0816d66320d221de576c8a9e6af1b05c7656832939876dd99bb8b40029fe694a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 06:00

Target

2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe
Size

666KB
MD5

754b79913fde2de487e9fc2826b65d57
SHA1

c8299aadf886da55cb47e5cbafe8c5a482b47fc8
SHA256

0816d66320d221de576c8a9e6af1b05c7656832939876dd99bb8b40029fe694a
SHA512

4a2420e2e89757cab2376932ce548f9b31b845f8c99dfd1cdd9a3b53dabed9e3cb11ecf514edeaccd932f277f65397c126ecaf42831f016554d2001034a25a1d
SSDEEP

12288:b9x+Tm3J3SrhP6pRKBdxZXi0gjFBFq4wTdbU0Cp4RWeAK+1coRm:b9nJ3SrhC+BdxZXi0gjFLq4wTZU0Cp4N

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
384	2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe:$TASK	2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe:$FILE	2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe: data	2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_754b79913fde2de487e9fc2826b65d57_ryuk_trickbot.exe"
1⤵
- NTFS ADS
PID:1060

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact