Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe
-
Size
1.6MB
-
MD5
35a39b5dab654322931ab6920106903e
-
SHA1
d1486d4e9972a1e18322ae679c56e004ffd777ff
-
SHA256
bb1b0ea17894b330457b93afc86b936ebc5be9f51fae6b6f128591a627db120c
-
SHA512
c3523a8cbb9a8cf3233e05a13337686086f2c32c8aae88869060af0013cca0623b25cb5d29977afad62036275efd90da86361787c390d7ab25cfe6c7b473e60a
-
SSDEEP
24576:TNbqRetBjNKieTnCPXybrXMfq4K6ApZpiZxKK6oanWowemBJo56K:ZbvXKikCPC4q4K7pZ8xKDwe56
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 24 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe File opened (read-only) \??\F: 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 64 ip-api.com 89 ip-api.com 12 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\PowerCfg 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeSecurityPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe Token: SeBackupPrivilege 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3272 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 3272 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4668 wrote to memory of 2736 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 85 PID 4668 wrote to memory of 2736 4668 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 85 PID 2736 wrote to memory of 5088 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 90 PID 2736 wrote to memory of 5088 2736 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 90 PID 5088 wrote to memory of 2436 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 93 PID 5088 wrote to memory of 2436 5088 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 93 PID 2436 wrote to memory of 2820 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 94 PID 2436 wrote to memory of 2820 2436 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 94 PID 2820 wrote to memory of 4984 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 97 PID 2820 wrote to memory of 4984 2820 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 97 PID 4984 wrote to memory of 4236 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 98 PID 4984 wrote to memory of 4236 4984 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 98 PID 4236 wrote to memory of 4196 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 99 PID 4236 wrote to memory of 4196 4236 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 99 PID 4196 wrote to memory of 4124 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 100 PID 4196 wrote to memory of 4124 4196 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 100 PID 4124 wrote to memory of 2072 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 101 PID 4124 wrote to memory of 2072 4124 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 101 PID 2072 wrote to memory of 1092 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 102 PID 2072 wrote to memory of 1092 2072 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 102 PID 1092 wrote to memory of 4568 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 103 PID 1092 wrote to memory of 4568 1092 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 103 PID 4568 wrote to memory of 2748 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 104 PID 4568 wrote to memory of 2748 4568 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 104 PID 2748 wrote to memory of 5040 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 105 PID 2748 wrote to memory of 5040 2748 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 105 PID 5040 wrote to memory of 2248 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 106 PID 5040 wrote to memory of 2248 5040 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 106 PID 2248 wrote to memory of 3916 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 107 PID 2248 wrote to memory of 3916 2248 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 107 PID 3916 wrote to memory of 376 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 108 PID 3916 wrote to memory of 376 3916 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 108 PID 376 wrote to memory of 4580 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 109 PID 376 wrote to memory of 4580 376 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 109 PID 4580 wrote to memory of 4324 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 110 PID 4580 wrote to memory of 4324 4580 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 110 PID 4324 wrote to memory of 392 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 111 PID 4324 wrote to memory of 392 4324 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 111 PID 392 wrote to memory of 4400 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 112 PID 392 wrote to memory of 4400 392 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 112 PID 4400 wrote to memory of 3272 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 113 PID 4400 wrote to memory of 3272 4400 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 113 PID 3272 wrote to memory of 3728 3272 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 114 PID 3272 wrote to memory of 3728 3272 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 114 PID 3728 wrote to memory of 1556 3728 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 115 PID 3728 wrote to memory of 1556 3728 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 115 PID 1556 wrote to memory of 3008 1556 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 116 PID 1556 wrote to memory of 3008 1556 2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair2⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair3⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair4⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair5⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair6⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair7⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair8⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair9⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair10⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair11⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair12⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair13⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair14⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair15⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair16⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair17⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair18⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair19⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair20⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair21⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair22⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair23⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair24⤵
- Checks computer location settings
- Enumerates connected drives
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_35a39b5dab654322931ab6920106903e_cobalt-strike_ryuk.exe" restart norepair25⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51f6a7968a6a75efc7c688e5eccfc0ffc
SHA1b90ed9b0a5f4bd3c96ce2d45264d55da3ee63e27
SHA25697410da32b99127cc310411fd9f7575c44264e5ab0c9921ffb9f19cd3968fe1a
SHA5121b7a5e997c75b00657f7b846b0ad2349f79b369cb2d23b999b00dd039c0cb1f6d2c7ec86b24f5f6c564cbb718a5ccf777218d763b3c19b9d072e738bfc42c727
-
Filesize
1KB
MD56a175dcf75884eee1bd04ef8b2bff6a6
SHA127cc561d016063fa9b9697079e1be215c057678f
SHA25682ca28d0e3bf261826be8684f14a64878536d775a310ba73402ffa1239fe4688
SHA512ba58ef4375ec4427daabae4637644171bc43f46bf93b2c75ec6f27eb1b69a7607b718ad9294c39e696fcc60fce68e655bf75f096668a47deb25bfabf36474427
-
Filesize
1KB
MD51a1f92bf14049f2cb120d3743d9eddfa
SHA172a12c2c7288bce95c04a5f1c7a53e705d8997f9
SHA2564678e31970f52f4c760ec0c9ca85de21cb1a90b57f13ed3225daea1eee23776b
SHA5123b6ae35965ba534656bb56a8ac9ec6f413cf3b2565e18fc43193a4d6394fc0cd6d0a07274fbfc4d49abebc845b09ad380831cc4f1fc0109eda0ab0dec754a5a8
-
Filesize
1KB
MD510bc52ebaea6551026f624006bdc8980
SHA11bb17f33b027c442729f4c5ca5f73ef3be62bbc6
SHA256f01ce95ca326a42f476fe0c8ce7e43b8fdcdf3e2bdd863d001d395133d726f8e
SHA512fc38efb650143e91d3974f2d1d3c3f559740c581f0d3dd0e651a6ce935a9a4b6c7c4a98d46d3ce6ed5c6006a31a3e0e3dd40d675f4f84ff5428ec22cc3547c58
-
Filesize
1KB
MD5cd87c99614fad8563a2b9a90fe524713
SHA172f4dd140429e418d1a34fad0dfb74921968b840
SHA25622c6f815d14ef16c9bd955ab0eb33774af9194556935e10edb72214a41a5d86b
SHA512e64db1eeaf69c0fb3c13bf661954dbb348ebe965ff822a5b9944924fba144ca9171fc13460bde0ba6bbb8a1c342ea8a2da65a2bebc42a5fff32cd38d2852d108
-
Filesize
1KB
MD51bef9d68fe7cc09e6bcf8a0f33b49314
SHA18b8aef4f6930f8484a2ccbe6b1e65e6dc07c4f25
SHA25606745fb372529b1aa8ff499255cb583204a6f7cfa1ff9d6239fa6afe9dcfbdcd
SHA5120c303e61894841cfb6195ff59e5aa8ddbdb64f91e88ce965a38f33cc31a50e921553bab1750638b44d6e0893ed40184a1fd546935c2e46628b8f577a0fd52f20
-
Filesize
1KB
MD5969863a47648e45d3064c09bc7fc3569
SHA11040cad7437012ff7a455d8ce56a76f57d5c65bb
SHA256dd8e2535b198665d726ff26582ff2b94abfa822749809ac78561050d91efd052
SHA512fd62e7d010464b3b7848164e0ba7ba21fdf464159f3e11ac5986c7872aa5fb5b54d4f65aaf6fa8447143fe6683ddba2ca649ee4eb6e2ac15f9333d47a8762235
-
Filesize
1KB
MD5daac83dcbd440c6ad50f53d9c0449335
SHA1f50db33b31d8b4b79f108e9279113d03234468f3
SHA256c117aba9d0e86f9e7d6856ec034f13255115ae3950925e392b1354eedb4f7026
SHA512b3f0da7b1feabc09142583058101b17677a5e64dacd840f5be4a328d349797322c9fbcb0c1d2eeb6f0b5c13f47910b2d746f46637e06c5fc1b5278b06810377e
-
Filesize
1KB
MD51072af5ec3e6650170beb140e7f8198a
SHA1ea44bb6bf9511f72b4d4f828bce3ac99ee64a1db
SHA2566c059588cb48f087096b6971be30df5f61b476bc9df37f6011a52af403e5a067
SHA512fabf24f49677d21304a8fa244329d650eebbf0442520691c38a84c301877f0820f34adf114f9f6eb9297c195fcb1b78983fe15e696341ae3b842c19d8dd35906
-
Filesize
1KB
MD5ac63f9ed32acd4c860cd10d0ba272ead
SHA172a1eb3302e5d6dfd07a9164aa04f62fb19a6a8d
SHA256398ae1516cf97a2debd462a082b97bdb029f9de9276f440d9a55133793d5716c
SHA5124069c1c0438420159df8a891136b910a76cd57433f47c04d34dc3910195b5aab24dbd8de3e6ba181a49b6c107096cda46a618ac6864c420c3d37cf718f760b25
-
Filesize
1KB
MD56e9d2e7b79f3f54600065443495567b2
SHA1070d9282154be106149c1bbe16077a6a74970bfa
SHA2569f0acc66423e7d1c6524cf4a46b87bc3b05fe190677986af59d00df8d5fb529e
SHA512b726412d48560022aa515d23fcfef3a6cd3acf6bc43ed7833da8365c1d565541c39e3d019d6b2efc80ad48dafb170a8d08bc8fb9f8234da4a77a3378903a7272
-
Filesize
1KB
MD56a8d5f5208fdc1d7ae3e902f1214aa61
SHA1b8e5a99da38642f0148567bd52c7f305c22f8220
SHA2565af30648c20e4a086daa3de6dc9651215760de3c7211b12a59cbc550460f2f13
SHA512569bbf2266de51b68b78f25f8130782e36a9e642b3a0ed7d7a4576b9b30dad3cb183317f8e5966bcda5506211e124c1e77d5868ab9595c179d75b89e2e04f5ea
-
Filesize
128B
MD5f0891ecaf11c581af23b66b792a04572
SHA17d87c505ee620af0bbfd91c4c7ac2e69cfdb74d0
SHA256e08d920430e243c941f7a38960b772ffb1bdd49443cee292789ac2b4de4f835a
SHA512c487cf485160ead488ad3939b0c9dbae3de582f5c987ade9febb6db3a8595ba5a75c884f4e94198427724b9d068559135124a26ea52a52b23a239a1c369527fa
-
Filesize
128B
MD5adc82d2e470a24c55de1b146084c9051
SHA1f2161ba2168e6709d70f13d8631e55392035220a
SHA256bf764d8b55eba8a1954a80d69aa5aab4be46748576168baf661a4da2370d6944
SHA512dc6bc705c9c03ef79e6f0db43b9dc6eeacb6cf6eca58ce705d2756bb55eed2bceb6810ad80153a0ccc3343088d69fde3700602e81fa5eabd1affde1004b4bb9b