4f453879499b71724261fbd75e889f5be69c59194909a4e2a22fb8126d1a4550

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 07:33

Target

2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe
Size

1.1MB
MD5

6749f7328e7755bef929dae3222fb4fa
SHA1

0ac4c6f605b56e897706dcaabfae4b39d322e733
SHA256

4f453879499b71724261fbd75e889f5be69c59194909a4e2a22fb8126d1a4550
SHA512

765f948df5ce8cc745aef33550c75c8d71e264e78fb63b343079302e767fd86255098facf6ecacee17de5dbca9bc6c5cdbc9c9f7ef3ba950d0a29dff4bd5821b
SSDEEP

24576:7Cps3IDhXzhHsCdsSsqjnhMgeiCl7G0nehbGZpbD:7D36hXt/sWDmg27RnWGj

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
468	Process not Found
2576	alg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6298eac3ae4ef42b.bin	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2740	2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2484	2740	2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe	28
PID 2740 wrote to memory of 2484	2740	2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe	28
PID 2740 wrote to memory of 2484	2740	2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_6749f7328e7755bef929dae3222fb4fa_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 312
  2⤵
  PID:2484

\Windows\System32\alg.exe

Filesize
1.6MB

MD5
1ad85157fb2f94ce57153bb820b2604e

SHA1
cf71a69a1fb4b46bf1863b42b8d62e0f926ab736

SHA256
5686a3d4c3116c0ee5f22360719b07b3bb2e026d672fe0c29d9ab8af67c819f9

SHA512
838bbf654749671c140187cabdbdacc1b78317d9523dc37079da1a9b718e697718a604c665610ff36d94104881543bd783266c818b688626221205e6217ef121

Download Submit
memory/2576-15-0x0000000100000000-0x0000000100191000-memory.dmp

Filesize
1.6MB

Download
memory/2576-14-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download
memory/2576-22-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download
memory/2576-21-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download
memory/2576-26-0x0000000100000000-0x0000000100191000-memory.dmp

Filesize
1.6MB

Download
memory/2740-1-0x00000000002D0000-0x0000000000330000-memory.dmp

Filesize
384KB

Download
memory/2740-0-0x0000000140000000-0x000000014012D000-memory.dmp

Filesize
1.2MB

Download
memory/2740-8-0x00000000002D0000-0x0000000000330000-memory.dmp

Filesize
384KB

Download
memory/2740-25-0x0000000140000000-0x000000014012D000-memory.dmp

Filesize
1.2MB

Download