Extracted

Extracted

• • Target

    320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689

  • Size

    190KB

  • MD5

    ffef678beca8ee60200bc88809d89630

  • SHA1

    b31070af1ac3e088dfc6f1599f8d12edb1b16783

  • SHA256

    320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689

  • SHA512

    54298098a866e24d99e3764154ae3ca4481e9163fd6e9e0d2c27d7978065a38da38accd58268c985b4ed0cfd4c11a27f4fa51e815c2d7a15e3ec18c453df89c3

  Score

  10^/10

  ryukdiscoverypersistenceransomware

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2