27beb88665c3041bd16c9d9701097f21523c96442bf95b5b544d4edb19b62a0f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe
Size

3.3MB
MD5

9bcd9915db9beba642193024fd55ad7f
SHA1

08292de28fbf9e54e6a3f876293832e1eb206985
SHA256

27beb88665c3041bd16c9d9701097f21523c96442bf95b5b544d4edb19b62a0f
SHA512

3c556f24f3477d0540385563a384b21d3826128cc1b008573224110d025a4c7dfed9527555d4179bef50997787e0741eb3813ca3bf469e5fa1740e2b20c696d5
SSDEEP

49152:fX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qe:flRsZ47/QXoHUOfAoj1x6e

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2816	wmic.exe
Token: SeSecurityPrivilege	2816	wmic.exe
Token: SeTakeOwnershipPrivilege	2816	wmic.exe
Token: SeLoadDriverPrivilege	2816	wmic.exe
Token: SeSystemProfilePrivilege	2816	wmic.exe
Token: SeSystemtimePrivilege	2816	wmic.exe
Token: SeProfSingleProcessPrivilege	2816	wmic.exe
Token: SeIncBasePriorityPrivilege	2816	wmic.exe
Token: SeCreatePagefilePrivilege	2816	wmic.exe
Token: SeBackupPrivilege	2816	wmic.exe
Token: SeRestorePrivilege	2816	wmic.exe
Token: SeShutdownPrivilege	2816	wmic.exe
Token: SeDebugPrivilege	2816	wmic.exe
Token: SeSystemEnvironmentPrivilege	2816	wmic.exe
Token: SeRemoteShutdownPrivilege	2816	wmic.exe
Token: SeUndockPrivilege	2816	wmic.exe
Token: SeManageVolumePrivilege	2816	wmic.exe
Token: 33	2816	wmic.exe
Token: 34	2816	wmic.exe
Token: 35	2816	wmic.exe
Token: SeIncreaseQuotaPrivilege	2816	wmic.exe
Token: SeSecurityPrivilege	2816	wmic.exe
Token: SeTakeOwnershipPrivilege	2816	wmic.exe
Token: SeLoadDriverPrivilege	2816	wmic.exe
Token: SeSystemProfilePrivilege	2816	wmic.exe
Token: SeSystemtimePrivilege	2816	wmic.exe
Token: SeProfSingleProcessPrivilege	2816	wmic.exe
Token: SeIncBasePriorityPrivilege	2816	wmic.exe
Token: SeCreatePagefilePrivilege	2816	wmic.exe
Token: SeBackupPrivilege	2816	wmic.exe
Token: SeRestorePrivilege	2816	wmic.exe
Token: SeShutdownPrivilege	2816	wmic.exe
Token: SeDebugPrivilege	2816	wmic.exe
Token: SeSystemEnvironmentPrivilege	2816	wmic.exe
Token: SeRemoteShutdownPrivilege	2816	wmic.exe
Token: SeUndockPrivilege	2816	wmic.exe
Token: SeManageVolumePrivilege	2816	wmic.exe
Token: 33	2816	wmic.exe
Token: 34	2816	wmic.exe
Token: 35	2816	wmic.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe

description	pid	process	target process
PID 2952 wrote to memory of 2816	2952	2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe	wmic.exe
PID 2952 wrote to memory of 2816	2952	2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe	wmic.exe
PID 2952 wrote to memory of 2816	2952	2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-31_9bcd9915db9beba642193024fd55ad7f_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads