Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 16:49
General
-
Target
2024-01-25_99300b525218b2a5bf5b16fe257f8a6b_ryuk.exe
-
Size
3.4MB
-
MD5
99300b525218b2a5bf5b16fe257f8a6b
-
SHA1
3d0919de8c2af3b43a492689f3ceaa427ba019ec
-
SHA256
263c74e6c34ca7b21f486d001650a5483eb0a595b475c6f995c9453db43bc6fc
-
SHA512
38889cc0511c80de5d16b912e7cc60a414fe61acf6bb7e17b5d5b5ce21f5fb20c22c8c91cbb0c82d6ac4b500e941ecc6e3584ad9b8d422e36ad53850e9224374
-
SSDEEP
49152:lQ+UuuLhdDM3xt+5YqcYsdJE1fyMt4cltQsx2eoqo5rN1ggWrJSdj5ik+pFzz+/a:lQv5o7FeW5rN1UEjX+pFtFR
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_99300b525218b2a5bf5b16fe257f8a6b_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_99300b525218b2a5bf5b16fe257f8a6b_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2312-0-0x0000000000320000-0x0000000000380000-memory.dmpFilesize
384KB
-
memory/2312-1-0x0000000140000000-0x0000000140378000-memory.dmpFilesize
3.5MB
-
memory/2312-8-0x0000000000320000-0x0000000000380000-memory.dmpFilesize
384KB
-
memory/2312-12-0x0000000000320000-0x0000000000380000-memory.dmpFilesize
384KB
-
memory/2312-14-0x0000000140000000-0x0000000140378000-memory.dmpFilesize
3.5MB