Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03/02/2024, 09:31
General
-
Target
2024-02-03_898ba58fb09562a4d419fa69b5016645_ryuk.exe
-
Size
6.8MB
-
MD5
898ba58fb09562a4d419fa69b5016645
-
SHA1
9249a43a155bed6b4b772d1c6dfbaadc14853170
-
SHA256
9173a0c63bf00e0c4a4353e4ae948fa9b5761a47afb29b9fe153d42ef316500d
-
SHA512
54865aa98e06e425f59b78ed789c167a65de4c605847c010071af05a7776e51f5ad17d305b49f5de4e167349a40b2fb8db4227460b84ea63b417279ef6c88c9e
-
SSDEEP
98304:6RYXRHTTSxIGFdh/R2BPMWQE5PR7l6n+8tgeWD6oQFLOAkGkzdnEVomFHKnPc:KYXRH6yGvjn21+nzFLOyomFHKnPc
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_898ba58fb09562a4d419fa69b5016645_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_898ba58fb09562a4d419fa69b5016645_ryuk.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx