137d45708273f8dc4e94d1b1e310d56f51a5378526939de55516acadc6bbc3fa

Analysis

max time kernel
90s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe
Size

3.3MB
MD5

78251f0badb3523e297ad139de5aa5a1
SHA1

b4ed453b00c2bbc1913eb29d3857403bc7a2bfe1
SHA256

137d45708273f8dc4e94d1b1e310d56f51a5378526939de55516acadc6bbc3fa
SHA512

ca1d6ada9ebf02560aef061d19daf26bff317eaf303cbcbeb5ec97513642105cdabee03718d3ad56c6421b8c39b777eb72b23181e3750efc0107a932b296e904
SSDEEP

49152:1X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qj:1lRsZ47/QXoHUOfAoj1x6j

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1624	wmic.exe
Token: SeSecurityPrivilege	1624	wmic.exe
Token: SeTakeOwnershipPrivilege	1624	wmic.exe
Token: SeLoadDriverPrivilege	1624	wmic.exe
Token: SeSystemProfilePrivilege	1624	wmic.exe
Token: SeSystemtimePrivilege	1624	wmic.exe
Token: SeProfSingleProcessPrivilege	1624	wmic.exe
Token: SeIncBasePriorityPrivilege	1624	wmic.exe
Token: SeCreatePagefilePrivilege	1624	wmic.exe
Token: SeBackupPrivilege	1624	wmic.exe
Token: SeRestorePrivilege	1624	wmic.exe
Token: SeShutdownPrivilege	1624	wmic.exe
Token: SeDebugPrivilege	1624	wmic.exe
Token: SeSystemEnvironmentPrivilege	1624	wmic.exe
Token: SeRemoteShutdownPrivilege	1624	wmic.exe
Token: SeUndockPrivilege	1624	wmic.exe
Token: SeManageVolumePrivilege	1624	wmic.exe
Token: 33	1624	wmic.exe
Token: 34	1624	wmic.exe
Token: 35	1624	wmic.exe
Token: 36	1624	wmic.exe
Token: SeIncreaseQuotaPrivilege	1624	wmic.exe
Token: SeSecurityPrivilege	1624	wmic.exe
Token: SeTakeOwnershipPrivilege	1624	wmic.exe
Token: SeLoadDriverPrivilege	1624	wmic.exe
Token: SeSystemProfilePrivilege	1624	wmic.exe
Token: SeSystemtimePrivilege	1624	wmic.exe
Token: SeProfSingleProcessPrivilege	1624	wmic.exe
Token: SeIncBasePriorityPrivilege	1624	wmic.exe
Token: SeCreatePagefilePrivilege	1624	wmic.exe
Token: SeBackupPrivilege	1624	wmic.exe
Token: SeRestorePrivilege	1624	wmic.exe
Token: SeShutdownPrivilege	1624	wmic.exe
Token: SeDebugPrivilege	1624	wmic.exe
Token: SeSystemEnvironmentPrivilege	1624	wmic.exe
Token: SeRemoteShutdownPrivilege	1624	wmic.exe
Token: SeUndockPrivilege	1624	wmic.exe
Token: SeManageVolumePrivilege	1624	wmic.exe
Token: 33	1624	wmic.exe
Token: 34	1624	wmic.exe
Token: 35	1624	wmic.exe
Token: 36	1624	wmic.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe

description	pid	process	target process
PID 1524 wrote to memory of 1624	1524	2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe	wmic.exe
PID 1524 wrote to memory of 1624	1524	2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-22_78251f0badb3523e297ad139de5aa5a1_hijackloader_ismagent_ryuk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1624

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads