General
- Target 241019-x646vstfnf_pw_infected.zip
- Size 77KB
- Sample250128-w92pgaxpcv
- SHA256 6b76ec5da7265a0b2a2ad097d0780665644f532680effb53b6e95ce60d0bd2fd
Score
10/10
Malware Config
Targets
-
- Target 8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
- Size 144KB
- SHA256 8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a
Score10/10Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
Ryuk family
Renames multiple (8042) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops desktop.ini file(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1