Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/01/2024, 06:40
General
-
Target
2024-01-08_52122a7590cb30373b0806244c7b09ee_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
52122a7590cb30373b0806244c7b09ee
-
SHA1
399bdaa455a85f9d711c20e61592364954aa3053
-
SHA256
2a85ffa59fe50aff8ff2c9e937986a07fca2082da12acf777e3accd468e32450
-
SHA512
74ae0f9d64cc81caae58bdfca27af8836a7e2ab2c1a0446723afd86e7c782aa014ebcda67e5e075507c2a0e48b73fadcfbf04e0b08d803c8f629e3063d97ec55
-
SSDEEP
12288:QXDCAZzP/w24lhpMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:PANw243SSkQ/7Gb8NLEbeZ
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_52122a7590cb30373b0806244c7b09ee_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_52122a7590cb30373b0806244c7b09ee_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB