a2423618a7931317c8ac0b360773c14e1c5465ee67c6fd2d563ae4fc0ce023b9

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 02:54

Target
2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe
Size 5.8MB
Sample240608-deacmagg87
SHA256 a2423618a7931317c8ac0b360773c14e1c5465ee67c6fd2d563ae4fc0ce023b9
MD5 5aae55cb202d5df6514e850cd64112bb
SHA1 6b6d2b499076a6dfd4dbd7747b7f9e88d7a4cb9e
SHA512 7a9f8c78e01364835955bfff909d4b7eae9f6acf89a6da63784434974cdb1279b8b2c91472a8974ee2ebe556eaa5fde55a8b7e153091059f3fb90e21c07b5a70
SSDEEP 98304:jOjmPhc0qRXeRt7DHQktlw2KceThIPuFJt7zD9PMW8e9tvg05ITDGVbyXfu54vdw:jLhdQOz7D3tlKXFIuB/9PvN2DG1yPu67
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
4556	2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe
4556	2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4556	2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4556	4868	2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe	91
PID 4868 wrote to memory of 4556	4868	2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-06-08_5aae55cb202d5df6514e850cd64112bb_ryuk.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:3720

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\VCRUNTIME140.dll
Size 87KB
SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
MD5 0e675d4a7a5b7ccd69013386793f68eb
SHA1 6e5821ddd8fea6681bda4448816f39984a33596b
SHA512 cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
SSDEEP 1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
MD5 SHA1 SHA512 SSDEEP

Submit Download

av.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\av.exe.manifest
Size 1KB
SHA256 d38f42629f7b06c4303ed2a7aeb6a77e63d3c4d08bd81178ba27a86d805dd4dd
MD5 58b53f4f180ea34ffd8805f71d02bb79
SHA1 3f221793893615ee3815a9e91a884b7bb27699ab
SHA512 f12351842e66eaf19fc5725590e70c6edf6d4c25f8a18f047ba6962a789c6b05bceeb54f82ae2221c97ff30c1b554394ebb0543c21c5e1763776041f24d5288b
MD5 SHA1 SHA512

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\base_library.zip
Size 730KB
SHA256 e78ab0f095578dd91fc578223b43ef1a4a10eec3af528c011c5d2517a9cdd626
MD5 9ffbaac36b501f097951ccad080e94d6
SHA1 a3d540e3ad1401144d8fd4e1377ac96617698bb8
SHA512 2c2c17017a1d9408a54f1c320fe023e82271607226519ccf9e2ba9c7f4d9517e514e9bebb7d3e56f005fb0cf412a0dc1cec906fa125b163c98ab8dfdc44ea316
SSDEEP 6144:YovW+A8xsBFL/yGfQEr4nyNi0OzDxi6zYaUlvSSBkjeiEAmuObuut/aCQKMKFKeh:YSGfQErAOpaKMKUGVwyZIMr5ndKm
MD5 SHA1 SHA512 SSDEEP

Submit Download

python37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\python37.dll
Size 3.7MB
SHA256 b93a5855201c48bcb3e203e2bd7e56c31a2529a73d5caaaf1068e978bb367d36
MD5 ed93d68a53e571066bf38d1be0627426
SHA1 6d9851191eef09fbaf8410fa9700ed36df94aa9c
SHA512 aa4c915d1ba20ed9821d97277f46da3776c365bb6e2b766d8ad415630aa43761490b7301057d7a15f2d970590e23bfc2fdc84f9b0dd8c997826c6a34700f28d9
SSDEEP 49152:F5OXOP4aJBxifzO/XmVur901e93CfCBt+yI7iOHIkvFHNGMPnEPPqTLzg1FKMPHr:Fx7rmS+7ok9HgMPkF1bH
MD5 SHA1 SHA512 SSDEEP

Submit Download