General
-
Target
Image-8646-ZP.jpg.lnk
-
Size
1KB
-
Sample
220321-tgsjzshdbn
-
MD5
e163fbce2507c89a106c8ad001dc099a
-
SHA1
afd8e902f55dbefcfa4afa30c95ce49b2daef6aa
-
SHA256
61e88158da4636ab0c11db75e376f42e11a02ebe0387223934fb10944b52794f
-
SHA512
a6dc129fd6cfc820461b29c3b9c35539f7bd45e67a383c1cb8c9a437509046edac793dd6b134a379b3be1768dc3daba0ea5d914be5624a4c10a4402d32d99b82
Static task
static1
Behavioral task
behavioral1
Sample
Image-8646-ZP.jpg.lnk
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
Image-8646-ZP.jpg.lnk
Resource
win10v2004-en-20220113
Malware Config
Extracted
https://inapharma.in/css/files/photos/Bn-Offrs-Album/Image-8646-ZP
Extracted
C:\ProgramData\Duolingo\duoApp.txt
ryuk
Targets
-
-
Target
Image-8646-ZP.jpg.lnk
-
Size
1KB
-
MD5
e163fbce2507c89a106c8ad001dc099a
-
SHA1
afd8e902f55dbefcfa4afa30c95ce49b2daef6aa
-
SHA256
61e88158da4636ab0c11db75e376f42e11a02ebe0387223934fb10944b52794f
-
SHA512
a6dc129fd6cfc820461b29c3b9c35539f7bd45e67a383c1cb8c9a437509046edac793dd6b134a379b3be1768dc3daba0ea5d914be5624a4c10a4402d32d99b82
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-