Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-03-2024 11:48
General
-
Target
2024-03-29_e9aa923fd8d58ea0ac43242104c3710e_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
e9aa923fd8d58ea0ac43242104c3710e
-
SHA1
dc93a94968e246a4fdedf34d9ae2b65a7f112993
-
SHA256
400d262ffb593695699d4dddf62670d4915c5c913f08d44b3ef5318dc10d0dda
-
SHA512
611894579ac09056e5e68db475ffbb91723dc0de48bc10f9e4406df71a84529852be16a6c2e0a9892b4e7e0ccb920d3a8b184e472012317267001f9c970e0230
-
SSDEEP
12288:GXDCAZzP/w24lh23Dbif4YAJ93y1NrLiLtJ8nBxu7DCOzRq8DvQgqAbhI:RANw2432Hofe3y1sInB2COzRq8DvFqt
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_e9aa923fd8d58ea0ac43242104c3710e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_e9aa923fd8d58ea0ac43242104c3710e_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB