ryuk | 6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

General

Target

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
Size

121KB
MD5

b003a727c9c2e8bec5c17f849c816726
SHA1

23aabb8ab9aa4dfaa55afd29fd09487254b49dff
SHA256

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623
SHA512

21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'dc75X5tp'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 3 IoCs

Processes:

vExrhdLWcrep.exeGqdXGpffxlan.exeLpFGOJQxGlan.exe

pid process

5088 vExrhdLWcrep.exe
1708 GqdXGpffxlan.exe
632 LpFGOJQxGlan.exe

pid	process
5088	vExrhdLWcrep.exe
1708	GqdXGpffxlan.exe
632	LpFGOJQxGlan.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

20468 icacls.exe
26840 icacls.exe

pid	process
20468	icacls.exe
26840	icacls.exe

Drops file in Program Files directory 64 IoCs

Processes:

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\RyukReadMe.html	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

pid	process
2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe

description	pid	process	target process
PID 2236 wrote to memory of 5088	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	vExrhdLWcrep.exe
PID 2236 wrote to memory of 5088	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	vExrhdLWcrep.exe
PID 2236 wrote to memory of 5088	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	vExrhdLWcrep.exe
PID 2236 wrote to memory of 1708	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	GqdXGpffxlan.exe
PID 2236 wrote to memory of 1708	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	GqdXGpffxlan.exe
PID 2236 wrote to memory of 1708	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	GqdXGpffxlan.exe
PID 2236 wrote to memory of 632	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	LpFGOJQxGlan.exe
PID 2236 wrote to memory of 632	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	LpFGOJQxGlan.exe
PID 2236 wrote to memory of 632	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	LpFGOJQxGlan.exe
PID 2236 wrote to memory of 20468	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 20468	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 20468	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 26840	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 26840	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 26840	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	icacls.exe
PID 2236 wrote to memory of 29456	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe
PID 2236 wrote to memory of 29456	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe
PID 2236 wrote to memory of 29456	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe
PID 2236 wrote to memory of 29548	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe
PID 2236 wrote to memory of 29548	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe
PID 2236 wrote to memory of 29548	2236	6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe
"C:\Users\Admin\AppData\Local\Temp\6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\vExrhdLWcrep.exe
"C:\Users\Admin\AppData\Local\Temp\vExrhdLWcrep.exe" 9 REP
2⤵
- Executes dropped EXE
PID:5088

C:\Users\Admin\AppData\Local\Temp\GqdXGpffxlan.exe
"C:\Users\Admin\AppData\Local\Temp\GqdXGpffxlan.exe" 8 LAN
2⤵
- Executes dropped EXE
PID:1708

C:\Users\Admin\AppData\Local\Temp\LpFGOJQxGlan.exe
"C:\Users\Admin\AppData\Local\Temp\LpFGOJQxGlan.exe" 8 LAN
2⤵
- Executes dropped EXE
PID:632

C:\Windows\SysWOW64\icacls.exe
icacls "C:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:20468

C:\Windows\SysWOW64\icacls.exe
icacls "D:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:26840

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
PID:29456

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:29548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GqdXGpffxlan.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\Users\Admin\AppData\Local\Temp\GqdXGpffxlan.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\Users\Admin\AppData\Local\Temp\LpFGOJQxGlan.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\Users\Admin\AppData\Local\Temp\LpFGOJQxGlan.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\Users\Admin\AppData\Local\Temp\vExrhdLWcrep.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\Users\Admin\AppData\Local\Temp\vExrhdLWcrep.exe
MD5
b003a727c9c2e8bec5c17f849c816726

SHA1
23aabb8ab9aa4dfaa55afd29fd09487254b49dff

SHA256
6a9de64813c2e3ad3940f2b5018245bed83bb0e24a6e47c8b0a4114be7aef623

SHA512
21b79ec4c8a1453bfb5c3fbea7d50b6c69be80dfe0413603ad7643c988821d9ecdd19c49608178958e78d41386e841104fcd58cb32e7ca9ffd203a51a2adc271

Download Submit
C:\users\Public\RyukReadMe.html
MD5
c91c73ed19a3fa56203d439ba324f144

SHA1
4af44df711aa03833df80cdd348c9e4d14c820f3

SHA256
974a52d27a63f6517dafeed5bccef1e04d74aadf1a721c29b690d9d3f3d3e984

SHA512
51d2ae82957d94fae1f7cf9b94075a61b33a93099f7bdb0d3d0abb3fa47c5c1087e3fe318d7e1fab7cd82ca7eb0f9db77ac4a0af9331f7218b48d844f10f9278

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads