ryuk | 827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa

General

Target

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
Size

189KB
MD5

22d2811ba73d9f43086700fe22991c81
SHA1

6a7efe4137e953c74de48f3c32019c5a70c644dd
SHA256

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa
SHA512

fed438621fec75371a46b28011ca8f36cc17ed12a6b6f9e077bb8f460f8bda5419dad2e6f64fc464d7e3ffcfe0a7e2b9e64e5e01778130d6bbbe1d71510e30e5

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

MrqgTNI.exe

pid process

3088 MrqgTNI.exe

pid	process
3088	MrqgTNI.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exeMrqgTNI.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	MrqgTNI.exe

Drops file in Windows directory 2 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 45 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.186170"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899853242928501"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exeMrqgTNI.exe

pid	process
3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
3088	MrqgTNI.exe
3088	MrqgTNI.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exeMrqgTNI.exeTiWorker.exe

description	pid	process
Token: SeBackupPrivilege	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
Token: SeBackupPrivilege	3088	MrqgTNI.exe
Token: SeSecurityPrivilege	3684	TiWorker.exe
Token: SeRestorePrivilege	3684	TiWorker.exe
Token: SeBackupPrivilege	3684	TiWorker.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exenet.exenet.exenet.exenet.exeMrqgTNI.exenet.exenet.exe

description	pid	process	target process
PID 3872 wrote to memory of 3088	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	MrqgTNI.exe
PID 3872 wrote to memory of 3088	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	MrqgTNI.exe
PID 3872 wrote to memory of 3088	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	MrqgTNI.exe
PID 3872 wrote to memory of 4084	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 4084	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 4084	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 3568	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 3568	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 3568	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3568 wrote to memory of 692	3568	net.exe	net1.exe
PID 3568 wrote to memory of 692	3568	net.exe	net1.exe
PID 3568 wrote to memory of 692	3568	net.exe	net1.exe
PID 4084 wrote to memory of 3452	4084	net.exe	net1.exe
PID 4084 wrote to memory of 3452	4084	net.exe	net1.exe
PID 4084 wrote to memory of 3452	4084	net.exe	net1.exe
PID 3872 wrote to memory of 3760	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 3760	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 3760	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3760 wrote to memory of 2224	3760	net.exe	net1.exe
PID 3760 wrote to memory of 2224	3760	net.exe	net1.exe
PID 3760 wrote to memory of 2224	3760	net.exe	net1.exe
PID 3872 wrote to memory of 1532	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 1532	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 3872 wrote to memory of 1532	3872	827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe	net.exe
PID 1532 wrote to memory of 3596	1532	net.exe	net1.exe
PID 1532 wrote to memory of 3596	1532	net.exe	net1.exe
PID 1532 wrote to memory of 3596	1532	net.exe	net1.exe
PID 3088 wrote to memory of 4148	3088	MrqgTNI.exe	net.exe
PID 3088 wrote to memory of 4148	3088	MrqgTNI.exe	net.exe
PID 3088 wrote to memory of 4148	3088	MrqgTNI.exe	net.exe
PID 3088 wrote to memory of 4204	3088	MrqgTNI.exe	net.exe
PID 3088 wrote to memory of 4204	3088	MrqgTNI.exe	net.exe
PID 3088 wrote to memory of 4204	3088	MrqgTNI.exe	net.exe
PID 4148 wrote to memory of 4248	4148	net.exe	net1.exe
PID 4148 wrote to memory of 4248	4148	net.exe	net1.exe
PID 4148 wrote to memory of 4248	4148	net.exe	net1.exe
PID 4204 wrote to memory of 4276	4204	net.exe	net1.exe
PID 4204 wrote to memory of 4276	4204	net.exe	net1.exe
PID 4204 wrote to memory of 4276	4204	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe
"C:\Users\Admin\AppData\Local\Temp\827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872

C:\Users\Admin\AppData\Local\Temp\MrqgTNI.exe
"C:\Users\Admin\AppData\Local\Temp\MrqgTNI.exe" 8 LAN
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
4⤵
PID:4248

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:4276

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:3452

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:692

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2224

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:3596

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1892

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\MrqgTNI.exe

MD5
22d2811ba73d9f43086700fe22991c81

SHA1
6a7efe4137e953c74de48f3c32019c5a70c644dd

SHA256
827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa

SHA512
fed438621fec75371a46b28011ca8f36cc17ed12a6b6f9e077bb8f460f8bda5419dad2e6f64fc464d7e3ffcfe0a7e2b9e64e5e01778130d6bbbe1d71510e30e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MrqgTNI.exe

MD5
22d2811ba73d9f43086700fe22991c81

SHA1
6a7efe4137e953c74de48f3c32019c5a70c644dd

SHA256
827b7e7ec7ca366fc31f3899a98339dfb4333073f197a5aa6755c8c09505bdfa

SHA512
fed438621fec75371a46b28011ca8f36cc17ed12a6b6f9e077bb8f460f8bda5419dad2e6f64fc464d7e3ffcfe0a7e2b9e64e5e01778130d6bbbe1d71510e30e5

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads