Overview

overview

10

Static

static

1

2023-04-15...uk.exe

windows7-x64

10

2023-04-15...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-04-15_8c8f2ada556174687e313d96f7c7bbbc_ryuk.exe

  • Size

    3.2MB

  • Sample

    230416-dflgaagf72

  • MD5

    8c8f2ada556174687e313d96f7c7bbbc

  • SHA1

    907263621d214fbf8d3a5b08083ebabd9682025a

  • SHA256

    20b70efde2e8092539330d5073f119b31910be31c8f5395b0436c4403b97ab06

  • SHA512

    ef1e5ef4ab1d4ca54560237392b0ae818492262baee82266b76967fec387f5f4ee2967bf50e8ff3c95403e334baca336e67cbdc2e3490c13a6858511976e297a

  • SSDEEP

    12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCM:eEtl9mRda12sX7hKB8NIyXbacAfn

Score
10/10
persistence

Malware Config

Targets

    • Target

      2023-04-15_8c8f2ada556174687e313d96f7c7bbbc_ryuk.exe

    • Size

      3.2MB

    • MD5

      8c8f2ada556174687e313d96f7c7bbbc

    • SHA1

      907263621d214fbf8d3a5b08083ebabd9682025a

    • SHA256

      20b70efde2e8092539330d5073f119b31910be31c8f5395b0436c4403b97ab06

    • SHA512

      ef1e5ef4ab1d4ca54560237392b0ae818492262baee82266b76967fec387f5f4ee2967bf50e8ff3c95403e334baca336e67cbdc2e3490c13a6858511976e297a

    • SSDEEP

      12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCM:eEtl9mRda12sX7hKB8NIyXbacAfn

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks