Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-02-2025 07:41
General
-
Target
2025-02-18_e1ac03fec670094e9413e15967608627_ryuk.exe
-
Size
1.6MB
-
MD5
e1ac03fec670094e9413e15967608627
-
SHA1
758e8a8beced6d8b2d77c01379590ab710e4b544
-
SHA256
f7ef9996df3719dd75f73fc4e71acba81830f4c68fa2af727f3298126630559a
-
SHA512
6f9a31a5d9cc7d6e17c1bf35aebd7f4feb4ea34c44b53739500e747400e46a2a96ac9dec5e24adcdce31f59a76f66025ede9b0e1d51da18527e6367e723ccd35
-
SSDEEP
12288:dxR8vCv+ERJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:PRVTnrKhxr+EHNmT8oW4ll1JCrLKXI
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-18_e1ac03fec670094e9413e15967608627_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-18_e1ac03fec670094e9413e15967608627_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 1482⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.7MB