Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_323eee01958f9737b7ccd08d02a9a966_ryuk.exe
  • Size 8.0MB
  • Sample240607-beg2cseh2y
  • SHA256 c270bf980e982161fcb4d0db502d084a89f9cd69809fcf6592dd0860f3b86f50
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_323eee01958f9737b7ccd08d02a9a966_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_323eee01958f9737b7ccd08d02a9a966_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_323eee01958f9737b7ccd08d02a9a966_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_323eee01958f9737b7ccd08d02a9a966_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3288
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3388

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\VCRUNTIME140.dll
          • Size 85KB
          • SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\_ctypes.pyd
          • Size 129KB
          • SHA256 430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\base_library.zip
          • Size 769KB
          • SHA256 91bebb3483364436af73953b5b8a866bf0710777c0d344b32df8eea8297ef2b0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\python3.dll
          • Size 57KB
          • SHA256 d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python37.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\python37.dll
          • Size 3.6MB
          • SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pywintypes37.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\pywintypes37.dll
          • Size 137KB
          • SHA256 78cb44eca64107d65001f7bf5de2036f442b842fc964a5c1da6639fd2e03d281
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24282\win32api.pyd
          • Size 131KB
          • SHA256 5c81cbb9cd298cd3fbcacbd246beffa36b3ba3d96ccdbbbf7be47407871c3698
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download