f0a496598349d4dcde775f46565bf60722f748034472412854ecbd38ff3fc1ab

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 11:33

Target

2024-04-18_e2d899d72b609428ef8d32775357b249_ryuk.exe
Size

1.0MB
MD5

e2d899d72b609428ef8d32775357b249
SHA1

347e443f65d0e17eeb5bd2586233722e1a801052
SHA256

f0a496598349d4dcde775f46565bf60722f748034472412854ecbd38ff3fc1ab
SHA512

913e64ef46c0c3ac9f7688a7eacac3f730443c3b3e7d02f775595a3ca0c84ba84dc91c209b6c14e006e050bfa495e7c233983c8f087037dc93e1a402b00af103
SSDEEP

24576:J49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:J494Q2Ogu7JYGWlpQI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	2024-04-18_e2d899d72b609428ef8d32775357b249_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-18_e2d899d72b609428ef8d32775357b249_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_e2d899d72b609428ef8d32775357b249_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140