Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_e0d3642d272534aa2b2929a1229bda83_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_e0d3642d272534aa2b2929a1229bda83_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-06_e0d3642d272534aa2b2929a1229bda83_ryuk
-
Size
552KB
-
MD5
e0d3642d272534aa2b2929a1229bda83
-
SHA1
8468ea99d875b198df2f8b62b8d93384d694aa5d
-
SHA256
1b3d9c7f11fab14a8e2bab84ec1e65bbfe33c9180fb26feebc5877ff2e2130f8
-
SHA512
5da09decad82f5b12099e9262e570fdc5bb49467c92bc87124d15b48b2987015c4884d46e3f91d23d289fb2757cadfc2b1cbb125344ab2bde391450b14e5f400
-
SSDEEP
12288:ptiN2XLLPJ/d246h0X/gnJqy0gG0wEPc9mrmR:vJXLLPJ/d23h0X/gnJqy0gGYPc9mrm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-06_e0d3642d272534aa2b2929a1229bda83_ryuk
Files
-
2024-01-06_e0d3642d272534aa2b2929a1229bda83_ryuk.exe windows:6 windows x64 arch:x64
a730e670d7fd129d6daf1063b8b7ff57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
PathRemoveFileSpecA
kernel32
GetExitCodeProcess
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
WaitForSingleObject
HeapReAlloc
HeapSize
GetTimeZoneInformation
CreateDirectoryW
SetConsoleCtrlHandler
CloseHandle
SetFilePointerEx
FlushFileBuffers
SystemTimeToTzSpecificLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
WriteConsoleW
FileTimeToSystemTime
GetStdHandle
WriteFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetCurrentThread
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
RemoveDirectoryW
OutputDebugStringA
OutputDebugStringW
WaitForSingleObjectEx
CreateThread
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
user32
MessageBoxA
shell32
ShellExecuteExA
SHGetFolderPathA
SHFileOperationA
ole32
CoInitializeEx
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
Sections
.text Size: 421KB - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ