Overview

overview

10

Static

static

3

2024-09-11...uk.exe

windows7-x64

10

2024-09-11...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk

  • Size

    436KB

  • Sample

    240911-aseygssepl

  • MD5

    13f929e2cc03dbe1780cce33b7dce110

  • SHA1

    80c4da8863796f0e1cdbb1e72e8678e679526a4d

  • SHA256

    dcb9ec0cc6bdce89df3df0c0ca4170829f6897decd78c5365ea6e7802f3c0941

  • SHA512

    91b0f91be9376884041efcc1aac5eaf5e62c516a48ed7d48c4d2dac5cd23681faba24e088c9131ebfcc1ee60090ba0097dd276a5e235f07cce6c4bf4afa2fd92

  • SSDEEP

    1536:N9QXhvCxVUzRTco+TlNXKldmmYp3d7Ye58zFFg2fahT5wXwtQyHsWSJcdH4JNMwm:IUDYoGyp3dEe+kIamQIYH4/M

Score
10/10
ryukcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-09-11_13f929e2cc03dbe1780cce33b7dce110_ryuk

    • Size

      436KB

    • MD5

      13f929e2cc03dbe1780cce33b7dce110

    • SHA1

      80c4da8863796f0e1cdbb1e72e8678e679526a4d

    • SHA256

      dcb9ec0cc6bdce89df3df0c0ca4170829f6897decd78c5365ea6e7802f3c0941

    • SHA512

      91b0f91be9376884041efcc1aac5eaf5e62c516a48ed7d48c4d2dac5cd23681faba24e088c9131ebfcc1ee60090ba0097dd276a5e235f07cce6c4bf4afa2fd92

    • SSDEEP

      1536:N9QXhvCxVUzRTco+TlNXKldmmYp3d7Ye58zFFg2fahT5wXwtQyHsWSJcdH4JNMwm:IUDYoGyp3dEe+kIamQIYH4/M

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealerspyware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Renames multiple (8047) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

File and Directory Permissions Modification

1
T1222

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks