6436322b1f51a8ce7ed0403e0e85fedfe847c3964cf2cc254893bbbf0b030aa3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe
Size

1.0MB
MD5

f7f40566010fb5764b55677f5c0092be
SHA1

e66eb5e8c40ed0ddee90f92a4d298b797e00d5a2
SHA256

6436322b1f51a8ce7ed0403e0e85fedfe847c3964cf2cc254893bbbf0b030aa3
SHA512

97a674a211820c933026b2d6e6fde3ff5ae6f802071bd9ac54de5ca5ed6bc0058a4c5eadec63504ef5be6a2bfe120d01da44529d679f8b092c13d8d8699ccb48
SSDEEP

24576:7oHL7iXdBlqZR/Fo90aUVbhTehXvGIWruYRenIVcX+83dJ:7or7k5qZR/PaUVbhTYWfoIbEX

Score

5^/10

evasion trojan

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Macromed\Temp\{AC82DEE4-914F-4CD2-BF24-A02CDB13A065}\fpb.tmp	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe
2724	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-29_f7f40566010fb5764b55677f5c0092be_hijackloader_ryuk.exe"
1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\Macromed\Temp\{AC82DEE4-914F-4CD2-BF24-A02CDB13A065}\fpb.tmp

Filesize
685KB

MD5
67889e9b503278d29afb98f37223e10a

SHA1
2c00ee00e18992728158bf98a0fb370b276ad912

SHA256
ea195e395cb4fa9b22d60adcbfedf0509e3ed4911c88e9dcd4e3af4d5142ee3e

SHA512
ac948131a3032cf519f02227becc94102a6551458dcd4f510103573ffe926714fde9f5e7a7e18c5a6697822143cee641d895d6c0540ed848ffa1b47646901de7

Download Submit