Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-22_67dffedd4bac85b7c053fb926011c15f_ryuk.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-22_67dffedd4bac85b7c053fb926011c15f_ryuk.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-22_67dffedd4bac85b7c053fb926011c15f_ryuk.exe
-
Size
2.1MB
-
MD5
67dffedd4bac85b7c053fb926011c15f
-
SHA1
28d9ab1adab6cc3f36e752cfe269673bbe4f5b53
-
SHA256
3224f7d275a61d736ba520afc29e6a69ae03bb6ba59d8b3cccb5d1f879570246
-
SHA512
02e92fbf3118cb14567e78283513a1df982d31f0d9a8a04d55bbc2fbfa6810824066170ef9c33d8b4a14451ee0a502b0a43a273782aa482e7e7be5c59e4bb6fa
-
SSDEEP
49152:ojFX33t4INlfTqkUMLu/52bulcI1wXZTBz59MomUj2:o7fTqmeX1Pbv
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-04-22_67dffedd4bac85b7c053fb926011c15f_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1160 2024-04-22_67dffedd4bac85b7c053fb926011c15f_ryuk.exe