General

  • Target

    nmap-7.92-setup.exe

  • Size

    27.3MB

  • Sample

    220624-sa3kyadaej

  • MD5

    79ba1e7f3d16eb87bfebb79b01928421

  • SHA1

    f0f0e7f7b802639a7e3f96b51d632f047291c37e

  • SHA256

    b2400db1a4af9607fdd6ee50e0f5926d8b9272f89eec93d4c30b56dc854afb7a

  • SHA512

    8c1dad5cd7829395b7df69cf1db789e2702cb7cdf58cb76d0e6b0c0f9b69261c57f8347d9d9185295d08e1d2fc6834db59f14ffd00a2be01c2d834130e394559

Malware Config

Extracted

Path

C:\Program Files (x86)\Nmap\nselib\data\enterprise_numbers.txt

Family

ryuk

Ransom Note
# curl -L http://www.iana.org/assignments/enterprise-numbers/enterprise-numbers | perl -lne 'if(/^\d/){$x=$_}elsif($x){print"$x\t$_";$x=undef}' 1 NxNetworks 2 IBM (https://w3.ibm.com/standards) 3 Carnegie Mellon 4 Unix 5 ACC 6 TWG 7 CAYMAN 8 PSI 9 ciscoSystems 10 NSC 11 Hewlett-Packard 12 Epilogue 13 U of Tennessee 14 BBN Technologies 15 Xylogics, Inc. 16 Timeplex 17 Canstar 18 Wellfleet 19 TRW 20 MIT 21 EON 22 Fibronics 23 Novell 24 Spider Systems 25 NSFNET 26 Hughes LAN Systems 27 Intergraph 28 Interlan 29 Vitalink Communications 30 Ulana 31 NSWC 32 Santa Cruz Operation 33 MRV Communications, In-Reach Product Division 34 Cray 35 Nortel Networks 36 DEC 37 Touch 38 Network Research Corp. 39 Baylor College of Medicine 40 NMFECC-LLNL 41 SRI 42 Sun Microsystems 43 3Com 44 CMC 45 SynOptics 46 Cheyenne Software 47 Prime Computer 48 MCNC/North Carolina 49 Chippcom 50 Optical Data Systems 51 gated 52 Enterasys Networks Inc. 53 Apollo Computers 54 DeskTalk Systems, Inc. 55 SSDS 56 Castle Rock Computing 57 MIPS Computer Systems 58 TGV, Inc. 59 Silicon Graphics, Inc. 60 University of British Columbia 61 Merit 62 NetEdge 63 Apple Computer, Inc. 64 Gandalf 65 Dartmouth College 66 David Systems 67 Reuter 68 Cornell 69 Michael Sabo 70 Locus Computing Corp. 71 NASA 72 Retix 73 Boeing 74 AT&T 75 Ungermann-Bass 76 Digital Analysis Corporation 77 LAN Manager 78 LogMatrix Inc (formerly 'OpenService Inc.') 79 Fujitsu Services 80 Auspex Systems, Inc 81 Lannet Company 82 Network Computing Devices 83 Raycom Systems 84 Pirelli Focom Ltd. 85 Datability Software Systems 86 Network Application Technology 87 Institute of Telematics, Karlsruhe Institute of Technology (KIT) 88 New York University 89 RND 90 InterCon Systems Corporation 91 Coral Network Corporation 92 Webster Computer Corporation 93 Frontier Technologies Corporation 94 Nokia 95 Allen-Bradely Company 96 CERN 97 Sigma Network Systems, Inc. 98 Emerging Technologies, Inc. 99 SNMP Research 100 Ohio State University 101 Ultra Network Technologies Julie 102 Microcom 103 Lockheed Martin 104 Micro Technology 105 Process Software Corporation 106 EMC Data General Division 107 Bull Company 108 Emulex Corporation 109 Warwick University Computing Services 110 NetScout Systems, Inc. (formerly 'Network General Corporation') 111 Oracle 112 Control Data Corporation 113 Hughes Aircraft Company 114 Synernetics, Inc. 115 Mitre 116 Hitachi, Ltd. 117 Telebit 118 Salomon Technology Services 119 NEC Corporation 120 Fibermux 121 FTP Software Inc. 122 Sony 123 Newbridge Networks Corporation 124 Racal-Datacom 125 CR SYSTEMS 126 DSET Corporation 127 Computone 128 Tektronix, Inc. 129 Interactive Systems Corporation 130 Banyan Systems Inc. 131 Sintrom Datanet Limited 132 Bell Canada 133 Olicom Enterprise Products Inc. 134 Rice University 135 OnStream Networks 136 Concurrent Computer Corporation 137 Basser 138 Luxcom 139 Artel 140 Independence Technologies, Inc.(ITI) 141 NetScout Systems, Inc. (formerly 'Frontier Software Development') 142 Digital Computer Limited 143 Eyring, Inc. 144 Case Communications 145 Penril DataComm, Inc. 146 American Airlines, Inc. 147 Sequent Computer Systems 148 Bellcore 149 Concord Communications 150 University of Washington 151 Develcon 152 Solarix Systems 153 Unifi Communications Corp. 154 Roadnet 155 Network Systems Corp. 156 ENE (European Network Engineering) 157 Dansk Data Elektronik A/S 158 Morningstar, Inc. 159 Dupont EOP 160 Legato Systems, Inc. 161 Motorola 162 European Space Agency (ESA) 163 Aethis sa/nv 164 Rad Data Communications Ltd. 165 OfficeNet, Inc. 166 Shiva Corporation 167 Fujikura America 168 Xlnt Designs INC (XDI) 169 Tandem Computers 170 BICC 171 D-Link Systems, Inc. 172 AMP, Inc. 173 Netlink 174 C. Itoh Electronics 175 Sumitomo Electric Industries (SEI) 176 DHL Systems, Inc. 177 Network Equipment Technologies 178 APTEC Computer Systems 179 Schneider & Koch & Co, Datensysteme GmbH 180 Hill Air Force Base 181 Kentrox 182 Japan Radio Co. 183 Versitron 184 Telecommunication Systems 185 Interphase 186 Toshiba Corporation 187 Clearpoint Research Corp. 188 Ascom 189 Fujitsu America 190 NovaQuest InfoSystems 191 NCR 192 Dr. Materna GmbH 193 Ericsson AB 194 Metaphor Computer Systems 195 Patriot Partners 196 The Software Group Limited (TSG) 197 Kalpana, Inc. 198 University of Waterloo 199 CCL/ITRI 200 Coeur Postel 201 Mitsubish Cable Industries, Ltd. 202 SMC 203 Crescendo Communication, Inc. 204 Goodall Software Engineering 205 Intecom 206 Victoria University of Wellington 207 Allied Telesis, Inc. 208 Cray Communications A/S 209 Protools 210 NIPPON TELEGRAPH AND TELEPHONE CORPORATION 211 Fujitsu Limited 212 Network Peripherals Inc. 213 Netronix, Inc. 214 University of Wisconsin Madison 215 NetWorth, Inc. 216 Tandberg Data A/S 217 Technically Elite Concepts, Inc. 218 Labtam Australia Pty. Ltd. 219 Republic Telcom Systems, Inc. 220 ADI Systems, Inc. 221 Microwave Bypass Systems, Inc. 222 Pyramid Technology Corp. 223 Unisys_Corp 224 LANOPTICS LTD., Israel 225 NKK Corporation 226 CODIMA Technologies Ltd 227 Acals 228 ASTEC, Inc. 229 Delmarva Power 230 Telematics International, Inc. 231 Fujitsu Technology Solutions GmbH (formerly 'Fujitsu Siemens Computers') 232 Compaq 233 NetManage, Inc. 234 NC State University 235 Empirical Tools and Technologies 236 Samsung Electronics Co., LTD. 237 Takaoka Electric Mfg. Co., Ltd. 238 NxNetworks 239 WINDATA 240 RC International A/S 241 Netexp Research 242 Internode Systems Pty Ltd 243 netCS Informationstechnik GmbH 244 Lantronix 245 Avatar Consultants 246 Furukawa Electoric Co. Ltd. 247 ND SatCom - Gesellschaft für SatellitenkommunikationssystemembH 248 Richard Hirschmann GmbH & Co. 249 G2R Inc. 250 University of Michigan 251 Netcomm, Ltd. 252 Sable Technology Corporation 253 Xerox 254 Conware Computer Consulting GmbH 255 Compatible Systems Corp. 256 Scitec Communications Systems Ltd. 257 Transarc Corporation 258 Matsushita Electric Industrial Co., Ltd. 259 ACCTON Technology 260 Star-Tek, Inc. 261 ADC Codenoll Technology Corporation 262 Formation, Inc. 263 Seiko Instruments, Inc. 264 RCE (Reseaux de Communication d'Entreprise S.A.) 265 Xenocom, Inc. 266 Nexans Deutschland Industries 267 Systech Computer Corporation 268 Visual 269 CSC Airline Solutions Denmark A/S 270 Zenith Electronics Corporation 271 TELECOM FINLAND 272 BinTec Communications GmbH 273 EUnet Germany 274 PictureTel Corporation 275 Michigan State University 276 GTE Government Systems - Network Management Organization 277 Cascade Communications Corp. 278 APRESIA Systems, Ltd. (formerly 'Hitachi Cable, Ltd.') 279 Olivetti 280 Vitacom Corporation 281 INMOS 282 AIC Systems Laboratories Ltd. 283 Cameo Communications, Inc. 284 Diab Data AB 285 Olicom A/S 286 Digital-Kienzle Computersystems 287 CSELT(Centro Studi E Laboratori Telecomunicazioni) 288 Electronic Data Systems 289 Brocade Communications Systems, Inc. (formerly 'McData Corporation') 290 Harris Corporation 291 Technology Dynamics, Inc. 292 DATAHOUSE Information Systems Ltd. 293 Teltrend (NZ) Limited 294 Texas Instruments 295 PlainTree Systems Inc. 296 Hedemann Software Development 297 Fuji Xerox Co., Ltd. 298 Asante Technology 299 Stanford University 300 Digital Link 301 Raylan Corporation 302 Commscraft 303 Hughes Communications, Inc. 304 Farallon Computing, Inc. 305 GE Information Services 306 Gambit Computer Communications 307 Livingston Enterprises, Inc. 308 Star Technologies 309 Micronics Computers Inc. 310 Basis, Inc. 311 Microsoft 312 US West Advance Technologies 313 University College London 314 Eastman Kodak Company 315 Network Resources Corporation 316 Atlas Telecom 317 Bridgeway 318 American Power Conversion Corp. 319 DOE Atmospheric Radiation Measurement Project 320 VerSteeg CodeWorks 321 Verilink Corp 322 Sybus Corportation 323 Tekelec 324 NASA Ames Research Center 325 Simon Fraser University 326 Fore Systems, Inc. 327 Centrum Communications, Inc. 328 NeXT Computer, Inc. 329 Netcore, Inc. 330 Northwest Digital Systems 331 Andrew Corporation 332 Digi International 333 Computer Network Technology 334 Lotus Development Corp. 335 MICOM Communication Corporation 336 ASCII Corporation 337 PUREDATA Research 338 NTT DATA 339 Siemens Industry Inc. 340 Kendall Square Research (KSR) 341 ORNL 342 Network Innovations, Inc. 343 Intel Corporation 344 Compuware Corporation 345 Epson Research Center 346 Fibernet 347 Dot Hill Systems 348 American Express Company 349 Compu-Shack 350 Parallan Computer, Inc. 351 Stratacom 352 Open Networks Engineering, Inc. 353 ATM Forum 354 SSD Management, Inc. 355 Automated Network Management, Inc. 356 Magnalink Communications Corporation 357 Kasten Chase Applied Research 358 Skyline Technology, Inc. 359 Nu-Mega Technologies, Inc. 360 Morgan Stanley & Co. International PLC 361 Integrated Business Network 362 L & N Technologies, Ltd. 363 Cincinnati Bell Information Systems, Inc. 364 RAMA Technologies 365 MICROGNOSIS 366 Datapoint Corporation 367 RICOH Co. Ltd. 368 Axis Communications AB 369 Pacer Software 370 3COM/Axon 371 Alebra Technologies, Inc. 372 GSI 373 Tatung Co., Ltd. 374 DIS Research Ltd. 375 Quotron Systems, Inc. 376 Dassault Electronique 377 Corollary, Inc. 378 SEEL, Ltd. 379 Lexcel 380 pier64 381 OST 382 Megadata Pty Ltd. 383 LLNL Livermore Computer Center 384 Dynatech Communications 385 Symplex Communications Corp. 386 Tribe Computer Works 387 Taligent, Inc. 388 Symbol Technologies, Inc. 389 Lancert 390 Alantec 391 Ridgeback Solutions 392 Metrix, Inc. 393 Symantec Corporation 394 NRL Communication Systems Branch 395 I.D.E. Corporation 396 Panasonic Electric Works Co., Ltd. 397 MegaPAC 398 Tyco Electronics 399 Hitachi Computer Products (America), Inc. 400 METEO FRANCE 401 PRC Inc. 402 Wal-Mart Stores, Inc. 403 Nissin Electric Company, Ltd. 404 Distributed Support Information Standard 405 SMDS Interest Group (SIG) 406 SolCom Systems Ltd. 407 Bell Atlantic 408 Advanced Multiuser Technologies Corporation 409 Mitsubishi Electric Corporation 410 C.O.L. Systems, Inc. 411 University of Auckland 412 Distributed Management Task Force (DMTF) 413 Klever Computers, Inc.Tom Su 414 Amdahl Corporation 415 JTEC Pty, Ltd. 416 Matra Communcation 417 HAL Computer Systems 418 Lawrence Berkeley Laboratory 419 Dale Computer Corporation 420 University of Tuebingen 421 Bytex Corporation 422 Cogwheel, Inc. 423 Lanwan Technologies 424 Thomas-Conrad Corporation 425 TxPort 426 Compex, Inc. 427 Evergreen Systems, Inc. 428 HNV, Inc. 429 UTStarcom Incorporated 430 Canada Post Corporation 431 Open Systems Solutions, Inc. 432 Toronto Stock Exchange 433 Mamakos\TransSys Consulting 434 EICON 435 Jupiter Systems 436 SSTI 437 Grand Junction Networks 438 Pegasus Solutions, Inc. 439 Edward D. Jones and Company 440 Amnet, Inc. 441 Chase Research 442 BMC Software 443 Gateway Communications, Inc. 444 Peregrine Systems 445 Daewoo Telecom 446 Norwegian Telecom Research 447 WilTel 448 Ericsson-Camtec 449 Codex 450 Basis 451 AGE Logic 452 INDE Electronics 453 Isode Limited 454 J.I. Case 455 Trillium 456 Bacchus Inc. 457 MCC 458 Stratus Computer 459 Quotron 460 Beame & Whiteside 461 Cellular Technical Services 462 Shore Microsystems, Inc. 463 Telecommunications Techniques Corp. 464 DNPAP (Technical University Delft) 465 Plexcom, Inc. 466 Tylink 467 Brookhaven Laboratory 468 Computer Communication Systems 469 Norand Corporation 470 MUX-LAP 471 Premisys Communications, Inc 472 Bell South Telecommunications 473 J. Stainsbury PLC 474 Manage Operations 475 Wandel and Goltermann Technologies 476 Vertiv (formerly 'Emerson Computer Power') 477 Network Software Associates 478 Procter and Gamble 479 Meridian Technology Corporation 480 QMS, Inc. 481 Network ExpressTom Jarema 482 LANcity Corporation 483 Dayna Communications, Inc. 484 kn-X Ltd. 485 Sync Research, Inc. 486 PremNet 487 SIAC 488 New York Stock Exchange 489 American Stock Exchange 490 FCR Software, Inc. 491 National Medical Care, Inc. 492 DCS Dialog Communication Systems Aktiengesellschaft Berlin 493 NorTele 494 Madge Networks, Inc. 495 Memotec Communications 496 ON 497 Leap Technology, Inc. 498 General DataComm, Inc. 499 ACE Communications, Ltd. 500 ADP 501 European Agency of Digital Trust (formerly 'Programa SPRITEL') 502 Adacom 503 Metrodata Ltd 504 Ellemtel Telecommunication Systems Laboratories 505 Arizona Public Service 506 NETWIZ, Ltd., 507 Science and Engineering Research Council (SERC) 508 508 Credit Suisse First Boston - Watcher 509 Hadax Electronics Inc. 510 VTKK 511 North Hills Israel Ltd. 512 TECSIEL 513 Bayerische Motoren Werke (BMW) AG 514 CNET Technologies 515 MCI 516 Human Engineering AG (HEAG) 517 FileNet Corporation 518 Kongsberg Gruppen ASA (formerly 'NFT-Ericsson') 519 Dun & Bradstreet 520 Intercomputer Communications 521 Defense Intelligence Agency 522 Telesystems SLW Inc. 523 APT Communications 524 Delta Airlines 525 California Microwave 526 Avid Technology Inc 527 Integro Advanced Computer Systems 528 RPTI 529 Ascend Communications Inc. 530 Eden Computer Systems Inc. 531 Kawasaki-Steel Corp 532 Systems Management Infrasture, Barclays Bank PLC 533 B.U.G., Inc. 534 Eaton Corporation 535 Superconducting Supercollider Lab. 536 Triticom 537 Universal Instruments Corp. 538 Information Resources, Inc. 539 Kentrox 540 Crypto AG 541 Infinite Networks, Ltd. 542 Tangram Enterprise Solutions, Inc. 543 Alebra Technologies, Inc. 544 Equinox Systems, Inc. 545 Hayes Microcomputer Products 546 Empire Technologies Inc. 547 Glaxochem, Ltd. 548 Software Professionals, Inc 549 Agent Technology, Inc. 550 Dornier GMBH 551 Telxon Corporation 552 Entergy Corporation 553 GarrettCom, Inc (formerly 'Garrett Communications') 554 Agile Networks, Inc. 555 Larscom 556 Stock Equipment 557 ITT Corporation 558 Universal Data Systems, Inc. 559 Sonix Communications, Ltd. 560 Paul Freeman Associates, Inc. 561 John S. Barnes, Corp. 562 Northern Telecom, Ltd. 563 CAP Debris 564 Telco Systems NAC 565 Tosco Refining Co 566 Russell Info Sys 567 University of Salford 568 NetQuest Corp. 569 Armon Networking Ltd. 570 IA Corporation 571 AU-System Communicaton AB 572 GoldStar Information & Communications, Ltd. 573 SECTRA AB 574 ONEAC Corporation 575 Tree Technologies 576 General Dynamics C4 Systems 577 Geneva Software, Inc. 578 Interlink Computer Sciences, Inc. 579 Bridge Information Systems, Inc. 580 Leeds and Northrup Australia (LNA) Nigel Cook 581 CSG Systems International (formerly 'Intec Telecom Systems') 582 Newport Systems Solutions, Inc. 583 azel Corporation 584 ROBOTIKER 585 PeerLogic Inc. 586 Digital Transmittion Systems 587 Far Point Communications 588 Xircom 589 Mead Data Central 590 Royal Bank of Canada 591 Advantis, Inc. 592 Chemical Banking Corp. 593 Eagle Technology 594 BT 595 Radix BV 596 TAINET Communication System Corp. 597 Comtek Services Inc. 598 Fair Isaac Corporation 599 AST Research Inc. 600 Soft*Star s.r.l. Ing. Enrico Badella 601 Bancomm 602 Trusted Information Systems, Inc. 603 Harris & Jeffries, Inc. 604 Axel Technology Corp. 605 NetTest Inc. 606 CAP debis 607 Lachman Technology, Inc. 608 Galcom Networking Ltd. 609 BAZIS 610 SYNAPTEL 611 Investment Management Services, Inc. 612 Taiwan Telecommunication Lab 613 Anagram Corporation 614 Univel 615 University of California, San Diego 616 CompuServe 617 Telstra - OTC Australia 618 Westinghouse Electric Corp. 619 DGA Ltd. 620 Elegant Communications Inc. 621 Experdata 622 Unisource Business Networks Sweden AB 623 Molex, Inc. 624 Quay Financial Software 625 VMX Inc. 626 Hypercom, Inc. 627 University of Guelph 628 DIaLOGIKa 629 NBASE Switch Communication 630 Anchor Datacomm B.V. 631 PACDATA 632 University of Colorado 633 Tricom Communications Limited 634 Santix Software GmbH 635 Encore Networks, Inc. 636 Georgia Institute of Technology 637 Alcatel-Lucent (formerly 'Alcatel Data Network') 638 GTECH 639 UNOCAL Corporation 640 First Pacific Network 641 Lexmark International 642 Qnix Computer 643 Jigsaw Software Concepts (Pty) Ltd. 644 Eastern Research Inc. 645 nsgdata.com Inc 646 SEIKO Communication Systems, Inc. 647 Unified Management 648 RADLINX Ltd. 649 Microplex Systems Ltd. 650 Trio Information Systems AB 651 Phoenix Microsystems 652 Distributed Systems International, Inc. 653 Evolving Systems, Inc. 654 SAT GmbH 655 CeLAN Technology, Inc. 656 Landmark Systems Corp. 657 Netone Systems Co., Ltd. 658 Loral Data Systems 659 Cellware Broadband Technology 660 MuSys Corporation 661 IMC Netw
URLs

http://www.iana.org/assignments/enterprise-numbers/enterprise-numbers

https://w3.ibm.com/standards

http://rpm5.org

http://www.arduino.cc/

http://www.nashire.com

http://www.sentinel-engine.org

http://www.ingnitia.com

http:\\citvo.ru

Targets

    • Target

      nmap-7.92-setup.exe

    • Size

      27.3MB

    • MD5

      79ba1e7f3d16eb87bfebb79b01928421

    • SHA1

      f0f0e7f7b802639a7e3f96b51d632f047291c37e

    • SHA256

      b2400db1a4af9607fdd6ee50e0f5926d8b9272f89eec93d4c30b56dc854afb7a

    • SHA512

      8c1dad5cd7829395b7df69cf1db789e2702cb7cdf58cb76d0e6b0c0f9b69261c57f8347d9d9185295d08e1d2fc6834db59f14ffd00a2be01c2d834130e394559

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks