Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
21-04-2024 11:03
General
-
Target
2024-04-21_36c38f539c1c6a730ca4f57a89fb9263_ryuk.exe
-
Size
1.8MB
-
MD5
36c38f539c1c6a730ca4f57a89fb9263
-
SHA1
6612ed380911cdd2f88e1c0d00b63c388352c513
-
SHA256
1a842bb17cfa107129ab512f57bfcae04184e0c45eca854851e6c90f78ca1c96
-
SHA512
230fbdabcdb20c35f560c71bbe3024dff0e31a970ea2ea251372b794908c30a305acd5b9ceabc34c3b54145500deb97b55c54dafb22482eaf4f10b4718210f5a
-
SSDEEP
49152:TKfuPS3ELNjV7IZxEfOfOgwf0R/snji6attJM:Am9sZxwghEnW6at
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_36c38f539c1c6a730ca4f57a89fb9263_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_36c38f539c1c6a730ca4f57a89fb9263_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2348 -s 3402⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5f98f48726f96bc1b0a8c4afe8e399e65
SHA1cb7354fc81b6f30ca36a4d9e7bd04401f1bdbfc2
SHA256c94c74fc54e9575d6183bf14be09b0d2e026842162bee03f64da0372936e9be6
SHA512f3a90c28349a1ad12122742ac46af0b128bf21d35b618dda882fe48376faf41ba90935ff596102772769231a7952150430e9b7c5671771e989867e8c20ad2704
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB