Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_5a1b5a2211a779ce207dabe0d0434adf_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_5a1b5a2211a779ce207dabe0d0434adf_ryuk.exe
Resource
win10v2004-20231215-en
Target
2024-01-23_5a1b5a2211a779ce207dabe0d0434adf_ryuk
Size
1.2MB
MD5
5a1b5a2211a779ce207dabe0d0434adf
SHA1
ab61264df65d60e66287cdbc3f0d4513d9953d32
SHA256
038380257953244555d5e6bccd3a0cae1bf0a02e8b1c54a494d8dd1babe22bfe
SHA512
10b6ac3c1d5933c631bb65e5cbf245dd2eb22963433dd02e305d01c74ccb4ebe2570091a92e68d5a7ac5c33ce82fe35c6b9ab4ed357f31f1cb92215742f1df91
SSDEEP
24576:Jmzp8HVdJYqQI4RFZHq7XH8cRNr20z8HPzDnIL:Jm81dJPQjRFZHq7XlazDm
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
WideCharToMultiByte
GetCurrentProcess
LocalFree
FormatMessageW
WaitForSingleObject
CreateProcessA
MultiByteToWideChar
LoadLibraryW
GetDateFormatW
ReadFile
WriteFile
WriteConsoleW
CreateFileW
HeapSize
ReadConsoleW
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryW
Sleep
DeviceIoControl
GetLastError
CloseHandle
GetFullPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
CreateFileA
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
SetConsoleCtrlHandler
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetStdHandle
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
RtlUnwindEx
RaiseException
RtlPcToFileHeader
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
OutputDebugStringW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
RtlCaptureStackBackTrace
SwitchToThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
InitializeSListHead
SignalObjectAndWait
EnumDisplayDevicesW
CharNextW
LoadStringW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegCloseKey
InitiateSystemShutdownExW
StringFromGUID2
CLSIDFromString
SetupDiGetDeviceRegistryPropertyA
SetupCopyOEMInfW
InstallHinfSectionW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiGetINFClassW
SetupDiBuildClassInfoListExW
SetupDiGetClassDescriptionExW
SetupDiCallClassInstaller
SetupDiOpenClassRegKeyExW
SetupDiSetDeviceRegistryPropertyW
CM_Get_Next_Res_Des_Ex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_First_Log_Conf_Ex
CM_Free_Res_Des_Handle
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupDiGetDriverInfoDetailW
SetupDiSetSelectedDriverW
SetupDiEnumDriverInfoW
SetupDiBuildDriverInfoList
SetupScanFileQueueW
SetupCloseFileQueue
SetupOpenFileQueue
SetupGetStringFieldW
SetupFindFirstLineW
SetupCloseInfFile
SetupOpenInfFileW
CM_Get_DevNode_Status
SetupDiClassNameFromGuidExA
SetupDiGetDeviceInstallParamsW
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
CM_Reenumerate_DevNode_Ex
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
CM_Get_Device_ID_ExW
CM_Disconnect_Machine
CM_Connect_MachineW
SetupDiClassGuidsFromNameExW
SetupDiClassNameFromGuidExW
SetupDiSetClassInstallParamsW
SHDeleteKeyW
DwmIsCompositionEnabled
ord102
closesocket
connect
htons
inet_addr
recv
send
socket
WSAStartup
WSACleanup
WSAGetLastError
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ