Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 21:36
General
-
Target
2025-03-06_fea251d1d58c745b974b7e263ff1d513_ryuk.exe
-
Size
1.5MB
-
MD5
fea251d1d58c745b974b7e263ff1d513
-
SHA1
7c9a1120eb69b1021557edd3172f085967d97738
-
SHA256
03367deec3ee109621f3a6330cbb094b9d32c2ad544a2d3d5f9d5ceec4191dcf
-
SHA512
5c94defcc21c6d02215e30c39237ac366e2da02785762739e7de6cc41652b8e4ab42fed7fe19d0342e41b5906d6a8c67426148b2860bdbed0362091f96537179
-
SSDEEP
49152:Hl+i4vOgbD4+k9m67I+BpclbwbWAaJiwmqTjcoOn1gR:ZoKIuxqPFMnc
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Azov family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_fea251d1d58c745b974b7e263ff1d513_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_fea251d1d58c745b974b7e263ff1d513_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB