Overview

overview

10

Static

static

3

2023-12-29...uk.exe

windows7-x64

10

2023-12-29...uk.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2023-12-29_5d52e0e5d2e1c2955011dd585f0848ae_ryuk

  • Size

    26.6MB

  • Sample

    231231-t9jsjsagfn

  • MD5

    5d52e0e5d2e1c2955011dd585f0848ae

  • SHA1

    7da00cb8fac2f21d495111c8754e7cd37f1540f3

  • SHA256

    64229251028e91c9b3a44e1a13f7fe2cdc036db7d3ef8b943dedb36d4549d3c0

  • SHA512

    e254e58aca8625d0cff2f829a49bdea1952c6010edec5a574bdd9cbfa72ecb525ed9fa66a34e0834000e051cf82ae6aa332d8405acb08e1f0eabcee435937887

  • SSDEEP

    98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMr:9nwngnwnC

Score
10/10
persistence

Malware Config

Targets

    • Target

      2023-12-29_5d52e0e5d2e1c2955011dd585f0848ae_ryuk

    • Size

      26.6MB

    • MD5

      5d52e0e5d2e1c2955011dd585f0848ae

    • SHA1

      7da00cb8fac2f21d495111c8754e7cd37f1540f3

    • SHA256

      64229251028e91c9b3a44e1a13f7fe2cdc036db7d3ef8b943dedb36d4549d3c0

    • SHA512

      e254e58aca8625d0cff2f829a49bdea1952c6010edec5a574bdd9cbfa72ecb525ed9fa66a34e0834000e051cf82ae6aa332d8405acb08e1f0eabcee435937887

    • SSDEEP

      98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMr:9nwngnwnC

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks