Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19/02/2024, 21:43
General
-
Target
2024-02-19_ca71437ba556e19cba73a13e7529b224_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
ca71437ba556e19cba73a13e7529b224
-
SHA1
f83344336d17fbdd0add06a2fb6c14abf44576ed
-
SHA256
3ffaac80c60a93ba49af0b7f62e245512a8288d515a21d886cf16a3ed51234e3
-
SHA512
d64c5913d223bc647a2d0f109b4cf404b23e88974dfc580855007715e6c3d473186a3f1cb076fe7943adfedd036a01321c299514fc85a5ff04a618b6398df887
-
SSDEEP
24576:vANw24390s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+:vew2u0VY3vSi+ttr+Ekw7n2m
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_ca71437ba556e19cba73a13e7529b224_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_ca71437ba556e19cba73a13e7529b224_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB