Overview

overview

9

Static

static

3

Ryuk1.exe

windows7-x64

9

Ryuk1.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    23s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 04:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Ryuk1.exe

  • Size

    203KB

  • MD5

    4f707c67968a14d08cc42958d5341707

  • SHA1

    accf64200195ef1ca9c7f497508c4bfb4e18da41

  • SHA256

    8da85cb00f7ba5e8c23b058d31a4b169c18936a8f7181015ce27e871d8b8cccd

  • SHA512

    9790ab884d3d43f23005a2085b3b320f9bf2ce8ccffd4476ea0b8f2a49cce11c6a61f3ed061d4fa759c167fd6728d890363a148c731251abfdab2bace96432ed

  • SSDEEP

    3072:6qUhUhEnI2XCIaxTrjCgmQ8GiVDswVAETR:bUWEIKXwr2OmA

Score
1/10

Malware Config

Signatures

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ryuk1.exe
    "C:\Users\Admin\AppData\Local\Temp\Ryuk1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4132
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
        PID:1736
      • C:\Windows\System32\net.exe
        "C:\Windows\System32\net.exe" stop "samss" /y
        2⤵
          PID:4892
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "samss" /y
            3⤵
              PID:1032
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
          1⤵
            PID:4384

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/2552-0-0x00007FF6B9060000-0x00007FF6B9339000-memory.dmp

                  Filesize

                  2.8MB

                  Download

                • memory/2600-2-0x00007FF6B9060000-0x00007FF6B9339000-memory.dmp

                  Filesize

                  2.8MB

                  Download