Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/02/2024, 09:29
General
-
Target
2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe
-
Size
2.1MB
-
MD5
1c4e86043b2c80c4ed7641c607215a36
-
SHA1
22f114dffd165624dadf61901f5b39d476b92561
-
SHA256
183eafdf781034205c75b2d5d734722ee7bdcc31593a3e069f6b72b333ae83be
-
SHA512
74a48010a9d3dd432eeabcd3c9e107f505a20bd49f0d5825c785ef2fed49c71781b3413e7f7e8223f9f8ced5251a71be55fe30fe85ed5f0562368ea73ea77d34
-
SSDEEP
49152:mXWtcDco9YXPtSjeJgEjTmucQgDUYmvFur31yAipQCtXxc0H:mSAYXPwtEjEJU7dG1yfpVBlH
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_1c4e86043b2c80c4ed7641c607215a36_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1644 -s 3322⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD52ee0ec22660929c5fd2bcc7f24242726
SHA1444305378a8750e66aac1238430153121dc6aac8
SHA256c2e0440feef0f8296adc3aaa4cc976c5abc2ae30de137c241884d4f5c934e4f5
SHA5124de87c7c13bf12e45c2e4b1c9020730ba55f791bc7ccb25f5e2d7adce8d6957cead74ddd4b52fd161923f7fd14a14cff8f491a0992b465e3de008742f9a9c941
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB