Overview

overview

10

Static

static

3

2023-08-26...JC.exe

windows7-x64

10

2023-08-26...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2023-08-26_1282d5e555288a0c8fe7364725714a04_ryuk_JC.exe

  • Size

    21.0MB

  • Sample

    230917-m59pvacd47

  • MD5

    1282d5e555288a0c8fe7364725714a04

  • SHA1

    b858b1536f3f0b1dc02935793e0cd3d65b28be5b

  • SHA256

    fbb9853e7a84bfca60b91c72f40214ddafe43c153a70873c2e30efab64c729b5

  • SHA512

    613e89332108669b2f6aa0c49072b0eed5430dd1b3847045d1c2a1b585ff936e6c6d1c1e4be3af6ddb47a6f8f087bf0002198c6bce2d651f095c7a7167a91f25

  • SSDEEP

    98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMY:9nwngnwnBRh

Score
10/10
persistence

Malware Config

Targets

    • Target

      2023-08-26_1282d5e555288a0c8fe7364725714a04_ryuk_JC.exe

    • Size

      21.0MB

    • MD5

      1282d5e555288a0c8fe7364725714a04

    • SHA1

      b858b1536f3f0b1dc02935793e0cd3d65b28be5b

    • SHA256

      fbb9853e7a84bfca60b91c72f40214ddafe43c153a70873c2e30efab64c729b5

    • SHA512

      613e89332108669b2f6aa0c49072b0eed5430dd1b3847045d1c2a1b585ff936e6c6d1c1e4be3af6ddb47a6f8f087bf0002198c6bce2d651f095c7a7167a91f25

    • SSDEEP

      98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMY:9nwngnwnBRh

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks