49900c5b1a575384a8232b3f0786f36c2af872c7f190e0055285d272a9ef86c3

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe
Size

10.0MB
MD5

b7268c70ac963cb9fd99ced27900d8b6
SHA1

bc42b1de10cc737ddc5bfe443ccb4eacf91ca85c
SHA256

49900c5b1a575384a8232b3f0786f36c2af872c7f190e0055285d272a9ef86c3
SHA512

1e06dfd31e12759cab03d36439f0d137a57ed5786eccc0296642fe294a75f22e33b78a852ac394db088a0446f9aca21cef000f731e612d09a1f255557d11cade
SSDEEP

196608:RRLHkfJQE7cRGo8sOgZo0aHoLgKvzYOAhOAkL7/TN38NBTQrDKJK8Cw/EqW0l77I:fzkxyLjzXAsAkPTh8NhQrmyKwe/j4

Score

1^/10

Malware Config

Signatures

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun = "67108863"	NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "255"	NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-27_b7268c70ac963cb9fd99ced27900d8b6_ryuk.exe"
1⤵
- System policy modification
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...