Managed XDR

1084.lsass.exe.0x35000000.dmp (Ryuk) — malware analysis report

File info

Filename
1084.lsass.exe.0x35000000.dmp
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
168 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
f0ce084ac833219aca2062a75f713b04bc4971cb
SHA256
b56745146244bbc3119478e31011dd3a198332f240176a7746c0afec43f2baa6
MD5
b8d2b443f2f0f2ee096bb59400ca3b67

Malwares

  • Ryuk

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
ryuk: Detected Ryuk ransomware
process_crashed: One of the processes has failed
no_graphical_activity: No graphic activity
test_check_service: Starts services

Related reports