Resubmissions

20-10-2021 08:57

211020-kwsc4aggf9 10

20-10-2021 08:46

211020-kpcdashgcj 10

General

  • Target

    f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample

  • Size

    170KB

  • Sample

    211020-kpcdashgcj

  • MD5

    1bd7d1b87c5091a9653fe8005892b784

  • SHA1

    3dcf19b833266a3591fd97c93e5b9bca4ac2c21c

  • SHA256

    f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703

  • SHA512

    4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe
Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Targets

    • Target

      f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample

    • Size

      170KB

    • MD5

      1bd7d1b87c5091a9653fe8005892b784

    • SHA1

      3dcf19b833266a3591fd97c93e5b9bca4ac2c21c

    • SHA256

      f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703

    • SHA512

      4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies Installed Components in the registry

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks