Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22/07/2024, 14:44
General
-
Target
2024-07-22_35643fe0547d80f483d1aeb4914ca5a2_ryuk.exe
-
Size
1.0MB
-
MD5
35643fe0547d80f483d1aeb4914ca5a2
-
SHA1
2543c888bf57eb67d21b8ee0e03b6a58769b1161
-
SHA256
fa8cfc0f2316bf93c3fef71ee337898e87d0253bbae6eec4adc6294d6237e8b5
-
SHA512
f65d9c28b20d8c46d6303f1d815267135f509f9f7a44cf6ab8e0dbeb187394cfda4843e8cbab144a6b323ff2fd8702829b5bd65ac16faeeab474517aeec94df4
-
SSDEEP
24576:o6V6VC/AyqGizWCaFbyMk7SgdEPi7PnmNbJ/UUgCY:o6cbGizWCaFbu2geuPnm7/Uf
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_35643fe0547d80f483d1aeb4914ca5a2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_35643fe0547d80f483d1aeb4914ca5a2_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5668b87aaa99fbe2bbeac6bee71653dc4
SHA14f0a7339499009fe3209051c0312f0f3a4611bfc
SHA2567a9b3c552a5f3aada82d1d5ccdbb5b3bd75cceda0182683b5062d67eb5388e0d
SHA5125381bd17c07b03e45378f259a3c3bbbd183eb4867716de645740e3533361f7decc39c57937947fcfbcb46f77faeb3eba8f1f9eaadb33a90bf03ae8fb2c8f313e
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
680KB