Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_ff55e8a3c61679612d362d3811dc13f8_ryuk.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-09_ff55e8a3c61679612d362d3811dc13f8_ryuk.exe
Resource
win10v2004-20240226-en
Target
2024-03-09_ff55e8a3c61679612d362d3811dc13f8_ryuk
Size
401KB
MD5
ff55e8a3c61679612d362d3811dc13f8
SHA1
f5d63edaf74fb9732e3981368807ea4df82038d4
SHA256
df398d8f81266d9241f93e457975652b8e6244febef8a315249ca1046cc0b118
SHA512
4fb75cbb19da289572c553d71d20f21217b14bf17d292076439f61c3d28457d8cc3e4a3b1a5298ed74e5416ff14a1a237ffa55c76970c7a424f2995ef997e4cc
SSDEEP
6144:BksOsoPcgQ2YhuQlzHNybt1PMCuIxj9IsKwhQ4vedqEarRohjrVoDP2g:1tokQYYQlzH8h1XuJsrNoJ0eg
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
C:\jenkins\workspace\winagent-release-2-1-0\output\bin\Release\x64\SentinelCleaner.pdb
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateFileW
ExpandEnvironmentStringsW
LocalFree
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetCurrentProcessId
GetModuleHandleExW
FindClose
FindNextFileW
DeleteFileW
GetFileAttributesExW
RemoveDirectoryW
ReadFile
WriteFile
FormatMessageW
FindFirstFileExW
AreFileApisANSI
GetStringTypeW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InterlockedPushEntrySList
RtlPcToFileHeader
RaiseException
RtlUnwindEx
LoadLibraryExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
SetEnvironmentVariableA
ExitProcess
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadConsoleW
WriteConsoleW
DeleteCriticalSection
DecodePointer
GetCurrentThread
GetCurrentProcess
CloseHandle
SetLastError
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetLastError
GetModuleHandleW
GetProcAddress
SetFilePointerEx
GetThreadTimes
GetNativeSystemInfo
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExW
CopySid
GetLengthSid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityInfo
AddAce
InitializeAcl
RegDeleteTreeW
RegDeleteValueW
SetNamedSecurityInfoW
OpenProcessToken
OpenThreadToken
UnloadUserProfile
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ