Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10/04/2024, 01:09
General
-
Target
2024-04-10_17905f379e12ac0514139b9593a9c1ae_ryuk.exe
-
Size
1.0MB
-
MD5
17905f379e12ac0514139b9593a9c1ae
-
SHA1
d3b483fab12cb929d85a186f76a3237a4f34714e
-
SHA256
c49e5de9e5569ca4766c0dad76d1a2916a3f76e0a19bbf3ca64885d2a2941c10
-
SHA512
f224f61ce50ef029c98b6e1d76b01f889404da40b4424b00ec33ddfda689560666719fe52804d4982ba5dc4f371f5d082eea352f6d7b6a9f276bb5e5140d8ee9
-
SSDEEP
12288:0X/7g9a/Ig+KxilJVGfHPMmWqapxVaqsLkHbbpxIVPPXk1pShoGDQinZv:0U9OREtG/PJzKxVaHL4xIVPXmpC1Mmv
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_17905f379e12ac0514139b9593a9c1ae_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_17905f379e12ac0514139b9593a9c1ae_ryuk.exe"1⤵
- Suspicious use of AdjustPrivilegeToken