Overview

overview

9

Static

static

3

2024-06-01...uk.exe

windows7-x64

9

2024-06-01...uk.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-01_967d70eae33e86f9a00cc51685aaa2ad_ryuk

  • Size

    192KB

  • Sample

    240601-e5krqaaf23

  • MD5

    967d70eae33e86f9a00cc51685aaa2ad

  • SHA1

    9ee396b7510026adade59f1ef9fea60deeb63e50

  • SHA256

    1d4fdaa30bc3b83054ad00b0dc80292decc9a1f409daf4bc0586780aecfaadfa

  • SHA512

    7e49b4ed0355affda0bdfa20540086d0d1f8a69d7129bc8d63a3d920cc6fa02ecd37b3863193f86c9393351e04fd54107fa7a2615bfa2fef0e0398e58d1ba317

  • SSDEEP

    3072:wbYRYDEnRuxvB5oveeGiKhvFB1JWxEc2C+mS+o4Xd/x+j8Zi/qpe:fYDcsTFbF75xCSk/dZ9pe

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-06-01_967d70eae33e86f9a00cc51685aaa2ad_ryuk

    • Size

      192KB

    • MD5

      967d70eae33e86f9a00cc51685aaa2ad

    • SHA1

      9ee396b7510026adade59f1ef9fea60deeb63e50

    • SHA256

      1d4fdaa30bc3b83054ad00b0dc80292decc9a1f409daf4bc0586780aecfaadfa

    • SHA512

      7e49b4ed0355affda0bdfa20540086d0d1f8a69d7129bc8d63a3d920cc6fa02ecd37b3863193f86c9393351e04fd54107fa7a2615bfa2fef0e0398e58d1ba317

    • SSDEEP

      3072:wbYRYDEnRuxvB5oveeGiKhvFB1JWxEc2C+mS+o4Xd/x+j8Zi/qpe:fYDcsTFbF75xCSk/dZ9pe

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (5229) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks