General
-
Target
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
-
Sample
220801-mg7kksfdb4
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
Resource
win10-20220718-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\IGM9JUSQ\f[1].txt
ryuk
Targets
-
-
Target
http://www.fsoft.it/FSPViewer/dwn-files/FSPViewer-2.1.0-Setup.exe
Score10/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Modify Registry
1Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation