Overview

overview

10

Static

static

3

8f368b029a...8a.exe

windows7-x64

10

8f368b029a...8a.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

  • Size

    144KB

  • Sample

    240805-lhl5lawepa

  • MD5

    89895cf4c88f13e5797aab63dddf1078

  • SHA1

    1efc175983a17bd6c562fe7b054045d6dcb341e5

  • SHA256

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

  • SHA512

    d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

  • SSDEEP

    3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

Score
10/10
ryukcredential_accessdiscoveryransomwarestealer

Malware Config

Targets

    • Target

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    • Size

      144KB

    • MD5

      89895cf4c88f13e5797aab63dddf1078

    • SHA1

      1efc175983a17bd6c562fe7b054045d6dcb341e5

    • SHA256

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

    • SHA512

      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

    • SSDEEP

      3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Renames multiple (5442) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks