Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe
Resource
win10v2004-20240419-en
0 signatures
150 seconds
General
-
Target
2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe
-
Size
2.3MB
-
MD5
22f0f2acff9db05ee63cdd5eb12b49e2
-
SHA1
5ea074d00e678fdcd6080fd8b1dcb4403717890c
-
SHA256
d734c88d72c86cae0e30301ee32bff27d1fa4fc392a559fff2ac09465ca443eb
-
SHA512
dd28ca143567a14d3734c2c4ef51c03be85b2c2f876d0c161e12439b31c66c039899489324d7eb4dbd08937d74dd90b63b64ae4447a01eed7c3a1aa7723f0f41
-
SSDEEP
49152:rosQHMmpQAaR824OnqDPqFmhlyjsrrJLp2lUEFP4+Po6kk:f4O2P5JLQlVt4ib
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exedescription pid process Token: SeDebugPrivilege 2408 2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exedescription pid process target process PID 2408 wrote to memory of 2360 2408 2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe WerFault.exe PID 2408 wrote to memory of 2360 2408 2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe WerFault.exe PID 2408 wrote to memory of 2360 2408 2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_22f0f2acff9db05ee63cdd5eb12b49e2_ryuk.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2408 -s 3642⤵