Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
-
submitted
21/02/2024, 01:25
General
-
Target
2024-02-21_e034d9a460980a05020f51f75c2942cb_ryuk.exe
-
Size
1.8MB
-
MD5
e034d9a460980a05020f51f75c2942cb
-
SHA1
c98b516eee1ecd058519ca8cd264fbaa49cf3b5a
-
SHA256
f8bbf4661ad49200f609027a80cc25150021acc8d9e066f1fb0771a49b9e4432
-
SHA512
904198e24c9d7919353ba03d28a5211b51f74b3bd89a9199453ce8705438633d543bc5c9451a35977ff274f8391a2751192e9201b1881c4b15beba782207bccd
-
SSDEEP
49152:xKX0DzOswXGfymHQlIuQaZPBmtc9m1Dd:7XNOGfjqIuBBmtc9mp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_e034d9a460980a05020f51f75c2942cb_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_e034d9a460980a05020f51f75c2942cb_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a836c7564a89322cf3adc831d435c7b1
SHA1be0c38c2affeb2acf525f448c58b5d08afd4b348
SHA2566f9769ed3d18528a8099b17eaf3d860d7d00f7be9e6d1903a4739b56e2f5649f
SHA512e9a0532e54134225dd483213a7e9f67d5add332ef8d705e9c73e93c9f4f90b63d9923222ff9b062707a5150add2187ac17ba5f54fd11cab54d5bd8020df5d51a
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
1.2MB