Overview

overview

10

Static

static

3

NEAS.2023-...JC.exe

windows7-x64

10

NEAS.2023-...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.2023-09-05_c24304181ae0373df14317da39f65ec7_ryuk_JC.exe

  • Size

    19.3MB

  • Sample

    231023-vs1keada39

  • MD5

    c24304181ae0373df14317da39f65ec7

  • SHA1

    83b7306c9c6defb68b2303fe48d01526aa286c84

  • SHA256

    ebf8b0380a17296d2fc92714974c849e65862a95b5b979ec6a9f2773c99f8913

  • SHA512

    83932d6815737c5e80dc9957d81a00f6dcb19a4525004d1ab6f284815facd8bb2773a683a4e19389c5af0ca934fa4161c2978503e323c63bea1f23461cb2746a

  • SSDEEP

    98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMZ:9nwngnwn0

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      NEAS.2023-09-05_c24304181ae0373df14317da39f65ec7_ryuk_JC.exe

    • Size

      19.3MB

    • MD5

      c24304181ae0373df14317da39f65ec7

    • SHA1

      83b7306c9c6defb68b2303fe48d01526aa286c84

    • SHA256

      ebf8b0380a17296d2fc92714974c849e65862a95b5b979ec6a9f2773c99f8913

    • SHA512

      83932d6815737c5e80dc9957d81a00f6dcb19a4525004d1ab6f284815facd8bb2773a683a4e19389c5af0ca934fa4161c2978503e323c63bea1f23461cb2746a

    • SSDEEP

      98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMZ:9nwngnwn0

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (786) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (93) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks