a2a871b4ddfca39d3cac00d6489c6e71a4c6b905aa93178e0cea1aeb54447306

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 02:24

Target

2024-04-25_56b790ebd192f81fb0eb95891cf4709b_ryuk.exe
Size

1.0MB
MD5

56b790ebd192f81fb0eb95891cf4709b
SHA1

3f57b68c28b11b258c71c589b9f316cb7c7f6438
SHA256

a2a871b4ddfca39d3cac00d6489c6e71a4c6b905aa93178e0cea1aeb54447306
SHA512

fb0c8f88e8b5cc009a0d871fad5f6e92e0948290e5da6355f0b5c1592b01acd0dd1593b8f0e68ddbf8edc4e240ad601882e9fa0bf01c72924573449264d530ff
SSDEEP

24576:E49ofzs1dTWhVk+zBu7JY8wWyiklHNsSQI:E494Q2Ogu7JYGWlpQI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	2024-04-25_56b790ebd192f81fb0eb95891cf4709b_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-25_56b790ebd192f81fb0eb95891cf4709b_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_56b790ebd192f81fb0eb95891cf4709b_ryuk.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664