Extracted

• • Target

    5e2c9d80fa4528fe9777738a9cba9ede08cdae353fd4cb2d9caf0c9801fd5711

  • Size

    134KB

  • MD5

    b6b531d5477d737cb153ec5201c5baed

  • SHA1

    fe228587cb8ff1565fbc0e825f45fac0726c4ec5

  • SHA256

    9d2bcfa82facbaff874c61534ef4bc647ee072b218c4903e87012e1683e30bec

  • SHA512

    c4d84ba0e25d0e8a4d694a9924183cc65168c010e18d539d2003b02ec13d43c6a2f3594266ab4dbbce7de5f769f86192e9320cd2ddee332ac0ad161de27f1426

  • SSDEEP

    3072:4MQVQQA/chSW4wL2uY5Mfz/qfsbkPnwaT3T8uZoCKq:XQVQQAKSW4wax5MfasWobq

  Score

  10^/10

  ryukcredential_accessdiscoveryransomwarestealer

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk

  • Ryuk family

    ryuk

  • Renames multiple (2967) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2