Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_e059844d31d217c6b2e4947fd1d91a77_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_e059844d31d217c6b2e4947fd1d91a77_ryuk.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_e059844d31d217c6b2e4947fd1d91a77_ryuk
-
Size
2.0MB
-
MD5
e059844d31d217c6b2e4947fd1d91a77
-
SHA1
8edabbded2f779645c31ad81cd3ca9f1528651d0
-
SHA256
be64ac88db9c57f02896f224bd6720e6cfa353ea6fc7a1181f7eb65dfaf579dc
-
SHA512
20b1a4ceff2a3421737d20f45ee5caa7aa3e530bdec7e45549e10566830ad12f6cb0be37b581bdec721d26aca7309c6f3a99df43def939258db532ec7599efe9
-
SSDEEP
24576:Tv3kQbYgvEqGgFZbevPPO15qaMbNW2isv/G:oQ9vpZqW3ORW2iS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_e059844d31d217c6b2e4947fd1d91a77_ryuk
Files
-
2024-02-23_e059844d31d217c6b2e4947fd1d91a77_ryuk.exe windows:5 windows x64 arch:x64
03f8a46a86a8dc4102474ec88afcd87d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shlwapi
SHDeleteKeyW
SHDeleteValueW
SHSetValueW
kernel32
GetCurrentProcess
GetCurrentThreadId
OpenThread
TerminateThread
SetThreadExecutionState
CloseHandle
GetTickCount
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetEnvironmentVariableW
OutputDebugStringA
OutputDebugStringW
GetDriveTypeW
GetTempPathW
VerSetConditionMask
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
GetLastError
WaitForSingleObject
GetLogicalDrives
FormatMessageW
CreateProcessW
GetDiskFreeSpaceExW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
FindClose
GetFileTime
SetFileTime
GetSystemTime
SystemTimeToFileTime
CreateDirectoryW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetProcAddress
EncodePointer
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetFileAttributesExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
DecodePointer
HeapAlloc
GetStringTypeW
GetCurrentThread
GetFileType
GetTimeZoneInformation
CompareStringW
LCMapStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WaitForSingleObjectEx
CreateThread
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
UnregisterWait
GetThreadTimes
GetModuleHandleA
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
GetSystemDefaultLangID
Sleep
RtlPcToFileHeader
HeapFree
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
DuplicateHandle
TryEnterCriticalSection
CreateEventW
ExitThread
FreeLibraryAndExitThread
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
SetThreadPriority
user32
OpenClipboard
CloseClipboard
MessageBoxW
wsprintfW
FindWindowExW
SetClipboardData
EmptyClipboard
ExitWindowsEx
PostMessageW
ole32
CoTaskMemFree
CoCreateInstance
StringFromCLSID
wininet
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
advapi32
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
CheckTokenMembership
LookupPrivilegeValueW
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
shell32
ShellExecuteExW
SHFileOperationW
Sections
.text Size: 335KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE