Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
14/02/2024, 13:53
General
-
Target
2024-02-14_4d99784aa40a6534d547d59ee27c2a17_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
4d99784aa40a6534d547d59ee27c2a17
-
SHA1
fee94e7bea64a0768aa369062c129ad1c5594b4b
-
SHA256
e82729c43fc322484f20402c292e4ba43a825f25d1b715d03939af3188c9b497
-
SHA512
8c33b09414a1b0842ecd13fa0579d4bfcb09dd61e034caa6f543ac8c0f086cfe4e94e9342ba9bc1ddd1a8c34828c2706b089ed4bb117c6ec449d6038e6075576
-
SSDEEP
24576:4ANw243c+L6VMRCPU6CENltmVVdpx7fLrQWd:4ew2e6ZU6CENlc7dpJLrQWd
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_4d99784aa40a6534d547d59ee27c2a17_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_4d99784aa40a6534d547d59ee27c2a17_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB