38f0750cbe49b30db326b53b9f752b66c4f5e23cc3bbbd6d1844e2878a19b9a7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
Size

363KB
MD5

dfd6177cd181f2c8cd9b2bd088a192ba
SHA1

67c93b7f0dbaa2e93b89b297095efa64a84cb448
SHA256

38f0750cbe49b30db326b53b9f752b66c4f5e23cc3bbbd6d1844e2878a19b9a7
SHA512

a2acf72fae1f091729a630a43cc937bf79fd9635caa57538ec930fc091f50b75a5ba15a9060c5e390bfa61d645c4e3e25aa0060ced26875a9bc2a8fb25a35e9e
SSDEEP

6144:w2CpH78AcyKHaXopnaS23kZcL9QhF4nW6cM2X29nAF4imK4NaHRrmW/:w2WbcyguopC30cL9Q74BcM8GndaxrmW/

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\Y:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\A:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\B:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\K:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\L:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\M:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\O:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\R:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\S:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\H:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\J:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\Z:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\U:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\V:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\T:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\X:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\E:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\G:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\Q:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\W:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\I:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
File opened (read-only)	\??\N:	2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_dfd6177cd181f2c8cd9b2bd088a192ba_ryuk.exe"
1⤵
- Enumerates connected drives
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\AAA_READ_AAA.TXT

Filesize
956B

MD5
884706cf6fa575a615a741b5722b7bc4

SHA1
71a2661f83f0d718b87760ab48e961b8a1f604eb

SHA256
1f0dbae9e91b6d35d681c7e72a5e0a899cab09857acedc115c36f97ed52bd572

SHA512
ac52d4c0edf1a852f821202974a0e0e4c04e53b4ef0d9bc6475b41931d217fec5d9c934e6b8d264ef71e8fcc9d570e25f5214b96f7a90362ce0304b8ae155e4f

Download Submit