Overview

overview

10

Static

static

683c3cdeda...db.exe

windows7_x64

10

683c3cdeda...db.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

  • Size

    190KB

  • Sample

    220306-d9h81shhf6

  • MD5

    65865d94596a90b7e6204deb1de53c3d

  • SHA1

    282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

  • SHA256

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

  • SHA512

    3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] balance of shadow universe Ryuk

Targets

    • Target

      683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

    • Size

      190KB

    • MD5

      65865d94596a90b7e6204deb1de53c3d

    • SHA1

      282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

    • SHA256

      683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

    • SHA512

      3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

    Score
    10/10
    ryukransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks