Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-04-2024 12:19
General
-
Target
2024-04-21_8cd4c1801bc0fc123d7ee3d7d92d321d_ryuk.exe
-
Size
1.7MB
-
MD5
8cd4c1801bc0fc123d7ee3d7d92d321d
-
SHA1
f49a83531f7d089997eb417a16259ea4348aca4b
-
SHA256
5437ce490adf0457d1cc89169737421d34a4679a1714e99ed1f323bec2867a8a
-
SHA512
f7a92526fc9758d434081f7fd0dc6757c2058263265101bc5a8431e28badf399e2dd27a4823e4e45a18a177680efc9a38cf78455ea06000ddb13fe600d857f36
-
SSDEEP
24576:g4fE5tzcTDpuJn8NMHcyUQAobb0QvqUC1SkQ/7Gb8NLEbeZ:g4f65cTlG8NMHcn3obb0PwkQ/qoLEw
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_8cd4c1801bc0fc123d7ee3d7d92d321d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_8cd4c1801bc0fc123d7ee3d7d92d321d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2372 -s 2722⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD57c46ac845f89086d222168cf12dcddc0
SHA11b13d5c31700b83aea5215ebdd19944e94464aea
SHA2561517bcc1745a0f82a6115b7a1288e5185069002c89fe5a9e28527d89c7989389
SHA512c61bb726dc7b8d5cd08c0adb04ec023a62683b4c74412db10b836106a30c4e12d5149915162ef3c639ac70900f4e73d61543db2813fdc2556a433185fc26d017
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB