8039ac9fbf34fd2bf0548d5c7039b7bc8f456a4adad7e8b2ab08c5846429378a

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 01:04

Target

2024-04-18_02fd3717de191262fbfcd190f44a3401_ryuk.exe
Size

1.0MB
MD5

02fd3717de191262fbfcd190f44a3401
SHA1

61f3ec7cf6343c7104b90a3a34e5b8021c0712c8
SHA256

8039ac9fbf34fd2bf0548d5c7039b7bc8f456a4adad7e8b2ab08c5846429378a
SHA512

ddaae801a53118bf70a9e82662d368ec2ae931830a170c0e0027c111ea36a2752205c408788bfb35671eadbab8397aad7da93c8e5772ff3beb5f5d3625d63cba
SSDEEP

24576:j49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:j494Q2Ogu7JYGWlpQI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	2024-04-18_02fd3717de191262fbfcd190f44a3401_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-18_02fd3717de191262fbfcd190f44a3401_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_02fd3717de191262fbfcd190f44a3401_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600