AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_dab9c6017e3e7cf447ee6a9b3170d9e0_ryuk.exe
Resource
win7-20231215-en
Target
2024-01-25_dab9c6017e3e7cf447ee6a9b3170d9e0_ryuk
Size
1.6MB
MD5
dab9c6017e3e7cf447ee6a9b3170d9e0
SHA1
93d47ffc0fe20ec219bc72936e7728ad6754a143
SHA256
142a4c77ccb8973af88950096903409df2cf8caad7b9e3a1db65704669b1c858
SHA512
e2b3c4a169990a6d666777d385fc41868b121ddc889db88fa84a27ebb519cb9590d723ba0d77e0fc0a61a089bc2af0a1abd5d74a2f611e32925ff68c82f82dc1
SSDEEP
24576:6Z7+0IbaEOtqZpp0YYtwlGhNsof2e7A+ebC:6Z7+0IWHmpSK8hWomh
Checks for missing Authenticode signature.
Processes:
resource |
---|
2024-01-25_dab9c6017e3e7cf447ee6a9b3170d9e0_ryuk |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
SetStdHandle
WriteConsoleW
GetProcAddress
ExitProcess
HeapAlloc
GetProcessHeap
GetModuleHandleW
LoadLibraryW
GetFileAttributesW
CreateFileW
GetUserDefaultUILanguage
GetModuleFileNameW
GetStdHandle
GetCommandLineW
RaiseException
SetFilePointerEx
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
WriteFile
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetFileType
GetCurrentProcess
GetModuleFileNameA
TerminateProcess
GetModuleHandleExW
GetACP
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
CommandLineToArgvW
MessageBoxExW
StrCmpW
AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE