Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 17:53
General
-
Target
2025-03-06_f978b331ab1a54d81bc979e500d8908d_ryuk.exe
-
Size
1.5MB
-
MD5
f978b331ab1a54d81bc979e500d8908d
-
SHA1
9e1544b51097cfc9945ba6f1b5b1fdc5b6479c3d
-
SHA256
ab9254d626437203ad5fc0a9e4782b61a768452b7873dacd3186cdc16294f7c0
-
SHA512
b4bc637cce04fa6b0c2bf8733fe1962e594e713cf6ea786c803c8f148f4db76394c4e0725a70425d3f7bd85a5b1366210530ccae722705fc04acfedc2791d033
-
SSDEEP
49152:xxGLjLeA9BetJxJn6PlH0pclbwbWAaJiwmqTjcoeSeoT:OqalUxqPFMLoT
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Azov family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-06_f978b331ab1a54d81bc979e500d8908d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-06_f978b331ab1a54d81bc979e500d8908d_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB