Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_0cc0471da3c39bb3ce9b22adee7f7c81_ryuk.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-12_0cc0471da3c39bb3ce9b22adee7f7c81_ryuk.exe
-
Size
2.1MB
-
MD5
0cc0471da3c39bb3ce9b22adee7f7c81
-
SHA1
4cf63c19d633497dd61ec2da60358cc5ab6d5146
-
SHA256
f6249ffd9551658595b1fc180e471f903d4a208bd145f63b6d005cdb75b9b3df
-
SHA512
2db894a85951965fad7c624023c2968a5fc9a4a5c94ab7246a36c14732f824910509fbeae2a1dd16ec1653779109cf703a39d710e2ec2ac2fcbf5e63c6019d12
-
SSDEEP
49152:BikKqNuKuNnEBV/wtjUNqE76CHHwbSijeuOCtcPyPGGQ2KlF40Q:BieknEBVnfbLuOBqe/2Kl9
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-12_0cc0471da3c39bb3ce9b22adee7f7c81_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4872 2024-06-12_0cc0471da3c39bb3ce9b22adee7f7c81_ryuk.exe