Overview

overview

10

Static

static

3

8f368b029a...8a.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.zip

  • Size

    74KB

  • Sample

    250126-tdlx2axjcm

  • MD5

    6b0a0046932cd2db225b2ae9239b0987

  • SHA1

    f9298df0d5bb1ef598c396e2f23045761471e52d

  • SHA256

    4815197a32fd49ba3f6cb23f48ceb1d4a68f7a2de1bd23471190f2ab39412e9d

  • SHA512

    0bced4b9b296cb8195e7b6c67e6491889e7de9c92d6388709072317b8695add019d2061ff3737df81cf755fed19baad99ee05efd2785620650e5fe9e640de5d2

  • SSDEEP

    1536:1nj1JUJyoAlO/dysSG81LXX5hSr9RwFzzAdm2HeeIQ315k:lrNomO/dysU1zXOr9CXUHvRl5k

Score
10/10
ryukcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

    • Size

      144KB

    • MD5

      89895cf4c88f13e5797aab63dddf1078

    • SHA1

      1efc175983a17bd6c562fe7b054045d6dcb341e5

    • SHA256

      8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

    • SHA512

      d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

    • SSDEEP

      3072:eOFqYZEtiRjB+OpBmUHkRCBMmn3T/znyS4:eO8xwjBx8UHkt2DJ4

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarespywarestealer

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Ryuk family

      ryuk

    • Renames multiple (7669) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks