AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_de27529b17db2e2656778f67876900b6_ryuk.exe
Resource
win7-20231215-en
Target
2024-01-25_de27529b17db2e2656778f67876900b6_ryuk
Size
1.5MB
MD5
de27529b17db2e2656778f67876900b6
SHA1
aa3107ae1ccd629c57dd70298c1482a9edf858c4
SHA256
635bbbe254e983f1181094d011d33b3961c53e99493ea65ebfcbcc3f1c52cd3c
SHA512
5b1fa47ab30fafc431ffe33d26f4c69921d65421d6b347ba163461ac636d7dd67e98b4debfe22919d1e1e4e0ee599d1d7f6d95a7f5569ad9073dfaa52786ca2d
SSDEEP
24576:kZ7+quEOtqZpp0YYtwlGhNsof2e7A+ebC:kZ7+xHmpSK8hWomh
Checks for missing Authenticode signature.
Processes:
resource |
---|
2024-01-25_de27529b17db2e2656778f67876900b6_ryuk |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
SetStdHandle
WriteConsoleW
GetProcAddress
ExitProcess
HeapAlloc
GetProcessHeap
GetModuleHandleW
LoadLibraryW
GetFileAttributesW
CreateFileW
GetUserDefaultUILanguage
GetModuleFileNameW
GetStdHandle
GetCommandLineW
RaiseException
SetFilePointerEx
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
WriteFile
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
RtlUnwindEx
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetFileType
GetCurrentProcess
GetModuleFileNameA
TerminateProcess
GetModuleHandleExW
GetACP
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
CommandLineToArgvW
MessageBoxExW
StrCmpW
AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE