b21ff1bac6c34d8f4d3fcbfe387a540f467b22b80b5e7cee4592db32ff3a8191

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:45

Target
2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe
Size 5.3MB
Sample240607-a38csaef3y
SHA256 b21ff1bac6c34d8f4d3fcbfe387a540f467b22b80b5e7cee4592db32ff3a8191
MD5 0358956d89b008681fc0140ced5ef5c7
SHA1 04dd00d6b4be8097be674cd35df07ce223a0ad20
SHA512 4bb36bfe85e5cf6abd55de10eaa7a4a490e739e4a9e100f0b8a70c9543d6a8060d7b664636d0c3e949575fac05ff4a6f55bbde22a0b2af3c4305bb61b0ad5424
SSDEEP 98304:PJhqE6OVQWJuhswoYv5eONVJSVlnsfGm2ceemmZqAZ8a+t1Twe2505IIbsONq4AC:POE/uWJysVYvsOdknseOeehZqAqa+3TM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4608	2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe
4608	2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4608	2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4608	4556	2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe	83
PID 4556 wrote to memory of 4608	4556	2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-07_0358956d89b008681fc0140ced5ef5c7_ryuk.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4608

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\VCRUNTIME140.dll
Size 87KB
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
SSDEEP 1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\base_library.zip
Size 762KB
SHA256 8145ddd0e6b6e0c579f7c7b2de986bbf9ed5c78e79a00485b153c359e5822337
MD5 6e063980ef2a67b9fe08dd62c41ff158
SHA1 c0aedbf70331e675dac2516d9a3d67be1ed3620e
SHA512 83a80f73f988b6305ae3fc9d0a25fa2383a8102e2ff9b8ce19cfbb6540135e875d2fb69f3ab31905afd8c396ac3daf563932b11bf871cb8f4100bf2d7726def9
SSDEEP 12288:iyMr5BpLgjJCU4IuMVwyZVfQEfen6MubXn8:ZMr5DeVwyZVfQEffXn8
MD5 SHA1 SHA512 SSDEEP

Submit Download

python37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45562\python37.dll
Size 3.6MB
SHA256 08686f0e6e3c54d455d4a4801d5deccadedbafd1e010b3d18ade81180853db27
MD5 f8f12175880677bd010def8ba14208da
SHA1 889e23b96d78135dc3294c84ab900b91fa9f7a0c
SHA512 7792f4a2005c2721b3fa848e2703bfb380670d6bd108599c5a98299f09197b44fb44adbb59da9c55bf064bb3c083a07fd82acdf29b7a09da07981c964eb11304
SSDEEP 49152:y7FeabU3vr19nnykftvv/kqKSjIa4XO41BbXbGttsDJIedHHtJMmnWPMITfT3cAt:yTK99C/bcFetH7MmBkcBWN
MD5 SHA1 SHA512 SSDEEP

Submit Download