesize
11KB
MD54a6fc6c389a3d807163dd5edf362174d
SHA1c1990674102062f873055609a14a456b13aefe02
SHA256a2c259e61c4ec1bb7611ac23830588747dde103363bdc671cf91a2433afce283
SHA512b860456e04fbaae73e39b7e7e9a69e3bed17fc2c72c86f56ff7aa61a6b5a68bc6cb40018921c874d6aec68a7ec76a6e8b73b9d4d79b9e3f2c00f493f118789cb
-
Filesize
11KB
MD5dc07b990d787b9aed770693ff90d173a
SHA170b7b03dd71714b5ab52de1407a9070789063be4
SHA256ea0f6c20f03568641c01b4eddbd263a7122a2c61c88136085b3339cbce56c4c7
SHA512344e20d51c990cbaa76b93afef2c5ea367243751b1c1b85c7afe9e56dbcee901d7d82d16e159583290408686a05dc819e12d021cd62d9629e6079f10367d5726
-
Filesize
15KB
MD5d8f7a8440c5b23a587d981e7b9a4892c
SHA14782b169363f7bb135ca2637fe8926da9b0ab60b
SHA256177e190aca8cc88c1ad1fa1f8848f9abcbbc24a5dfd046cfff06f72fff1a3566
SHA51260f2be466952f3c75ba8cc963832076eb99c7f29163cdd2e3c2d9e01ee3dbc29ba4eeb00b90a3d9e64146e3cd350e1675e186de6efeceac95c41174131d1d344
-
Filesize
11KB
MD50753722e5bd0af130c1b465f2981477c
SHA11d6e6702496a5d68bb50a7f96492d6fcd31267fd
SHA256fbd4bde83228c37de6043f36a98610fa4bb053355ead44a59d33a464ccdb9fac
SHA5120607657f33235284f577480ffbf3ffbe25a0133ce709ded6356351fb2383c15fd9a835fabc159a6efb3a481491c36eac9b825aa38cd5b87f09cb6d487764e1a1
-
Filesize
13KB
MD5eba98af7ba9fc4696bfd3f03d43ce07b
SHA124d1632cdc55d6e513888c0f119aaff418668b21
SHA256c31cfd12bd6c3da456bada513bb381d33ebb6980465ff0d586b24fe84719b50a
SHA5122019fac652141e1a49e85f9929132a0a84227d680488df3709243205cc69c350451be5c0ddef94a13f615aa22e09790091d21306091b4d4e996ac5f19935e86f
-
Filesize
12KB
MD5c2f694722f8d98990b218ecab729b0fe
SHA195fd1390dd8247759b2463d9ad415d0a45fe659e
SHA2561fc7051de0d107ac25badb41bc6062bd3a67aaf5553b6256052c65e51b548df5
SHA512f48973d0fc2f4cf90f7e5d63ec3ca9968884a22f1139845cb01dd554c83403c23edb8067e5fa3b43b3c4079a71e2b6bd5799edb7c0dba75f8e7c753b7f4f2882
-
Filesize
11KB
MD562ed9da33afe5624a08d9427527536fe
SHA115aac6f0001ca1084d449969f70a3f4ff9a5a067
SHA256860b4ebcf673ee4c389e0ff8f502f540fd1ce8b2614a9c16b7f65cdf5c2ae0f2
SHA5128c6c391bfb6c066fe716cb1d5f0ea84fe8af25226220602532c921af8e663a6bc95b8efda83dd196eb3f5e3dacf7262c244719791a825c1a287162f0cdce530a
-
Filesize
20KB
MD5cab18eac01b9fcf6a0ca74e95fadb8b7
SHA1f5770816a0547c28780572cb24c257071ae7fd36
SHA2567aaf66c87221eaac91c50ec1368f4accd32b63970f0e826f7ffffb2c4306664b
SHA512c8eef88370c5696c2a27e6a857ae3675f9b800c5181837a8ec97d3eb3997e546b54761261d567ec23cc698f7e4334589784503f81620a7c932acfd66cb7e0e2b
-
Filesize
12KB
MD5a4fa9ca07855a7f237d1908e62b5b1c7
SHA140906f74ccb58923f7776657484443010157db92
SHA256733d3c3856868107e5708c92e747aac6df968a4d072328a8e8f36425d0e81770
SHA512bb26ef58883a94dd04fc334a26f100ab7d2146d59a34903e1e0f074110a822cd1d33b940e117cae1837f08ac33e66b5157f03872e65bb8a7ee70cce7c4b9a203
-
Filesize
15KB
MD54cdce034568c1177325799a60f987f27
SHA143d680d815c64b4c6cdff9c212923e507c89d6aa
SHA256b27cfa62dc7a0a115b1593d6f4b0c90ae494505dab3cceeacc013e2135d25969
SHA5125cbf4d38059f13b7dcb78fd060846b1f44b32fc382ee8371fc44e254a68447cbbc9f0fe3eae35987b490ac90c680723a03a5b701255429e85bd206510b38611a
-
Filesize
17KB
MD5020e0dcc82a7c5afdee3fba57c5f30d3
SHA1ce7e1791a5326f5f527aaa0b16208f0f3997ff99
SHA256e1bd3f4b19a0c7e574673b88b12d819d97d503350ed280ce2204afbdd7c9bc5a
SHA512e8c2841415e3a596600fa90c551794790ac86613bcff48c81ad893b99a1a980198b8ef4bbac972da72218c1b50f2e0956a65ab1e33c502220f367ec02069223e
-
Filesize
17KB
MD56a2c655bc6b7e2edfc98b632b521697d
SHA1f7000ba98d92ddbaf268647a4e95da5debbb332c
SHA2567e69bbbc6ef5072b6c8e17af5f842f9959bc12335ef61cc6398d18ec8e03c41d
SHA51223248d09e095904fc8665eea4ce3a2b937293b8ed20b70973101104bd18ad37f032bcb8a3c851af23812de560208d9c96521c9060852394eb45cf7410460cd22
-
Filesize
13KB
MD5cb20ccf93e34cc08ab4b58a344e76dd1
SHA19895feb39e4b29799b7adb3972b774093093246b
SHA25650cf24a5b850ab992431f98dfe208704e7bc07427f74dee9873d0146900d56f4
SHA51272f2490f5aedced9eb0a398134360f6f2affda8d493575d3e2920a17a72f9d03397e462bf2d27fa8260f255da15fde808fe31a6388b65a1f4180ccb29a07fd7d
-
Filesize
764KB
MD5ea5f13815995acc665814971b0ba395a
SHA11ea954ef9c6eed89f5bf77eb56b2ed9144f5ec0d
SHA25652fd8d303a435a302c533ed304883eba82248fd2c407fc36bf897a1914fe90c2
SHA512ec05866a777328746c94c3daa15dd397f2d3d14e88ba0a544a9e75e24b4feca6183828973237fdfadd15d7454fc476dda1d569b19267f1d26203276c9bed2bc0
-
Filesize
3.2MB
MD5bf83f8ad60cb9db462ce62c73208a30d
SHA1f1bc7dbc1e5b00426a51878719196d78981674c4
SHA256012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
SHA512ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e
-
Filesize
1KB
MD522a0ccba48fe09df9b1a9dc4d03348c8
SHA1b83b7b140333e5fcb70bf361e717453982f8be1d
SHA256d4dc6e1c6191a54fd372aa0bb6c8db946d4be94b70142d0d9c3aab4d6b11d28f
SHA512633abf3a33f13e21566d7e0ea1d1fccd52fca5d5237202e0266ed46f539a8354b877487f422b29e2082b62f4adc8acf1487620f6b60e417f4d91663e826eef7b
-
Filesize
3.6MB
MD586af9b888a72bdceb8fd8ed54975edd5
SHA1c9d67c9243f818c0a8cc279267cca44d9995f0cf
SHA256e11aa3893597d7c408349ebb11f47a24e388fd702c4d38b5d6f363f7ad6e8e5f
SHA5125d8fd9040f466e23af7f17772e3769ad83c5f55f8c70dcc3cfb1f827e105f0f4e6133f0e183fabc67dd44799495c47f931bf92546342b30b9c4a5c2b4aeee7c7
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
971KB
MD51eb17f650462eea820f4cd727d2d3ab1
SHA1688f59160589ffa293502bffcd5c0e62e1993903
SHA25624968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
SHA5124b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
-
Filesize
680B
MD51360f25874309b7a35ad31b9ceaa984c
SHA1dc0f58dfb19f88efcd76ffada078a145a43cdf36
SHA256da116f50c9950d8414fc42bb4eeea6e6f32deb784f66058d0cae31267af589b1
SHA5125b6ad025e86bb0f6fdcb55f858f956bc21f444eddf7a8e6016c62762bf61702d677b1449aa457ca1e73aa46a9b08cff1162ed642af8ab500b68f1d41940095ef
-
Filesize
131KB
MD59a69561e94859bc3411c6499bc46c4bd
SHA13fa5bc2d4ffc23c4c383252c51098d6211949b99
SHA2566bbde732c5bcb89455f43f370a444bb6bca321825de56f9a1f2e947b0a006f1c
SHA51231d9e3844f1b8e72ec80acd1e224a94d11039c130e69c498a668e07e0d8bba8d1ed1ebe0b7a16376ca597d0e2b74a0d5e3bf53d1cbadf5bf099d3bf78db659a4
-
Filesize
38KB
MD51f77f7a5f36c48e7c596e7031c80e4ff
SHA179f86e31203b60b3388047e39a2a26275da411f5
SHA25630dfbd97883b1545513ca5bb857a9aad6e9bf4b8b4272569818346eaf25033f7
SHA512b647e820ae4854921839a6cc92610fd63ef79623d442fd17503a39ca145dfd6cde3719c50473c0c74fe487f980b12e90bd3d3beb5729fa5498a357d44f81809c
-
Filesize
251KB
MD516fb5a2363ce8dd12a65a9823a517b59
SHA159979d9195259f48c678cdaa36b5efee13472ff5
SHA256bb78ca0dd1478027e2e9f06f56fc7c3cc6f157b4151562d58a7f6646e463fcc2
SHA512d9801cdd8cc9809781b79882a226ee7a56d93eac0181295c80cb1f088f0fbf46e3eb35c7d8ff208dbd5a3e93a190a04c48fd254c9971a3740b020547973683e1
-
Filesize
67KB
MD5e994387279fec56a0eda4ca03eec759e
SHA1f3a3872b42c7c5bc3379a605dac398e8596e1179
SHA25601604c20b2ef42ed854c84c75a4227a844f543e54e1c05949281f9adabb762ff
SHA512f005e4916d0fb468c70946ca884cd38870a74dd8936ca49925e79cc0aa0458ca578b61e0be436aa2497e98c45f95513e14085289746f41027a2bfec540d3dc79
-
Filesize
12KB
MD5a98ec7edb339cd967e5cbd5eec174ceb
SHA112d54e0874928e157a357d666f4099b6f0e895f0
SHA256f17517f46361328aebf52954dd1b9181df5a98cbdb2395701e3e73c4da7a7a84
SHA512c32926b41d0d40da7a8824b70b6dd1958a1c02cef5d6d91409adb7d7b09576d1bf3bf08d3ba1300c79b992d8e9b1faf7c6bdd3d4e6916cab0f3002f6560e7e8d
-
Filesize
11KB
MD51ea4f3d5312c15a64904a6e9e457612d
SHA1f399df3e88b7f3a865d5a79a1873f3be5191da2f
SHA25633ca12e689203e92d20e1407169fce64f318ac327327e833061b4aad9bac9cab
SHA5120a2e2b69a58f74585ccb1c1d4c6200c4a2fc92ddf5bf17c2fc47b49abdc3a801f30dc2bcdd36d730f2da396ed2e2379765e2e2c0a95a69e22c7f6f3ba774388d
-
Filesize
26KB
MD5e1d0d18a0dd8e82f9b677a86d32e3124
SHA196a00541d86d03529b55c1ac5ff1c6cfb5e91d1e
SHA2564595675949851bd0ff65521e936647fcc5c8d2f32f0ac2641a262fb6323896dd
SHA51238e3b6b23ebcbdc60eeeed0bf3dddc69004a1ccd4a2486f3a9f8c0d4624b690e2e5704e3fe05bf1bf2c900bf4f5bc9439f45f3c02fd4c67783056b3da15e0f56