Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-01-2024 23:48
General
-
Target
2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
f88efafa2a031ef0fc39e8a0c3635a2e
-
SHA1
8e1fa51deecc0f9465d65715e286420d3ce88401
-
SHA256
5622250df6633625db61a3fd6c28fb0af0905a52293ed3ada98c7e556dacb21a
-
SHA512
cf84f0457973aefb803b44e55b78b8def818912c2cd3c528da41be8e31750f4d3175ff741f38bf74c91c8493f835d88bdea4a207db0a87e27a6d0f5813dd4879
-
SSDEEP
24576:LANw243oVqIi2lObXobHAEW9INFJY0au:Lew2Bw7x03jY0a
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_f88efafa2a031ef0fc39e8a0c3635a2e_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB