Managed XDR

7600.clkdlcjdtlan.e.0x35000000.dmp (Ryuk) — malware analysis report

File info

Filename
7600.clkdlcjdtlan.e.0x35000000.dmp
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
168 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
4b09eb537b96a167c1fdcd3c5dfc75649428adc5
SHA256
6522b8177ff5935c56a596aa6aaf9a72f85158b2f89349cd51e730334fe433cf
MD5
77220f252abb1458cfa4e3e8fcb96d07

Malwares

  • Ryuk

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
ryuk: Detected Ryuk ransomware
process_crashed: One of the processes has failed
no_graphical_activity: No graphic activity
test_check_service: Starts services

Related reports