General

  • Target

    b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

  • Size

    976KB

  • Sample

    220508-g3keaacbfq

  • MD5

    f3699b7b1bab29788fa470cd38c4c70e

  • SHA1

    563eb07031dd1d697d6ff932904c0930ca6ce5f9

  • SHA256

    b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

  • SHA512

    eb30d1d66788681d7d2bad7af50c0695460e6571a99c023d2424cfd5410de7ab7fda386d2551bb2314c0abebcc97a0b084345db7ab01077558deaf861a8180c2

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\History_E.txt

Family

ryuk

Ransom Note
History /////////////////////////////////////////////////////// /// The sentence was got with translation software. /// /////////////////////////////////////////////////////// 10/14/2007 v0.97 Addition: --------- Change: ------- Revision: --------- -Correct a AVI output. ================================================================================ 9/17/2007 v0.96 Addition: --------- Change: ------- Revision: --------- -Correct a FDS. -Correct a menu of Disksystem. ================================================================================ 08/12/2007 v0.95 A language plugin is changed. Please pay attention. Addition: --------- -There was ON/OFF by indication of time in movie playback. -Were usable to four pieces of disks (8 sides) by a disk system. Change: ------- Revision: --------- -A bank loaded in a state road in MMC5 corrects a problem to change. -Correct a FDS. ================================================================================ 06/01/2006 v0.93 Addition: --------- -Several automatic correspondence or addition of a family BASIC keyboard. -Add a Mapper164/165/167.(Thanks TPU) -It supports Supor Keyborad.(Thanks TPU) -Coped with a voice synthesis of Moero!! Pro-Tennis. Change: ------- Revision: -------- -Support a logical change application of a Caps key and a Ctrl key. -Correct movement of a frame counter. -A remainder of DMA_cycles corrects a few problems than request_cycle. -Cope in Mapper2 in Shanghai (PRG CRC:b20c1030). -Support a version other than DBZ2. -Correct the number of clock of NES for PAL. -A family BASIC keyboard connection 2P side controller corrects the problem that does not work. -Be revisions scantily. ================================================================================ 04/09/2004 v0.92 Addition: --------- -Add a correspondence pattern to simple virus checkers. (WORM_NETSKY.Q) Change: ------- Revision: --------- -Correct a reset parameter of $4017 in NSF. -Corrent Mapper19. (Wagan Land 2) ================================================================================ 03/25/2004 v0.91c Addition: --------- Change: ------- -Stopped extension distinction of ".zip". Revision: --------- -Correct a triangle wave. -Correct a reset parameter of $4017 in NSF. ================================================================================ 02/20/2004 v0.91b Addition: --------- -Tried to link "VirtuaNES.exe.manifest" for WindowsXP. Change: ------- Revision: --------- -Correct an operation of the ZIP file which doesn't include IPS in "Auto IPS patch". -Correct that be removed a pause by DIALOG indication of a launcher. ================================================================================ 02/12/2004 v0.91a Addition: --------- Change: ------- Revision: --------- -Correct that there is the case that simple virus checkers detects by mistake. (MYDOOM.A) ================================================================================ 02/07/2004 v0.91 Addition: --------- -Add a correspondence pattern to simple virus checkers. Change: ------- -A list view update method of Cheat support is changed. Revision: --------- -Correct IRQ of MMC3. (Rockman 3) -Correct a triangle wave. ================================================================================ 01/27/2004 v0.90d Addition: --------- Change: ------- Revision: --------- -Correct a triangle wave. (pikes of DQ3) ================================================================================ 01/21/2004 v0.90c Addition: --------- Change: ------- -Change it to admit the UP/DOWN simultaneous input of a pad. (diabolical pitch exclusive use:D) Revision: --------- -Correct algorithm of a triangle wave. ================================================================================ 01/21/2004 v0.90b Addition: --------- Change: ------- -Put back a patch of "Some speedup". Revision: --------- -Correct an operation of a "Prohibition of double activate" option. -Correct an operation of Holdnote of a triangle wave. (some BGM of Dungeon of Zelda were strange) ================================================================================ 01/13/2004 v0.90a Addition: --------- Change: ------- -Remade an IPS patch routine. An IPS file name didn't need to be the same in case of bundling in a thing of a ZIP archive. Reinforced it than a thing of an error check, and the IPS patch with a change of size ignored a size outside part. -Correct that malfunction can go with a patch of speedup to some extent. Revision: --------- -A color corrects a monochrome bug in a total color change by AVI conversion. ================================================================================ 01/11/2004 v0.90 A language plugin is changed. Please pay attention. Addition: --------- -Add an IPS patch function.(Thanks Feather) -Add Mapper27.(Thanks tpu) -Add a hq2x/lq2x filter. -Add an AVI conversion function. Please refer to AVIconv.txt in detail. Change: ------- -Change a font of language plugin. -Some speedup.(Thanks Feather) -When the right button of a mouse is pushed in use in Zapper, it is a change a screen to become the same as the time that pushed the left button outside. (Thanks Father) Revision: --------- -Increased a queue buffer for sound. -Correct an IRQ timing of DPCM. -Correct it to take damage in Gun Sight(J) rightly. -Correct that a color didn't change by a monochromatic / whole color change in a full-screen /8bit color. -An option of "Using Sleep" corrects what isn't saved. -Correct a problem of a snapshot in a monochromatic mode. -Correct Mapper16. -Correct Mapper33. ================================================================================ 11/03/2003 v0.86a Addition: --------- -Add the option that doesn't use joystick ID. Note) Even if joystick connection is "OK" with control panel, when you cannot use at all by VirtuaNES, please add "NoJoystickID=1" to [General] section of INI file. -Add Mapper61. Change: ------- -Didn't support slider of a joystick. Note) Provisional measures Revision: --------- -Correct a label of POV of a joystick. -Correct updating timing of NES controller. -Correct Mapper4. -Correct Mapper60. ================================================================================ 10/26/2003 v0.86 Addition: --------- -Add an option to do a pause of an emulation at active time of a launcher. Note) Add "ActivePause=1" to a [Launcher] section of INI. -Add Mapper200,201,202. (Thanks CaH4e3) Change: ------- -Support POV and SLIDER of a joystick. Revision: --------- -Correct Mapper4. -Correct Mapper189. -Correct that tape/barcode was strange. Note) Enbugging was carried out from 0.85. ================================================================================ 10/19/2003 v0.85d Addition: --------- -Add VS Mach Rider(Japan, Fighting Course) to VS-Unisystem. Change: ------- -Support mouse wheel in MemoryViewer. Revision: --------- -Correct Mapper69. ================================================================================ 10/13/2003 v0.85c Addition: --------- -Adds VS Raid on Bungaling Bay(J)/VS Mighty Bomb Jack(J) to VS-Unisystem. Change: ------- Revision: --------- -Corrects surface drawing process. -Corrects Mapper74. ================================================================================ 10/11/2003 v0.85b Addition: --------- Change: ------- Revision: --------- -Corrects Mapper20(FDS). -Corrects that an effect sound doesn't sound in Sangokushi2(KOEI version). ================================================================================ 10/11/2003 v0.85a Addition: --------- Change: ------- Revision: --------- -Corrects an indication of FPS. -Corrects screen simulation of Mother. -Corrects a bug of version information DIALOG. ================================================================================ 10/09/2003 v0.85 Because a mail address wasn't usable, the mail address was changed by a virus.:( A language plugin is changed. Please pay attention. Addition: --------- -Add file name representation in an emulation to a window title bar. -Add starting and an option starting a launcher simultaneously. -Add a quick load / save. Note) Choose a slot directly, and there is load / save. -Add a pallet edit function. -Add a bank changing function to a turbo file. -Add various graphics filter functions. (required MMX) Note)2xSaI/Super2xSaI/SuperEagle/Scale2x is usable. A supporting screen mode is referred to as follows. | 8bpp 16bpp 24bpp 32bpp -----------+------------------------------ 2xSaI | No Yes No Yes Super2xSaI | No Yes No Yes SuperEagle | No Yes No Yes Scale2x | No Yes No Yes -Add the option that does Sleep of an option of "Sync drawing" in activity to graphic setting DIALOG. -Add the option that resolution except 4:3 can choose in a full screen. -Add VS-Unisystem. -Add automatic distinction of NTSC/PAL to a NSF player mode. -Add Mapper12. Change: ------- -Change internal surface drawing process. Note) May be accelerate, and may become heavy.:) -Change it so that there is monochromatic / background color modification in a line unit. Note) Because a pallet isn't enough with a 8bit color, can't reproduce a color precisely. Please use more than 16bit color if possible. -Change an approach of interrupt handling. -Change it to set a PAL mode automatically when a file name includes "(E)". -Change it so that a snapshot can make even PNG. Note) Please choose it in Emulator setting DIALOG. -Change it so that there is a multiple selection in a launcher list. -Change it not to update a list after Folder setting of a launcher. Note) Because a complement was able to save a list. Revision: --------- -Correct fault of action at the time of focus movement. -Correct malfunction of a triangular wave. -Correct a mapper in various ways. -Correct the bug that isn't saved after header editing with a launcher. -When choosing file on WAVE recording / tape operation / movie and extension is omitted, correct so that extension may be attached. -Correct other in various ways. ================================================================================ 08/25/2003 v0.82 Addition: --------- -Add a correspondence pattern to simple virus checkers. (Sobig.F has been sent to me by terrible force. Have been sent around 2000-3000 in a day....) Change: ------- -Changed cheat code folder of a default in ".\cheatcode\" from ".\code\". Revision: --------- -Correct Mapper20(FDS). -Correct focus and there can be the thing that place it, and shortcut key has worked in one of movement of short cut malfunction. -Corrected the malfunction that had worked without relation in setting of background movement when minimized it with a click of task bar. ================================================================================ 08/07/2003 v0.81 Addition: --------- Change: ------- -Invalidated operation with a keyboard when turned a chat window in net play into an active window. Note) Can operate it in joystick. Revision: --------- -Corrected that a general conservation error went when it started when DirectX7.0 or higher was not installed. -Corrected setting to SRAM check box of Cheat support. -Correct Mapper112. ================================================================================ 06/23/2003 v0.80 Addition: --------- Change: ------- -Set a start music number of NSF in an initial value. Revision: --------- -SRAM save corrects the malfunction that there isn't by some games of Mapper1. -Correct Mapper45. ================================================================================ 06/01/2003 v0.79 Addition: --------- -Add indication of a sort state to a save and a header part of a sort state in Launcher. Change: ------- Revision: --------- -Correct behavior of an APU register. -Correct Mapper90. ================================================================================ 05/24/2003 v0.78 Addition: --------- -Add some equivalence patterns to simple virus checkers. Change: ------- -Saved a state of a source emulation part by a state save. Think that the phenomenon that a sound becomes strange almost disappears in state load. Note) Don't store VRC7. Revision: --------- -Shortcut key processing a few revision. ================================================================================ 05/06/2003 v0.77 Addition: --------- -Add an option doing Sleep when uses an option of "Sync drawing". Please add "SyncNoSleep=1" to a [Graphics] section when uses it. Default off. A frame rate depends on monitor frequency when turns this option into ON. Note) Please do not use it when can't select monitor frequency in full-screen with Windows9x(Include Me) series. -Displayed a key of VRC7 with a NSF player mode. Note) Display a musical scale of a channel in key-on. Change: ------- Revision: --------- -Correct that FPS and shortcut key processing become too fast when it makes the number of frame skip increasing between pauses of emulation. -Correct Mapper83. ================================================================================ 04/21/2003 v0.76a Addition: --------- Change: ------- Revision: --------- -Correct that then can have returned by a full-screen change with shortcut key in the cause. ================================================================================ 04/20/2003 v0.76 Addition: --------- -Add following Mapper(there is Mapper which doesn't work.) 044,045,046,047,050,051,057,058,060,062,074,105,108,109,110,112, 114,115,116,117,133,134,135,140,142,160,182,183,190,191,193,194, 198,222,225,226,227,228,229,230,231,232,233,234,235,236,240,241, 242,244,245,246,248,249,251,252,254,255 Change: ------- Revision: --------- -Correct that Shougi Meikan '92 didn't move. ================================================================================ 03/21?/2003 v0.75e (Don't release it formally.) Sorry... Addition: --------- Change: ------- Revision: --------- -A debugging code is left, and correct that was very heavy. ================================================================================ 03/21/2003 v0.75d Sorry... Addition: --------- Change: ------- Revision: --------- -A debugging code is left, and correct that was very heavy. ================================================================================ 03/21/2003 v0.75c Addition: --------- Change: ------- Revision: --------- -Correct a very stupid bug of NMI. :( -Correct behavior of special NMI. ================================================================================ 03/21/2003 v0.75b Addition: --------- Change: ------- Revision: --------- -Correct the bug that FDS can't save. ================================================================================ 03/20/2003 v0.75a Addition: --------- Change: ------- Revision: --------- -Only DISKSYSTEM was the same as v0.74, and steeped NMI. ================================================================================ 03/19/2003 v0.75 -Because revises plug-in, please pay attention. Addition: ------

Targets

    • Target

      b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

    • Size

      976KB

    • MD5

      f3699b7b1bab29788fa470cd38c4c70e

    • SHA1

      563eb07031dd1d697d6ff932904c0930ca6ce5f9

    • SHA256

      b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

    • SHA512

      eb30d1d66788681d7d2bad7af50c0695460e6571a99c023d2424cfd5410de7ab7fda386d2551bb2314c0abebcc97a0b084345db7ab01077558deaf861a8180c2

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks