Analysis
-
max time kernel
92s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 21:45
General
-
Target
2024-04-10_d089019d2a13d1c09168c07abc31d67d_ryuk.exe
-
Size
2.8MB
-
MD5
d089019d2a13d1c09168c07abc31d67d
-
SHA1
da42e7e5fee7e0937e17723a4b6f80130d82e9f4
-
SHA256
e24aa999faa034001c195741f3db77d40ac40552de8705f849a63bc9319ac963
-
SHA512
39273047b64a806dedc7e297a867a2dc008e25516250b1aa7597c010e37079fd80e67f77e2d03931b7d25353772dcf5e4d9f27e4b27304c6349d16f0c0ecd1fe
-
SSDEEP
49152:suxMNXEkkvcL86O+ZWK98Z2F43QjvSGOcMq6jfsLO:p03pZbF4rcMq6sC
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_d089019d2a13d1c09168c07abc31d67d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_d089019d2a13d1c09168c07abc31d67d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
-
Filesize
2.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.9MB