25cf0a91ff323a7c7e196cc81979e21ca96aa0caa7444706a4809ac92fabf66c

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 00:06

Target

2024-04-15_71c4eeed252df4c93ca528272912a406_ryuk.exe
Size

1.0MB
MD5

71c4eeed252df4c93ca528272912a406
SHA1

1f0de212a9ce497c045fe34c339bbbad8df08a38
SHA256

25cf0a91ff323a7c7e196cc81979e21ca96aa0caa7444706a4809ac92fabf66c
SHA512

2b1100e6fd7810d26f6d7587c3b2c6189edbc7f4d27f6b23218fe219bc3958bffd15f421ac89bc134acc92ba62b9f0f8114a7c8aa2a7b6cf6c23585eb387e545
SSDEEP

24576:k49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:k494Q2Ogu7JYGWlpQI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	2024-04-15_71c4eeed252df4c93ca528272912a406_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-15_71c4eeed252df4c93ca528272912a406_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_71c4eeed252df4c93ca528272912a406_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3552 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4672