Overview

overview

7

Static

static

3

2024-04-17...uk.exe

windows7-x64

7

2024-04-17...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 14:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe

  • Size

    6.6MB

  • MD5

    690421984e7876f89af2d11b911d195b

  • SHA1

    65f1ad87f06f1b95696fe15c183a4030ce362ec8

  • SHA256

    af577ca05d50aebaab5f0d70dd217bb17941f51e7836ae195e0084af21158fb4

  • SHA512

    050660466dae2eb56ba1ca1434ef6e4f559ad189026de7906eab8891a1e675825b200c021a0c908b1619f2f4ad1ebffe502d19f119cc52163af133e383864df0

  • SSDEEP

    196608:YSAFuDe9xY+JA6nuj8xE2U+X2iZKhORcd8SEW1D25hMqe:auq9xY+JA6n/zyh37s5ne

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 21 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-04-17_690421984e7876f89af2d11b911d195b_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:2940

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\VCRUNTIME140.dll
          Filesize

          83KB

          MD5

          0c583614eb8ffb4c8c2d9e9880220f1d

          SHA1

          0b7fca03a971a0d3b0776698b51f62bca5043e4d

          SHA256

          6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

          SHA512

          79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\_ctypes.pyd
          Filesize

          124KB

          MD5

          1ec6d919a90fe611fcad86555b20bdbc

          SHA1

          783365a6563026eaf8312f1ba2479c74d19b285e

          SHA256

          059e6d79776d5081ec6342e62d63725b07f0388787c5d7b250481729f63341f8

          SHA512

          cf91e0a5aa4e714a1667dfbed81d0931606c64a1e7885bdf9adde96d2540700834a64352a4d2b4d571072e0b47044af92669149560161f446bda86425448b6da

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-core-file-l2-1-0.dll
          Filesize

          18KB

          MD5

          bfffa7117fd9b1622c66d949bac3f1d7

          SHA1

          402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

          SHA256

          1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

          SHA512

          b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-core-processthreads-l1-1-1.dll
          Filesize

          18KB

          MD5

          d699333637db92d319661286df7cc39e

          SHA1

          0bffb9ed366853e7019452644d26e8e8f236241b

          SHA256

          fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

          SHA512

          6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-core-timezone-l1-1-0.dll
          Filesize

          18KB

          MD5

          f62b66f451f2daa8410ad62d453fa0a2

          SHA1

          4bf13db65943e708690d6256d7ddd421cc1cc72b

          SHA256

          48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

          SHA512

          d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-conio-l1-1-0.dll
          Filesize

          19KB

          MD5

          6c88d0006cf852f2d8462dfa4e9ca8d1

          SHA1

          49002b58cb0df2ee8d868dec335133cf225657df

          SHA256

          d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663

          SHA512

          d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-environment-l1-1-0.dll
          Filesize

          18KB

          MD5

          c712515d052a385991d30b9c6afc767f

          SHA1

          9a4818897251cacb7fe1c6fe1be3e854985186ad

          SHA256

          f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

          SHA512

          b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-heap-l1-1-0.dll
          Filesize

          19KB

          MD5

          f9e20dd3b07766307fccf463ab26e3ca

          SHA1

          60b4cf246c5f414fc1cd12f506c41a1043d473ee

          SHA256

          af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

          SHA512

          13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-locale-l1-1-0.dll
          Filesize

          18KB

          MD5

          ab206f2943977256ca3a59e5961e3a4f

          SHA1

          9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

          SHA256

          b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

          SHA512

          baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-math-l1-1-0.dll
          Filesize

          27KB

          MD5

          4dd7a61590d07500704e7e775255cb00

          SHA1

          8b35ec4676bd96c2c4508dc5f98ca471b22deed7

          SHA256

          a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499

          SHA512

          1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-runtime-l1-1-0.dll
          Filesize

          22KB

          MD5

          8b9b0d1c8b0e9d4b576d42c66980977a

          SHA1

          a19acefa3f95d1b565650fdbc40ef98c793358e9

          SHA256

          371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503

          SHA512

          4b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\base_library.zip
          Filesize

          764KB

          MD5

          cb7d57935e7eabffcb7d94bbaeaa27cc

          SHA1

          e22478d7c1907ddd723c7f1db6bbaef236debce9

          SHA256

          f4257d927a242c15e88791b82231b6796b4133e070bea15d079a74dd9123c426

          SHA512

          601d23a5af46ce2b58fbedaa82688f801411bfff04a5756bc411a2e324463fd470d4d7b40447aa9031e0128c1baf90b303c12bac8bebecb6268095a7e16e0c72

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\file_arranger.exe.manifest
          Filesize

          1KB

          MD5

          7858c9ea1b0cac02b59baadb00a5f59f

          SHA1

          0f115347831a0c24846a64fe51811b4fd473b2fc

          SHA256

          0e1a52e30609e02276469241bc386e8b5ab285c144d4601780de61459a974ed6

          SHA512

          1f6880744df359ed5c43eb75b34654f8f285e746b13b9e2bb984ece65d50d0dabf0764c5a3778088bf739a906eace4595db023472ff93f5bcc399278de74f9ad

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\python37.dll
          Filesize

          3.6MB

          MD5

          0b321720d7fb6769ec046f2060ba1747

          SHA1

          3d2a45c42f3ebedb9d7175385ee48b7c808fe3a5

          SHA256

          e57fe2c5a107df01fcffe1f3753e0e670c9f1623a77cab5a2b1d3c8dac1c8cee

          SHA512

          736afe1bbbe9d62b6f3117748c8d712c84ba887de44f2ecd25d22938ce7765160b50eaa6183ea54767f0cff4b28d2e3ca9653d737d0cddf5efdc07296c22be8e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI21282\ucrtbase.dll
          Filesize

          992KB

          MD5

          0e0bac3d1dcc1833eae4e3e4cf83c4ef

          SHA1

          4189f4459c54e69c6d3155a82524bda7549a75a6

          SHA256

          8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

          SHA512

          a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-core-file-l1-2-0.dll
          Filesize

          18KB

          MD5

          49c3ffd47257dbcb67a6be9ee112ba7f

          SHA1

          04669214375b25e2dc8a3635484e6eeb206bc4eb

          SHA256

          322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

          SHA512

          bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-core-localization-l1-2-0.dll
          Filesize

          20KB

          MD5

          588bd2a8e0152e0918742c1a69038f1d

          SHA1

          9874398548891f6a08fc06437996f84eb7495783

          SHA256

          a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

          SHA512

          32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-convert-l1-1-0.dll
          Filesize

          22KB

          MD5

          d53637eab49fe1fe1bd45d12f8e69c1f

          SHA1

          c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

          SHA256

          83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

          SHA512

          94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-filesystem-l1-1-0.dll
          Filesize

          20KB

          MD5

          f0d507de92851a8c0404ac78c383c5cd

          SHA1

          78fa03c89ea12ff93fa499c38673039cc2d55d40

          SHA256

          610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

          SHA512

          a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-process-l1-1-0.dll
          Filesize

          19KB

          MD5

          595d79870970565be93db076afbe73b5

          SHA1

          ec96f7beeaec14d3b6c437b97b4a18a365534b9b

          SHA256

          fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558

          SHA512

          152849840a584737858fc5e15f0d7802786e823a13ec5a9fc30ee032c7681deaf11c93a8cffead82dc5f73f0cd6f517f1e83b56d61d0e770cbb20e1cfff22840

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-stdio-l1-1-0.dll
          Filesize

          24KB

          MD5

          76e0a89c91a28cf7657779d998e679e5

          SHA1

          982b5da1c1f5b9d74af6243885bcba605d54df8c

          SHA256

          0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577

          SHA512

          d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-string-l1-1-0.dll
          Filesize

          24KB

          MD5

          96da689947c6e215a009b9c1eca5aec2

          SHA1

          7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60

          SHA256

          885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82

          SHA512

          8e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_MEI21282\api-ms-win-crt-time-l1-1-0.dll
          Filesize

          20KB

          MD5

          6b33b34888ccecca636971fbea5e3de0

          SHA1

          ee815a158baacb357d9e074c0755b6f6c286b625

          SHA256

          00ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9

          SHA512

          f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165

          Download Submit