Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_1faf3ed00e1b5eb305b7fbce86b81437_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_1faf3ed00e1b5eb305b7fbce86b81437_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_1faf3ed00e1b5eb305b7fbce86b81437_ryuk
-
Size
2.1MB
-
MD5
1faf3ed00e1b5eb305b7fbce86b81437
-
SHA1
4a25421a04de33868343b7a947489a8f55f3a90b
-
SHA256
b0e2bbae58ae76ea87540cddea90930a42af7e4e0d938b2a6a32142b5d4b3468
-
SHA512
59a212d1b59cd55502ed37231d9816085edb7e89961244ac3bda9c60843a4b26c347c891591a0c8c8eb3447bbc88bffeb29c69f9b692270ca6988024580c7a4c
-
SSDEEP
49152:3vKzKt5J6LZ+EYw41h2ossffGlGsZhRprx2zCV2piy:fKzKtH71h2ooFO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-20_1faf3ed00e1b5eb305b7fbce86b81437_ryuk
Files
-
2024-02-20_1faf3ed00e1b5eb305b7fbce86b81437_ryuk.exe windows:6 windows x64 arch:x64
1cfef2b4203f0a5cf5d4a9545f9c5230
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteConsoleW
GetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
GetProcessHeap
ReadConsoleW
GetSystemInfo
VirtualQuery
LoadLibraryExA
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
SetEndOfFile
GetUserDefaultLangID
HeapSize
LoadLibraryW
FreeLibrary
CreateDirectoryW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
GetVersionExW
MultiByteToWideChar
GetNativeSystemInfo
GetProcAddress
VerSetConditionMask
GlobalMemoryStatusEx
WideCharToMultiByte
VerifyVersionInfoW
CreateDirectoryA
WaitForSingleObject
GetCurrentThreadId
GetExitCodeThread
GetConsoleMode
SetEvent
CloseHandle
ResetEvent
OpenThread
SetThreadAffinityMask
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
GetProcessTimes
CreateEventW
WaitForMultipleObjects
SizeofResource
GetModuleFileNameW
GetProcessId
GetModuleHandleA
K32GetProcessMemoryInfo
LockResource
GetProcessIoCounters
LoadResource
FindResourceW
GetThreadTimes
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
SetHandleInformation
CreatePipe
CreateProcessW
GetPrivateProfileStringA
FormatMessageW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
EncodePointer
GetCPInfo
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
SwitchToThread
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
LoadLibraryExW
SetThreadErrorMode
GetModuleHandleExW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
OutputDebugStringA
SetErrorMode
FormatMessageA
K32GetModuleBaseNameA
InitializeCriticalSection
CreateFileA
DeleteFileA
GetFileAttributesA
ReadFile
SetFileAttributesA
WriteFile
LocalAlloc
LocalFree
GetThreadPriority
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
GetACP
SetConsoleCtrlHandler
GetFullPathNameW
GetFullPathNameA
SetStdHandle
GetFileType
HeapAlloc
HeapFree
ExitThread
HeapReAlloc
ExitProcess
GetCommandLineA
GetCommandLineW
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
SetFilePointerEx
user32
GetSystemMetrics
GetClientRect
WindowFromPoint
WaitForInputIdle
shell32
FindExecutableW
SHGetKnownFolderPath
ShellExecuteW
winmm
timeEndPeriod
timeBeginPeriod
shlwapi
PathFindFileNameW
PathFileExistsW
PathStripToRootW
PathRemoveFileSpecW
PathIsUNCW
PathIsRelativeA
PathCombineW
PathIsDirectoryW
PathFindExtensionW
PathIsRelativeW
d3d11
D3D11CreateDevice
dxgi
CreateDXGIFactory
d3d9
Direct3DCreate9Ex
dxva2
DXVA2CreateDirect3DDeviceManager9
avifil32
AVIFileGetStream
AVIFileInfoW
AVIFileExit
AVIStreamGetFrameOpen
AVIFileInit
AVIStreamGetFrameClose
AVIStreamRead
AVIStreamInfoW
AVIFileRelease
AVIFileOpenW
AVIStreamGetFrame
AVIStreamRelease
imagehlp
ImageDirectoryEntryToData
advapi32
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclA
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 627KB - Virtual size: 627KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ