aa8f8a3e268493157e62d93ab9cafb94573606fe43a80e63e3e4f2e5c9b22a5b

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 01:04

Target

2024-12-08_765bdc0f8bc0d77f7414e7a36ae45fd9_cobalt-strike_ryuk.exe
Size

1.6MB
MD5

765bdc0f8bc0d77f7414e7a36ae45fd9
SHA1

c303968d61bfeb154a110549217d40bbdaa7439c
SHA256

aa8f8a3e268493157e62d93ab9cafb94573606fe43a80e63e3e4f2e5c9b22a5b
SHA512

5bb1267c5f4b7dc67d7da75af08ce616d5f518ea5469443ded642c2c7410256b370d1b01c355191ae9df8cb3e56ce31910ff153761787aad054148b12add5718
SSDEEP

49152:rKha/+cyVQ15lPzJkSnQOYnwOiYlBA7KVO3QTmdQQ:rPJNoBUKkemdJ

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	2024-12-08_765bdc0f8bc0d77f7414e7a36ae45fd9_cobalt-strike_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-08_765bdc0f8bc0d77f7414e7a36ae45fd9_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-08_765bdc0f8bc0d77f7414e7a36ae45fd9_cobalt-strike_ryuk.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1964