Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    203KB

  • Sample

    231009-nm7m7see98

  • MD5

    4f707c67968a14d08cc42958d5341707

  • SHA1

    accf64200195ef1ca9c7f497508c4bfb4e18da41

  • SHA256

    8da85cb00f7ba5e8c23b058d31a4b169c18936a8f7181015ce27e871d8b8cccd

  • SHA512

    9790ab884d3d43f23005a2085b3b320f9bf2ce8ccffd4476ea0b8f2a49cce11c6a61f3ed061d4fa759c167fd6728d890363a148c731251abfdab2bace96432ed

  • SSDEEP

    3072:6qUhUhEnI2XCIaxTrjCgmQ8GiVDswVAETR:bUWEIKXwr2OmA

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

Family

ryuk

Ransom Note
tiravira1978@protonmail.com tripokforcont1983@protonmail.com balance of shadow universe Ryuk
Emails

tiravira1978@protonmail.com

tripokforcont1983@protonmail.com

Targets

    • Target

      tmp

    • Size

      203KB

    • MD5

      4f707c67968a14d08cc42958d5341707

    • SHA1

      accf64200195ef1ca9c7f497508c4bfb4e18da41

    • SHA256

      8da85cb00f7ba5e8c23b058d31a4b169c18936a8f7181015ce27e871d8b8cccd

    • SHA512

      9790ab884d3d43f23005a2085b3b320f9bf2ce8ccffd4476ea0b8f2a49cce11c6a61f3ed061d4fa759c167fd6728d890363a148c731251abfdab2bace96432ed

    • SSDEEP

      3072:6qUhUhEnI2XCIaxTrjCgmQ8GiVDswVAETR:bUWEIKXwr2OmA

    Score
    10/10
    ryukransomware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Renames multiple (7381) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks