Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/03/2025, 15:42
General
-
Target
2025-03-07_90dd218e234a1d44b18756f29dceb797_ryuk.exe
-
Size
1.4MB
-
MD5
90dd218e234a1d44b18756f29dceb797
-
SHA1
7ca047841caa625993184c35a9dd5e10337a7c32
-
SHA256
9fd7df50e12a6511e4f48bcd55f137da38c7092f842e2668755aecba18d64fd3
-
SHA512
2759edb918f0b05ee5ac086a7313dbc1b7bff1ef1b875567f29d69c2ceb6bedbf2b583139824cd5b69b6b7b7ce89abe5e970926e17cb3c9051029e3fbad34547
-
SSDEEP
24576:WXwwzE3xhVy+3aSQNwSg3e/uQESAfVevgw5Z0t15kEiaq:WXwwzchVnaSQyT3eGQpAfOgwf0tnktaq
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Azov family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-07_90dd218e234a1d44b18756f29dceb797_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-07_90dd218e234a1d44b18756f29dceb797_ryuk.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1120 -s 1922⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
20KB