Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
04/04/2024, 11:23
General
- Target 2024-04-04_75e8c420054235c4a9a0eb6437912fa0_ryuk.exe
- Size 1.8MB
- Sample240404-ng4dlaeb28
- SHA256 431794852fa9907fdb6f60b1cf4743ac8f89c3a8581ff7ad6e75b13185280a57
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_75e8c420054235c4a9a0eb6437912fa0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_75e8c420054235c4a9a0eb6437912fa0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2088 -s 3362⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2088-0-0x0000000001C20000-0x0000000001C80000-memory.dmp
memory/2088-2-0x0000000140000000-0x00000001401DF000-memory.dmp
memory/2088-8-0x0000000001C20000-0x0000000001C80000-memory.dmp
memory/2088-11-0x0000000140000000-0x00000001401DF000-memory.dmp