Overview

overview

10

Static

static

8

bbe7f26bcc...10.exe

windows7_x64

3

bbe7f26bcc...10.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    02-04-2022 18:44

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe

  • Size

    24KB

  • MD5

    0d9cdf4a04cbd4ad7d58d777f5cdd5cf

  • SHA1

    3e4909844bfe19cd4a239052e3f4a043c915d269

  • SHA256

    bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510

  • SHA512

    905cff6972682d02afad4c7decc680004f82ac1bdbef686a03414055dace8eaaf4a1c080af7afd8dffe61412046bdbf3e76cf77132a9afef5dfd47f6787e0e41

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8E73FL5R\f[1].txt

Family

ryuk

Ransom Note
{"sodar_query_id":"7iVJYpTKA6CR9fgPo6icwAk","injector_basename":"sodar2","bg_hash_basename":"qK1_kiClR8859HLR2ZQEsar5twHbosMJ2VQOYA2yeqI","bg_binary":"BQWlSWReMJjt7UvgRlrkyWTOOYbkJJi1JNI649bDuI0AOCczd95WQyh+rZkBwRoaCKxJaH6EcuVbaTBzk+/EQfjiZzOiFzDqzAdVeQx6lv8M0Ku1WSrb81TJaIOWwPtxLQMI9KhjK7Nzbibv5xRnJUJPy1EbnvbQoBn2jPxaHeoMifFLDwoKZa1Z3khd8jqBI7AieTvzHNJv1KBFCNi/EADCZNVTo95/uZJXkKfSCNfuwg4ZHE7YIALCXx2BfWox4PbNmko976Td/5AAOriTxH5Kh9lVdEy6s4Oio16viJZ6Y9QDlLSQmeiCxFXjXBKs+Hj/dO4emrS/Ki46RZcTkpeEuP+leSFLFpdyRNtP3RaUj0O0ilaOtgSXHsVqouj0ZBl4Qvx1uKLm7Z06zY5N38D+2rX9GY/FWdieFadZIKqutN2MSXB5sgn9E3cVfARy0rTRGISdgdzE3JhQcMkmLhYuL9XwSQSgsn0SLbcYvSl1M6/mM+JqZa6GXALlOQK2Iuj9koctgzxEnOFu+E5BANvHky2H+8q33ceHcvjuFEzhlT1+GvdjE3+AALMTF0PrfStjUfwMgjVbIVBdjUii9tmVILnaM6DQ9Ub9rzVO48S+9RhMLPuMrySsv2f60D5UQu38UUqihe/nek1gkJDluMDYbfO2ImzebdgtQlt3l0qLIEJoaZujMt3rsAc/s5vmBu0f3LtFUttcUitAi0qggJhbbWMONPux/oQIwk0ObWSEti+rLablYkwTD2nkFpZmNIXsvIEM6/t4wDjSxXOalqf/Q0hpFjXMZb8D9AjdNjlVfweHCfnJKapTummRHnRMoQ96EGeDdzBNMO1JbSVTjutzcg9LYq0A//HpT88+dieCkv3cW+kD96dlLgan28Hji2jBLMs13nOtlK8r5oZ4y/Wq7ZIZ+ZngPd3ixqWmeIryzkRHrcrxR1ePQSSX/TKwLDFUBvU8KVJHC90Rgz6xZQAw6QXpx72NCatafPNKFQtNhckZehN+ubmmx64al/belGyd8iMWxNKTp4yCdFVQ8dWbtG94y89JJlZOXxR/FQ8hoZskqFAddyQFtB8Lo2h7LPJAu1botQ3y/JV0iOD0qudsO/3VbYVi+DImDyQZIT67n4vckbIV/iTXu7rG7P+qUgBZ1EnI6GUPCfCWviuU7rNz80m1bwwazxyii4FPYKGQjpIbSQJeGruCovhDPMgb+V+/KLuXZt9oNednQcDxYovaCxkNKXo4sMogh2creyx60KrMrP8cuu4O9t40YVLx1whF0sbQakc4GJCDqtDIOJw6P/YUXpyqUrmDC6wmH4Vc9Ca/dCORBP8FKB3smBWF8Y/ZDJ/KTF2+RAtGElHXVSVcpWFEJfYUnTJNGz5OSwS5gpXa7Ns7cHc+SRlrlVhriOGiMXB1EL+0tQT+xMwFQFoL76ogBH+E/+LkN3v/RdZMX00/AQYu6PCU0FxWzRNTFXNZ9oeb23MJml9wcZjHK8b7qPwbEr5B/S9n2zIEfH8vlCnS/kp45DqDdXTpW+ZqIfkQoqUs/iowgx29DncpbqOyBUdD0yFfurU7hVH4uxqkqpnXpxtVP5MewUf+KiZPI8ds5Xs1sd0/wnAbyYmnmm0c4VRyL9vXGaLIcGwhN4tvm0v82xH+F2+B4xaqEh4FirlTkjvIMNNt+wtHp1uM42mWQAh6nLCu+WLtY7erlNSsP3DCln/a/FdLSLKsDymUelA+8fVEhIhZmdTuAtUrapVnP6Q6k1FHlAGS+UbrMnL9A3em5JbF94Lqc5ezPYTPpk0TutKZZNkXg16n/1zFojD90YvhgJZsvMeyy6sT4QpAX5U/peHGCseHtd8sp7YwhmTQRYcGkF5J98v7/GBDsh3NuLrb2MF6w9l2RZAchv3Fx+cYZRgDsymcgZd1c4DMqqtwzr5sRrUjwwCFj5S0cl6m5HZQvypoYg0AVtVaQIFMEWPbLFQq1iBfaazP5XP7Hc03iUm/1mCOWlnKzfWxMUkMpLMGK4fa+lbn53hr3v8N/K+yATxTNCwBCibTuYQf2AijURf5nhTjIlfTc0lz9hvgxIafiBwelcCzdg/rP3Styk+S8nt5DYy99nDH62evxaLK4CeC1145HI+El9Or9dMjNMN/NJQftO6+Hu2e43i+HYWqQWZHcQ25b1KUZvjQBYMp3GCA4yXyo2gKhOEbXIVx0zw+gUiZhm5WK5Y1q/UPj+s4lDogw0W28QtyB/a0lLzjNvS3Gu8h6meUy/Q5NkIKhzvssqO+oTLIAfTLOJOHbv4oIg1zWU0/mcLX56y9iNgu9db4D2fhV3Kvx08zSFKvi4156TsHPeyGH4UYOX+yxqq4O7N4vohCZ+BR1HOqFVh0bg1+Rze4DOKegzhhkEKL59kYWTaobGacEqHpPRgRCZ6C7cDJ+UeeOufus6yw6iwei3MBkD/IjzVIq/VO5X4cHDsig6ilsaJq4j+dXA8AqwcwxKZwWcyz9qKP7+Kq+ymPBq0Vphmcv/0BQ1Z1OP4vDZAC9xBskrjFViEUqc+vu23jIm70PYpOwTAcMf2LEXt96YjgIiLOiZXGkCSnX8jI704+NDNrZ5i9TKLlYBpttr7Zn+xQ7UV4sN/0l36jp4TePD9dnVoRTuV6BvmQ8gnwrTnmF1ko361Lt5j9nEFrIf7Yl7G40cskgDzBmY/kN21Bp8pk/J1zPtWkWJD1D8ufNrYFMxMmRDdIQmEbeW5qrvlR6Nu9I86+uskbfHZtMGjI/HA2v1tyj4xJeITnT5qsUQs9QEH3nMkxQAvnAzQu17DPLYdjfJIv25f+ysV8eWASwq29fkhWIm2mFb2KxkBvGxQoXXGIRysuvdG4HpJkcQEU0PKCY9LlVqnQnf0H6flm57v0GPKrvCUvGVWnMWVyikytPtI/Km51saMLF/Tvo8PPlTcr9vMMeTA7alCo/cTkj9oEm5IDeBLQ2HD1ju/vcC6qQx1RcttgMwnP433vjDOvU+bXb7IMwdW8UvW94ZMHvMvE6ZAz6dSnXcmUqOSJqJhu9x84vkx4CbUzFr7qpBsNV153HIoVD44dRUub2hSbPSJZt6BGdWN7Mzs17xqtgnSp8ZUVP5fZ64GpHJK8+7huyA+SCN2mzTwzqFdO4xcdZuvnh6/bv9ZNu4rna45tbNOxtloo0ty/6XPqK6bR7VzGljYsHrsLedum6iqhzUOBUx5e9WzRDMQjB/Sj+6U91CAj1x7Xgo9dcGSl+hPWBuMYUn3rt0tgayMnAa5U9E1ceUH/Nqm2kA68TulKsRjlMfA1IfPAuGjRMlLrfcEmMB9F1H0bn33mcXxMEIRS4Fo6pAT7q1mSep3BVDxzCA4MQ7LhE3yy12FztKqcnabLL8f7RiUnFUc73I5TKShy0H3AkbW6ZoLQspNg7CPrY/AvAqoF5rhvXaGsFgKyRQTx9tUEPB3XuJyDbSW3CH25MnWk5rf1PX5GOKVlnJ/um+skundmaZcMHLyA7xrkLxv1/vVJgwaACd2mW+IHP7tV48tkQgy0PQBVLzL+Uk4oWhdm13plHJcDOxbusge2VqYOGEUWL81pd6ONSL+bwARn0+Dr+T32mVeWQegp3x8AreUfE4Pxy3/SVTsOdKlyYBrvFmjKUU97t77uNtUIV2bt6mChfQTfp2M+OGb4irff6WciF0O7VxxLWAcq8v/nfvUbBMt7grEKSPvnV4PzHPU0G33JJfdb4rOpip4i3VPtVCbaJvC6k/HPWeXHkzekkzl2O2zO9FyDEdsYrZD4DjINNjm4MJnlFPPLDJ7h0Yq+Z3AjDpUcy3HXhvK0JO0sH+S3jEvprKetLlVO4byT0AaQ0g6h6/KKrtBN2vw8XhLXZ9CcozRHNgk0q04Pi+6TI6dHh7/j9Ft571hY7NjubNsh4o8mPTFIoL6I2mrgkrAwmMi0QO+PfchsLqwDoeh/wcoWa1GOj5QJaJ4RE3keI/DhXp36O2z3YPW3PgbxWNWMMEna1mPpxvXiToMMsMGUypgQATlyCKWsAkSQ0yf5RixNbVY26sEkO6DJxojaqnEMLT1mIGQ7NcpYf+j26uB16JQvrjGt96BBCaD2aqeKlTUNabGBxpdQlclH4PuDVak1Dtfg6tWFHgqqcf6f/SZPl9FUpVMm03Ow9Dbeztl5jRCDqDpZNCfG2D6pAE4hlSiM/WKxRCyO0fsp70SpdNLu6yxLhzJdHa9JLlExEUlU54mEr9a5WLZE+OrUW4FvLuDRu33njhCiGSVA9ghL/qrh6k9rIrQkrH3KCIiNDCUj6JtDS0gx56qDLpmj0wgKwa30a32rAFHJWCxUtdWz1R0lXgkNEjgJ7yTt9FwnBfpLrcbu8lF2T+f70r3IXsaO3PHfh/yTO/OsPn31g1C9uystV6sM9DZTMf/LYCR4ueDlWjPzSDBFCiFd1G3Uyn7sVcwRxh9jlJU5A3NXeI4TAiZFAItLAAoXVqrVqQFrQF52ncdAsytSj1LRbCWsodpaWyq7KKqt2MY3q3RKt9tgfO8nmXrqLbuFPEKmj/V+P47gwgA6rvc63IlNhwIhBr0bsao0IPADISrFvO/0QjVOot5qjyU16VRV2tcFyG6kn53k26U0rVWRNQWhsSaDRvy+pIZqBBlggViK4p892ZAvRJtMKWFbinfQzhoZCi0v9cc2uQLbtGc3garzi2DLajW38lRjNOuLarLoExnzKvk/+IOd8UClMvZovC+vY5/0EPDXRCEyMCoZugrpEvRNUWR6YwAIDpx5o7tkGuxJOrr7iZUTvwX62j1DtUnIEibTLV3ggmTRDyhUdGysOJABTeWSl8viOX5MlvDzowYVtnI0VYnEwVoaoQanhyyl3fZVKVAWrTOYQ5pjFEnLZasnJS26XeIKOp/m8zipuHDeSTVaAbbUSJUQU0d/+KvXfgOSDPVRAyxV+lxRrpeG7z7W9C912Rgp67NwRassdBKUWbk0qJP9zgCQG1MrjecLQd3lhYTJyfa9n08Yaaaiw7a5r8P6XdIfIg19ErARDTySuHIYMKSd/1RYKjUmx0SpB0E763wfAID/CK3PC1shOdU07EwZwtVeqdWcLirMNZI/HQtz5aXDMnK7RPb6oLJ9n2U6TP0kQuG42g0kIl/iGDvZ3rgjo8HljU80NDmvhcA+DbLqxc0z60bO2D6AaZVv3VSGWZxz0uHxwbczL3rjb8j4TPZzYI+6cNw0bZjRNzKx7k4UAkBptOuJD04W8E7MFGBVp/W1eUUyzX2tP4BZ4HK2DbBc5ZO6RgYYowMBhxFtNMPUzpqb1NlDmi+dE7jzxrTcUX3IrjiSqjc6xxyLQpE5SBqmgoNKao+WOad+zG/py07CrwFj3//HqpFBez+TSNINVxJx08EVGFOgV2DAfLINQGkIS0pnUpjRG6Yly4Esa0lokDzKzsiQ9FiAsVOtSaSUHyWdNGnvrUPlMQMFhPDocbhj2iomVTv1PyqbBIp8bE2Ql7QR5v+SchrrJ4fvmU58dKIbLvuroeDvL/0tCHu+v+lG+RGd5rFqNog/0WyL4aoRfDnmPFeuOezv78VpHsMaGTi/wvgiL3V2wiNvnB4pNkY7ntCmd/9aXvq9RCz1uq1eG//tj8WkP3fjfFm7iCIAxLyMVfqR7zvS/jXJncTOE8pwFyRMuVPnrlscUg4uh90iS+j9DjJC4mAx3EK4WETmv11IK37Ph0cyEzCE6e2h76z/LGbmrzIWNW2/s49aN1Mqo5XoFyOKMoG32d2KVrn38a1ro9ezlxjkd46cZIaigCSvzrJKCSVw+Fm6QeYT+udtXIJRchDd7j3tcEOViIvcLZOE4dQQkD2DsHhKnF3QHo98hmEVnIDFgPrm5C93ZczWAEHiywJSdLK+wbzex/mih7ii0SIJlsByXsr1oVaVz38jM1Kiz8icgKFh5FA0LBtmNra8Xn9mj2yU54vV5XIYsdrsFpWsHPz0pQD/MuMgak8QLWyb3xkS/Z0alaxSBu+POzC/Vc//7KdOrX+3QFs5n0bWAprlztbPbgphJhcMoIv+3u83RXn5yD/FxoysmUpLYRzI8NLj/gKbDGiHkB1QeLqndlmRhbV6l2p55RyKZH2+erzzQxHUB9zWBywKLGsrmhZxJ9I/g/tvWiumXp6JSUUDM3Kjb/SjE6k+2LZWEmWpF+Z5JzmAIcGVmWYiqzvZWy3LlFcXNuBVhjuQwaE3Z0ITka4+hiTyKba6o0LYV6f7D4xmy4Bh1/oRZwgxn+ayCIuFOwPrQ+qUusX4Kx6bgXcCU+9YVHuDoD5NlpLAzraUPNX7pd58yyGZU4bxEmCYN/ff5kpFDOWJC/EBf8FDK49695VKFr85+QKpvmAEFjJC6Ep/bayHtdgKm+dxGktkIlfHzShdF2PJ7YCnDBT92tsjfoekCLI+1w9kFBlCMnVz9c3AwfMR8aStm1TZEwn236UK+EERwRiQGTFF5hPTdz4kmhzbfxTWn83j4nsiPhzqUYcZJHJKRd2ICvL3nFKsDnL8FXGtJurNlb0TfLQNGPfmkbm2V6fKKGcdXDlW2UBHYld+YyF5x53oclmaMXkyL5/3/fjUTzj3JlXkcze49Q/QWqRmQm0S01/FtSSk7tzcbS9M6Sx5rab9XTk29V6nwPbP0ozL6Aq4S3cXGPO57+Ed9a/t+Vv3AVPmIxV4JfFkx2GFsQqHXt0DxZr9ux8OgY/962wsa8rFd0j1NBFHSPOd9heWPWJ9+HgkZ+zbWHjTDeQhV9mh5pvymeWueqyMF73Zl+mnff7YwQF6LkS4LqIujVk7E4Gqe/K5IhJuEQrQ0tYxWpu1IbRB0kIZPUvs2aXHgUN+N7t8Y0jMmwsJ+2iUOB8bclZQshTOls2/lRLWCkL3wjl92EdWhamUmxASg/foXsYWjD1dMaI4U/lGu12GyE6/bm5tPzxE3/Gl6Rw0wmAIt3DwoLOg/XT0ewvSu8J1RRhSIhSZ97/RCjgORmkcXvkXqkhTZmrL6cYNi9ExD7ZkQAJSJQZi7Q5XQPkkxzeuAAn1ZovgCTKS9/ENcxVW0JHHFDS7WG/csYQIwuHhsbJfsopcdlb0lsDdvCdojmNLwWtcfaftsOeCzHSkZREyZ/jhnsldha1Rzmg1OG4BQHkHkJ3TqRXcl9ZzG83FBYBSrie0+KqnHVn6mI6qWDf6S8IKy32q9VSN4fA0W/aJwjM6scKjFL7j5aF7o3D8JptidjfHTAbId7cmeS28eRo2mJI+slP+QfOL4voz+6zLQMhKn6RnqWmyMw5OUm+SRF4zr/Gs24raosDKyD92NKuYVDAcVaNYYWOp/X70D8KHa9YlxqaJDVirqLzX6spQXPl/lIRxw4Ny5MHq94ID1JZs+i/fmc9iKn+2L2lnskzfuLqXHbftHiofuWnU+Zc2yY1o8+5XN3y5teVPqKYRwt+bc7A0wh6jZEmanCY7nRUWFlGvDD0yrd2iCiDfNHfj6LWD9ylc8/bR144EskfS4PnHjIhq2lNjzDZA4/IKLvhfIweRe8hoc65riJbgjwHR2HGBOlFDbNmOvREYxbg6iYnW+NsG6g4AAXJDQofWTUouDjLAJz2d6fSped07JV+YN1y0auKCZ50c9b260a+eTQIlPavh8tIsKzGroDSqcbqpaBVCOTQjKZGFj5W1qASpdzOFwF9RKNjj8kYJNi20pR6fi55wXqdlRzr3s2IZw2pqEVBl7W/0q/jzBCn4Fsfu94Bl79zl/P0ywgi1oudNO4kxcRe0Z/AozwZmJ6z9RNE8Jv3SQx1Vn4SX9VW21LcQZhxzWhPRdUqz2zfSrP2TRkwhLz3cFq8ZGdVvk9wmd6ThOnmZhx40QtLKj44bJwnnqsLNpfbEk62bwVVYOw2k5xXPO43DUMWfVpEeAxgQLtNgVYxBumyf/8/4W/We94wgSoOadaEN88ioX4N1Xr+rHiai/xQBI92dZGp7yWGMe4rtIEMJCMfz+dBG1ZCVdFoKb3FAYzTE0MwajG+XCqNEWFp8RHC2DaqLPl7K52n2qsQCXpM6IpluqYRv3pMWQ6DX3JudwEvWlVwyUwd0z2Hpo7U9laqGqPZRMoOPMjRi7oK19i2h9y6Bhlf1uRx4kGyVbmDOdN0h9k0gZPMQZblTZksktaIhIvUu+9Fxu/L40bW7nSASJqyQCy18PAktcCxtr+W09ZG0CVL2LmwUY5j6wsQUCJ7tLELlSXS+uK2XpWk2UBqMd08EIHwioLWq6HxquLT1ted37RjhOjBGLyjAbeoKkqdEvPgP1YxXidgj2iby4/keuHHswkXCdPVV2rlkAOtwswJLqQHemCzf7RJP4lKDakNJOYxXf2J8EoehLksCeYsj4zikdlRIgxiuoWpHmoy2m2kGPs7j4HZBQWpHL56Zk6H4bzRbVSujO1lBkPPYIZU5SpQLXhR00dRYzrpNAe34dfrw/vOVmzU3AGwmRgSr04jmLsXIi2xTPW4kfXpd8aJWFfzJS2Cwn/gvB3kQI+VmsBFbBRm0fjTMgNlWZ9aBS0gWe+VXjwDdPQHpnl3n/LY7epjIn3VTLQw2bmFUSGINNjBwXAO3CbIh/dU5WDisQ5CmG1aoZNi91HAL4K0isYsg5dBF4A25CUjtNm9+5XdueT5ws1f8vu74k2ONxv4M2NrJ/HcXHbpHKEPGDiu1PiGUNiHQMTlasqQVDMoSek5aG8YIpnjcZkbECRy0rkqEQCovmdxWeQXyTKA9/lFwmgax99YiWrgfh5T7kNNoYvjmlnlNbu9UTxd7rtJCz7kN7VqDYgCvY4Az4l93Od83qs/6m1ZK5Z7of6jxRC0FnZnQExJDUy83N6fVmMC8n1g/qdiebKrExoh1Xqrl77arDuID8s14JMNvztMiD3L6y9e7YQ77rzNwC3sd21v6nmLLRaI6R1+dXV9d2SkqpKecuNI360qBZdC5G/McPijk5ts7NYRATvAYy6R5Nu+PhzrcvCJioM+h1p+m7wAQholENwZFGry551XWp5DNxT5NUXjfn3UvnbXdrrSKNPjnfr3Rm4G0659Sbh6NzxIsywdzAFOKmA4g4JWBieW4GkBCwtX7dKkqv9P+AnibqRfyjqdI9hew8nyYQmjBnw5+GXpK6qWrYLjKrpy6t0AVeGVJ+hr6Pf7dxK+nc6lmN+PAz7pUO+bKstBBFbYMqyXslxIugP6KBGLUqj4LUH1yfwhM2gjQSAfb4GbHHCucbWM6lnsPPzn9R8581XBcYmZPzg2DsebOkJzFGMtniyPE+ez/drPxMgxg4S2uPMx1Id4ds6GgA0gJK6t9ewRXU1Fj9QTjjhuME5Bl/RfTUI1Q9t2qRtYIRZ9sf3z5skotbxwvlRBosB4DQEqkReQq6oaJaI9vazF5553lICH1eW9Tf9brgSOvIAYO79+3JKUGNeuMgkudxHc61Rri298GMoJVIkKGUw/T2u6NVp3reT1T+5IGR1LOTjWe2IjO20N9GZzLAUW0hDSPQnwn+6HEZCj4U6H5s8wnWAXbGt7fiS+j7esHIyEFk4UAkK9oI65n2wTOCNzYSQmH0dUDckKMCpVQ0gdRasAi1ykNBhKFVYmC9/h2B6lmCQ70AlEH1xFG4Hn8312QEUBspxjLR9ZgI8eSGvZ4XOZuDEex5Cdv76CnvtiO8riDvX898mFDH8ktePtFt4YlpRhYRUvoOk9xJjbBQCOj0TrzJU3umOe/Lc4SFeSp5rYEkvV1cyXNoGnaouwRwtdbMhL+TLkyHyTRpzrMQrzH/bIvxjTYipazP2oFrUj49SDKeF7O5wTaSFuWsGixfsNivuKTRo2YKD8tA4tBJgWimTh9M92BtFOQYMkvXP6FwPnOwI00Lbm/wZFQdSsPnFmrys7GwZjczImMQdJ2iWQP+BoLQIfOx9/M2nb0fYBoSbovG4yTWkgIev+XUkPwHTPdidhZ1zF+LYSzqz34urggyQvQSILrjWBbJIF85R8S252v9uSPVSza3BRehT9ghsgFtW+CTqMT5c3f+5jXA2vkp+ogEkXi/iEwr+OteTt70M1PQdAuCcalyrhgqmO5xnCuoeb3GV8Oa/b7FT6vGxwKnB1UkXv4jdYI9WJsEKdNMW5jKzObmDr10b9oeGObB3ER82QUvNJkU7jarXja30nPuqlL4CnlqY/K5byrpKKN9X7oSLN3lmN/0KTvtKBU9LWDp50BeQ6Wol3X3rAEqXVeNIQJSKxLpu17UILHwAXOwQvTdc3cXiFG/Y5u2fAzYANan7udNqBW/zI0mlNEn7+gHnnqIKusG1dJTJM50Hfz9aRccUZGfaZz7P1uiTj2C/BDXtenfS74nNgJdO0P6WE3JBJcw3gq3gYedZ7mPHiZ7Di9eR20O9TPx+893utDDfbp7q5znPuizXoSDTQ5MSLuYdlfev2fk3cgJHSLYpTFpwpSuGI6x3SdnS4RCmdRLHJNw6FZqBgqt5t13KoZ4ghxIR3PKMq1z7YKoUMtvolVdPMLywwxBDMeFbwJuq4ipgiGqSRN1DTLiXYG7I0z6dMjgL7k2yIf4OcsTX7zlpXsQT8jHw6hR+JAKBGmzAT815sbiDj0kxBiZj5GRDgn/67d+ssIuwZR3YqIgZN5dGaXgdoQf8IU2Ac7aWhk1jcy44j7YK6RDYhrwxhFetQ6CJYm9XRHPsDJbe80lRQGS4YwSwlL3lFD1Zb5fdz0Uz5nBGz82V3mqXvTt8ItpBFmBobicmIa8PXVCujRrBqyh9BjzgKPOjyStRug1q005v+WWtoZ00Bcn1/6Rv+TBc2Bx5jiZL9ElMDP9mnk7Q2BhAB+BoWxKBvjjk1UEN60f+2TiNUmDubWTc2CqKHDCwV2hEIs8PFlxge4On2h+S37ABJAaSxFf15fpTWQZzYJUSsz6h+NtyMr6s4S9i76+O9jHvONpnfvGItKYGJkLmz0bMxhaoytMUMftAU+gHXNGi+E9OaSdwQcP8sIQ0+EZrVFIfDMay4ID3doWNcGra1s+qO7qT/gvlWaQovr6+U+vqhZszAHfR7XBokPHzBJqlMs8/dhThmrMzAaIf49cMNTfFhHrc0HtYLAppUNvvJ3AEQJArO6wVtz63bqZ8CFG68Py6DqWKg7Cgh0z8fM+65R6hkqq4KLTHupj508EWLtSZqFp7NxgkLVY3AP/ZRl5uOU55cKBsNZfOafLB78elhvZ23IeRiHcLAK3iK5i0lg7Rvc2seUYGyMQpwDHOHz1VBZg7N7gud74YG10yJLXtQlQNM0BL0WIEhoKNwb3BLQjvOWHzGiRtcqeCqzMEy1ovcW7F25uVz+pTnNRRa8GXVjqtwguQpJEcFXJQcQqxKVHr6OTEJzPrPXXEvdYEmDTPs1oPp9tNJrwLRc5D+Pp8S6zRRYwICkOXwilqD/Z33wDtv6wLnPZAfMkmPaAZFOSb2wxXEWUteh5EQYewBfyomMZPsCWCD1e+8GEIPoT4rQ7POlXi7/hPvpMFX2B1ueapq1m+FkStTDaQ3qkz+9MdWQ+7rYodly2BCDXbZGGRRNX60cXndokuo4rxzr/DfMnkJ+34Ab7vChXalLLtRgVu434xcObfy63U9obH88c5o1LvLE2yrfeRA6v47APo+yOkOc9FjTWLLQurjdJK5BINjmxjEEnHvg+WnVTSsNQUICzuPqGldHiju+sZl9n7bR/1kZT51H/Q62/pSYTswrlGl3AjecTiDGykMjze63sbOwMrmQnJ637iGbBY4yfs0ZyndssVakwCkybM+EKXDNgrBe0KDQcuk15zqmRh1PRgcVCC2wKrkAFGTJVJVo9Vri8q0U2AkRoMTF+QiusM4fnF8SVA428hQjDoKvTM1FSjcKciZ5CF99DmjXtTzwkT+Xmx1bHv2usA8wuHDvBbyoQ6RzFyg4lyy08WLD94YLiBRK2dfty2tJOCCeGHVNJ+nj7TtJO4fxOcEz6EEWc3j6gd+AI9lpj55yPjinXzielteHxDxr49kW284+/dZBeutC/qL3iy+aGtCkvVU/TI+Afbsm7VZJzzL66oMZb9R1hySjbwRB+MXAWxf5i9aDngQ42jdyWpwWwiTPznXPXGg8fL75LI9GmxX6fRWft6jjVTO2ORJU+lbFmdeUr2wWmIn6+OTgAg1FrmNKn48ni3C3sf+exGxXCZf/bFCho47sstRlWMrZx8ScNQgxhTW8StyCNIu9lOWwYnso7sH3wsxmh2J2uwzwWua/jAmgONSp0FqpfHFVAgX3QgB+phZH27XPdEPtE+AHFE77XtbSfno37LAJXrJ4z9WlN7HGVWA+9xs1ok33k8YUVFNiIPGc58kuN4EuP3x8ihSQvSbyjy3a9kO7hAzMx6zh1gxNCbTJuAGvMOztoq2NS/x3WM/MGH6qmzRlLkaskxBY5tL7bjOm1Ys85b3fd52B/bEjBZPEyInZb9wauztytXvakpWmBTUQze0+DlSCwlptgQmr+gCTkwqFUV48y7p82AzNTDHW/V22McqVh+Q0Q8wb+LHRObdRhGnTkRRB9bAFOksMFWJcXEhKJx7vRuXxsXtG9+QaCM5InYBRyukQuaUxK3nwGIhHjS/MBw7WplYuleV5KJr/GST8V3WtVa3dMze3ilJEzqh1uiCk1ob0bahnO4uzToLAVahMi35eyebXblq/ioEwBGnFShDoDCxlySK+kUxEce/FSp/a3m++rRXaakYO82oB2pSgsVcqDDzZnivMbLA/r3LMygnezmbOPJBaZBJLLYPBk/K2b2oMsbXVekRoC69gy4MqlGCxplqPjyWXIOh7M4Tj28HvnqJupa35/IPhFr3ftN8HtiXgVaR4RNvY5QmJ3n0QM6h3VdKilwX/aV+eL1xTkiJYEpQVxXth8kdESwRNv61jZpa0eidgm9lYgFcFGx3XtxA6QgzVwHgg0WxR8jQ7NfmOoBH+8R0TCMsY2hexsDTS49dxk99R58mz4zn6B//lr35GWBYXDTvwqd3g07REO/J+QVNvBhodxkUdWisgZ0R0jf1sQttVJ6DQov0UQdWDXC/xU3/w5Ea4dgnRPXIVk0EcDujcfd5ZeuEk2ogVASJZKkVGARnuEYU1Wz4HpCe7D1KzDw2TShS1+wr/Z2UbawDE869El0NFP1ANzDUEZyRoDpbMF5V0aJfO2XPmsmx744doaunDt0o7/di1CHueqLIU2qztS5jOUN/89ZdTanU4+gw26uperzUBN0N6vh2X1rbUkEzrB36CW0VFfeniV0W3uX/Wuskq4RZOVT6nxXdGJTejBUA8QaIeE2tXOo+CAyx9bHjtEFRmVbQe4RnKRASdzej5SSFvuMmw3srO2HcVoAxP37BONFT+B3k9iNBsJIETKd9u54cqY5//gFk3OZjJIp/YWs5/PTbvHs3p2NtAGpPnOac5U5jv6+SZdXwRWLcGcLWmYt6O7kqZeXKNPBd0bVywOFaAVhA7BmKvPzMDI7x/PoSoG7m2bpoh9+r1675gG/PurHgsx8LBZrYalGT7lDl8v40PuvnBqFidJQdsY4cRHNKjVDpKNbV4YAyvXfpQoPebnZBwRVn+3P8RNJClWwWSsZiPgfcU/njoNRQSUCOaFo/5eUfmRYBqhwVocfbv9QyyPRVaOtS4YBM1SJI1SADXWIpWVVp/pCVxAvGDO0bZkf81HbYJlzX2+9KC8ruqQvSQ7nhaZoUWCkjg7MDy4Hk647Wnh7Mb9v+9Ji8/Do2aWV5vgmBS+mUCeBUMdVn0jV+tjZu5W5ASVWin9vvIRP4uIVw+TZANT7yAdfI1VYdMwDc4M7ALauLoxC2MjFCoP3CT3QM8kpy+t9zYlo40CXsT6RrFru38ye8JRUzwCb5ky40S3WnOrsBG8TQYEB+R0LBhRar98VB2UM5egwCvVNxQO2SGf5yAKPp2/1B17dlU/pWhmkJEAkj6HAZs79LRl34PDT81HyKrB7P9HS/MSijup/FgF3QVp93OhKRgFkBp134G4C+PkY9EiaIavlhd+7unIoeZ5JgyqlhAY/CNZpfOApwDzuLiYKH8vesbBubhL6G13Vn/qs0A55GHVRnQYRTNdMvbfiGOrthylPWF7LZLts/83eRd967P8p/9m0/G3vUkzSUOXAAABkhalaUlBZ87QU/Bs1jzZb24AsXEV3uFBwBQh9cWp8D6RnDkaJ7m5fMQexzTy4fTJs36+OpKIdP53mf8L+RK6yzzhPpZADaiKRwjRRa9YXowjnFSAPFAYAc4iyyQCwB5GwG1x01Rvc/mFscw6dYI9K5gTSDUQ12xEpFwBUyN8NdJcghfDrJX65Jyy/2hUvEkoi20N903zE8Ky+4EAwgW0GKpozTuJcrUvRBtRmxlQJd/EJkOopfZgynY3TU1hiBbSL3BibzCtSbIEZaj7tZpeLyF32GbD3SpJd/kxdTHtbDI+cRUFmyTpJBkm3LmAc/VOHePYm4mXUfuuHnsZo0mUxccKlHfKiZW+GptRLhb5oH/63jqM56EV9pZc4HTDnt/JrIf52lQGA5R4h61nN/dr3K+XNAag/NZqp1BhRxDHDjuP796b232kOMbd3XJj1AgjGTlSBEHfURaXtlhKQYxT9Sc/Q+6rKwsLSdzr9JtzmTug1plldCcxBUuKM7GD2QuZ6e4/xTOBVXLXEGZvQGfGouwbpDZOtD83wCjSI1RnJzW6biYsR01iw3xvED/yjzZVQIwB+tFrj87ZoFLCFJZNEPwziMXpnZN3wcRjUpJL0zfKe6ZFDpGLxw2EhbvGSs2nWIDnTKpmb64nxnHlf/Fk+A7FGMSF1o9la574GYIaQxcChJujqfqsew4EeKJv/uqlJpAOQy9Rbe2ukW+i+M45mXNvZLZMKXyVDPV2/KnKia6jE1lhqD4EiCeh7hkSZNUq0nVE75/iDkGlkcuYH+qf/ywaH1tWlSlw+P5US02WomNCZYSIzuBJTe/TumJZDLd4ndqow7yu611wcqZxm0fXBXgh6ysAVtwxyjP/SYNzvOyOVdWtxpf8H8fVk+qhW500vI6gScKG7G7mAdF+mfRDnzRswgyuT721QGffnFk4BhRggKZDDJwQ8rvckYesgONLpDlNWAQcZ/YSabm4cLmrUxvUn2f7D3Lv8+VF5OnzUheXsGklB3u8mh+PMBhRnAM+VeVZtKSpX75SsUal1H7ez51Kub9Y/5tJPZAFITo+tS94ZmEe3d8b4JYfxDVdWf5JcCPujVr/VZ+WE4qgQSIJD8tywqGYPqXll+df6MVtlDPXToh6svHs2IvE/X5ui9LEqCB2ycrsw=","rc_enable":"y","bg_snapshot_delay_ms":"500"}

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 63 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow ⋅ 3 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 12 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe
    "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js" "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
      PID:392
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    PID:4612
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2172
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17412 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:82952 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1144

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8E73FL5R\favicon[1].htm
                        Filesize

                        291B

                        MD5

                        b73189024a094989653a1002fb6a790b

                        SHA1

                        0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d

                        SHA256

                        014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d

                        SHA512

                        1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js
                        Filesize

                        6KB

                        MD5

                        3055ff6048a60e79a704001c8b7a0cdd

                        SHA1

                        c793381bcc5ae2e1da599352eb74131a6790c224

                        SHA256

                        6f739f14f1d4dec5d4a62f91cd63caa98766874e9b25cae430990137ad812f37

                        SHA512

                        e4ee9df4b1c7ee75feb331fa2a597b6dfdf83ed714a753a9278b22eabc389ca78aad48609811ce913ebbb7d7ac01c02f7f495aba7d9c244fa31e7f367d906fc1

                        Download Submit
                      • memory/392-124-0x0000000000000000-mapping.dmp
                        Download