393f5ec9d8f560d0c6bc110f6d8c7414bd8e9acfcd29a2d5311b6788f8d35bbb

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 06:46

Target

2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe
Size

25.6MB
MD5

ac3f1e889bb90d88b30895e9dc600bb1
SHA1

d6ec11bc806bfbed683e8ee18f3cdefdbb18bc38
SHA256

393f5ec9d8f560d0c6bc110f6d8c7414bd8e9acfcd29a2d5311b6788f8d35bbb
SHA512

16689e887858bb2c5dbf0a993c53c95e413d07fd59d175a2e4adc1c335ac76fb208598f35b0bffd9123fbc963aeb3e70c31a2b7da0ff3a0868a72b42404368bb
SSDEEP

786432:vAZYyJ7T+ZNZR1dl6h3MlBitRVTrcACBX:vA6PNj1dl6h8lQtXrcACJ

Score

1^/10

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun = "67108863"	2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "255"	2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_ac3f1e889bb90d88b30895e9dc600bb1_ryuk.exe"
1⤵
- System policy modification
PID:3544

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact