Overview

overview

10

Static

static

3

d6b7b27e13...a9.exe

windows7-x64

10

d6b7b27e13...a9.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    240626-rptqxa1ejn_pw_infected.zip

  • Size

    66KB

  • Sample

    250128-xlqgzayjgv

  • MD5

    0c760c9af1439400edf0b47efd89db9e

  • SHA1

    ace1b2fe04b22fdceb9a19553fa911d6871744fb

  • SHA256

    7fd2e1a7ddff6be3ca2e6f04eaa12ed79581d3d76c3da7419aa793d128a724f0

  • SHA512

    5c1a0a99e6547131a79a408e3d379ff3585b5ff0bb78193973f226befdbda87f4de39c7608979c8d573775c07dea38f5cca22fcdc72a16017306855b5a7e2327

  • SSDEEP

    1536:Oo4cuqJrtMt7gt36E9lOwYlZ1mhJh1V3tFkdnJvSOvytg:5a8Z6w36E9oZo9Wd7qC

Score
10/10
ryukcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9.exe

    • Size

      131KB

    • MD5

      2cc630e080bb8de5faf9f5ae87f43f8b

    • SHA1

      5a385b8b4b88b6eb93b771b7fbbe190789ef396a

    • SHA256

      d6b7b27e13700aaa7f108bf9e76473717a7a1665198e9aafcc2d2227ca11bba9

    • SHA512

      901939718692e20a969887e64db581d6fed62c99026709c672edb75ebfa35ce02fa68308d70d463afbcc42a46e52ea9f7bc5ed93e5dbf3772d221064d88e11d7

    • SSDEEP

      3072:j06qm9E8obCg2QdgYdrp23suV+eGg21Yg:j06qHnOg3df9eAJ

    Score
    10/10
    ryukcredential_accessdiscoveryransomwarestealerspyware

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

      ransomwareryuk

    • Ryuk family

      ryuk

    • Renames multiple (8297) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

File and Directory Permissions Modification

1
T1222

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks