General
-
Target
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642
-
Size
170KB
-
Sample
220220-jmym3saca7
-
MD5
552ad0a68c4a1fe2ff797269dd0a577c
-
SHA1
bd88287ed069606d736603432099a687dd556942
-
SHA256
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642
-
SHA512
7e064b91d5cb4fa0c66d5ab8d4df936580faa42fe9e477e51b8f341d7e37c0c0465de9700a6f8b0b22ea05c556a62d6c572f58fdead790be05fbdf97a92827c0
Static task
static1
Behavioral task
behavioral1
Sample
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Targets
-
-
Target
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642
-
Size
170KB
-
MD5
552ad0a68c4a1fe2ff797269dd0a577c
-
SHA1
bd88287ed069606d736603432099a687dd556942
-
SHA256
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642
-
SHA512
7e064b91d5cb4fa0c66d5ab8d4df936580faa42fe9e477e51b8f341d7e37c0c0465de9700a6f8b0b22ea05c556a62d6c572f58fdead790be05fbdf97a92827c0
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-