Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22/07/2024, 16:55
General
-
Target
2024-07-22_7a8f18f8f53b07ec371d9472e40e6125_cobalt-strike_ryuk.exe
-
Size
796KB
-
MD5
7a8f18f8f53b07ec371d9472e40e6125
-
SHA1
edae4b2a83a3bd61a38bfc4a6737b800876f375d
-
SHA256
46facf6874cbcb49df63b6022be4e7c79507249adcba79ea0db0e471da2cd9a6
-
SHA512
9d45e41077aa79821252bd7064c4f30f3dc1096d0cba2fcb1e9a44cde5b9674d6d5327c953343720646442476a9b717d2fc033e67bfcffe8045322fc51e977f3
-
SSDEEP
12288:VXDCAZzP/w24lhvINk7k14+gYZ5UaiAPqF0JZI4GPnmNbIQ/qDJSgCmP8i/:cANw243ik7SgdEPi7PnmNbJ/UUgCY
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_7a8f18f8f53b07ec371d9472e40e6125_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_7a8f18f8f53b07ec371d9472e40e6125_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB