Analysis
-
max time kernel
70s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 17:30
General
-
Target
2025-03-06_e664cc9bde017862a2c484b30cb7ea93_ryuk.exe
-
Size
1.5MB
-
MD5
e664cc9bde017862a2c484b30cb7ea93
-
SHA1
c5a1415e2860fa0aa106e6ddbdb3d7d7e62e2fc0
-
SHA256
6f55662b1ec78350e8dae5ea5377df36bd048b9a72d643ade4526b74da8537c9
-
SHA512
574d466b24c3db733353a43bbd3e95806b13c22c6bd86313f20470566bf06326593987bed9ed173bdea088d1b28a85d2f703ff0908d534478e6a490066297730
-
SSDEEP
49152:eVzpfQd4T9kIDGE63XVGpclbwbWAaJiwmcTdcoeG88:mfIXIxqPFE98
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Azov family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_e664cc9bde017862a2c484b30cb7ea93_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_e664cc9bde017862a2c484b30cb7ea93_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
20KB