Overview

overview

10

Static

static

3

2023-04-25...uk.exe

windows7-x64

10

2023-04-25...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-04-25_4525a670c602c5fef0129358940c24a2_ryuk

  • Size

    2.4MB

  • Sample

    230426-efet6seh43

  • MD5

    4525a670c602c5fef0129358940c24a2

  • SHA1

    807f5cbc5300f360545a45da1cc4f36ee33e1b74

  • SHA256

    baee2881de86c99ac55358c2ef0101ad3612ebaee77bffd343955bcf5bee50f0

  • SHA512

    ec6d0572621ab372ce5b1292492ffa0744322a6dabb58179cae0fd3f0994b1c93519f2196b17596360aff421e74b6d0b380de32353fe1dabfa3ec12e4d6a2a79

  • SSDEEP

    12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCq:eEtl9mRda12sX7hKB8NIyXbacAfD

Score
10/10
persistence

Malware Config

Targets

    • Target

      2023-04-25_4525a670c602c5fef0129358940c24a2_ryuk

    • Size

      2.4MB

    • MD5

      4525a670c602c5fef0129358940c24a2

    • SHA1

      807f5cbc5300f360545a45da1cc4f36ee33e1b74

    • SHA256

      baee2881de86c99ac55358c2ef0101ad3612ebaee77bffd343955bcf5bee50f0

    • SHA512

      ec6d0572621ab372ce5b1292492ffa0744322a6dabb58179cae0fd3f0994b1c93519f2196b17596360aff421e74b6d0b380de32353fe1dabfa3ec12e4d6a2a79

    • SSDEEP

      12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCq:eEtl9mRda12sX7hKB8NIyXbacAfD

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks