Analysis

  • max time kernel
    93s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 20:24

General

  • Target

    2024-10-11_7cf1afe3ed0ad07f6131022484335cc0_ryuk_sliver.exe

  • Size

    3.3MB

  • MD5

    7cf1afe3ed0ad07f6131022484335cc0

  • SHA1

    68c152c547f034c0d884e8bdc1fca847f5fcae81

  • SHA256

    116ef1d1e1573a23c279a194f59fedb5a9b13e7ff908fcbe0bb51409e0c38c39

  • SHA512

    2a1ccc05da68db43965d6749423baa4b1dcc875b8264d3479c50418110da5b8f2247008199d9eb3ac8a1050274e915ca40bf58da2c19264e92f98ee637eae338

  • SSDEEP

    49152:3X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QHr0:3lRsZ47/QXoHUOfAoj1x6I

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-11_7cf1afe3ed0ad07f6131022484335cc0_ryuk_sliver.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-11_7cf1afe3ed0ad07f6131022484335cc0_ryuk_sliver.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads