Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-09-2024 01:07
General
-
Target
2024-09-21_d0e0461bc0a130c622013f61e35aff6d_hijackloader_ryuk.exe
-
Size
838KB
-
MD5
d0e0461bc0a130c622013f61e35aff6d
-
SHA1
715c1c5f403d7d1a9831be878e1d2a3910bc4f3e
-
SHA256
d274787942d562893a74ebbfd28285e0c292ba50bed479038c90c0d2d21e368a
-
SHA512
98d5043162a4e6a6c6a61026c6e5367bf43ad8eba9078e4818697d3aaac4c523f73777ea7cf803a87e81794d13e89ca1a484409c0ab7d9057c4ece43fa13802f
-
SSDEEP
12288:hpTcb8nrtGiBhTrv4jAjCHD55gZGVB50K8Mnxu3omoa/5cdP:jTBXrv4jAaD55gZGVB50K8O4TS
Malware Config
Extracted
Protocol: ftp- Host:
134.122.155.46 - Port:
21 - Username:
lz165404 - Password:
lz165404.
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_d0e0461bc0a130c622013f61e35aff6d_hijackloader_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_d0e0461bc0a130c622013f61e35aff6d_hijackloader_ryuk.exe"1⤵
- UAC bypass
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
504KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB