Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
10-06-2024 11:43
General
-
Target
2024-06-10_2d8ab675fef0cc8be67791756a1e9585_cobalt-strike_ryuk.exe
-
Size
298KB
-
MD5
2d8ab675fef0cc8be67791756a1e9585
-
SHA1
ee898cc2396d2036ff2070476861734e1105bbff
-
SHA256
7ec09a0caa48381c3ff4655364782d926bd0663da9e303043d189aa08c819ebe
-
SHA512
e5740ee68a26ccbfc54f3bedac5cb314f48798b2ff7d727769981dee60b7d657dbb248b6a4f7867614348466fd9aa4c912de6abfb91b4f565e4ede735a30ff08
-
SSDEEP
6144:yO3uwis9fqGKMxY+DjH9QsOgcVJ7olgtlhn659Ao3W:5+wis9fXfG+3Sj24lhn6Hm
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_2d8ab675fef0cc8be67791756a1e9585_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_2d8ab675fef0cc8be67791756a1e9585_cobalt-strike_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
28KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
260KB
-
Filesize
20KB