Overview

overview

10

Static

static

a93ebb14d2...22.exe

windows7_x64

10

a93ebb14d2...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a93ebb14d2792370f7009b9accdc6901c90d4bdc5811c91002d19a6364825622

  • Size

    208KB

  • Sample

    220220-d3l2bsgcd8

  • MD5

    fb61f86d2ea604337ff2da9aaf4585c6

  • SHA1

    c5c63525bda35a317348adf7f2bd7eae9dee6de8

  • SHA256

    a93ebb14d2792370f7009b9accdc6901c90d4bdc5811c91002d19a6364825622

  • SHA512

    a8f03d7c63f974556b9c7a2ec12ddc14b7f6124f8ec74520afb0a00e124fc932f07050d1ae64d5be600d08bc5f518a7c458d5ae4813234c32e6ed6b3a982bc69

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] [email protected] balance of shadow universe Ryuk

Targets

    • Target

      a93ebb14d2792370f7009b9accdc6901c90d4bdc5811c91002d19a6364825622

    • Size

      208KB

    • MD5

      fb61f86d2ea604337ff2da9aaf4585c6

    • SHA1

      c5c63525bda35a317348adf7f2bd7eae9dee6de8

    • SHA256

      a93ebb14d2792370f7009b9accdc6901c90d4bdc5811c91002d19a6364825622

    • SHA512

      a8f03d7c63f974556b9c7a2ec12ddc14b7f6124f8ec74520afb0a00e124fc932f07050d1ae64d5be600d08bc5f518a7c458d5ae4813234c32e6ed6b3a982bc69

    Score
    10/10
    ryukransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks