Analysis
-
max time kernel
115s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 17:28
General
-
Target
2025-03-06_c32074c697181bb10785afb2251e3d97_ryuk.exe
-
Size
691KB
-
MD5
c32074c697181bb10785afb2251e3d97
-
SHA1
1e35ab0f31510f19d84369f132ec417941f1d2a9
-
SHA256
b80cf979042c47ac0faaefcdf4e92142aff6aaaf0286b67a9e0835138a3e7707
-
SHA512
140667faba182b2207ac416b221aedd5f793e320a0f2ae9d0fd33586fa60bef270c602985fee0671ebbae5e9caaf45d2726cfd0d377e973c6c6d24bf4ca96a36
-
SSDEEP
6144:aNrRsZd9uXuSZSs9egMz4Od/LLrnm3TP1U4sx09xJTtP7/F30EFKp/FgmX:aNrRfZSs9ezz/PwTP1Utq9MEUp/ymX
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Azov family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_c32074c697181bb10785afb2251e3d97_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_c32074c697181bb10785afb2251e3d97_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD578ede93114e65f9160fd03d3357c56e6
SHA188d531b101e57655f1d0d26c6b3257aa2468d460
SHA256c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d
-
Filesize
28KB
-
Filesize
656KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
16KB