Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_771dc18a75dc9e869904e2f75ce448de_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-10_771dc18a75dc9e869904e2f75ce448de_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-10_771dc18a75dc9e869904e2f75ce448de_ryuk
-
Size
2.0MB
-
MD5
771dc18a75dc9e869904e2f75ce448de
-
SHA1
521cdc10999fbacd3a353d5d00cfe0c581654266
-
SHA256
194c6294b5019077c50e8705d2b54307699d5154ad5af048d83d9fd751cedf70
-
SHA512
017c89ee63ee05acfc95a4002ecee639691640bf6adc7fad098b0480d53d219305d6609d2921572645615aba3f8dd8b239f64f970143acaccbdf6e89ae05bd29
-
SSDEEP
49152:Jh0k2E5gshrUjwyReUQOfx5iPdKTKeyPs6525Dnr9C:H0egsiQOk0fVln
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-10_771dc18a75dc9e869904e2f75ce448de_ryuk
Files
-
2024-03-10_771dc18a75dc9e869904e2f75ce448de_ryuk.exe windows:6 windows x64 arch:x64
0c83407b686e180e0c6875f827f7777e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteConsoleW
GetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
GetProcessHeap
ReadConsoleW
GetSystemInfo
VirtualQuery
LoadLibraryExA
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
SetEndOfFile
GetUserDefaultLangID
CreateDirectoryW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
GetVersionExW
MultiByteToWideChar
GetNativeSystemInfo
LoadLibraryW
GetProcAddress
VerSetConditionMask
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
VerifyVersionInfoW
CreateDirectoryA
WaitForSingleObject
GetCurrentThreadId
GetExitCodeThread
GetConsoleMode
SetEvent
CloseHandle
ResetEvent
OpenThread
SetThreadAffinityMask
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SystemTimeToFileTime
GetModuleHandleW
GetSystemTime
GetProcessTimes
WaitForMultipleObjects
CreateEventW
SizeofResource
GetModuleFileNameW
GetProcessId
GetModuleHandleA
K32GetProcessMemoryInfo
LockResource
GetProcessIoCounters
LoadResource
FindResourceW
GetThreadTimes
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
SetHandleInformation
CreatePipe
CreateProcessW
GetPrivateProfileStringA
FormatMessageW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
Sleep
EncodePointer
GetCPInfo
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
SwitchToThread
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
LoadLibraryExW
SetThreadErrorMode
GetModuleHandleExW
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
OutputDebugStringA
SetErrorMode
FormatMessageA
K32GetModuleBaseNameA
InitializeCriticalSection
CreateFileA
DeleteFileA
GetFileAttributesA
ReadFile
SetFileAttributesA
WriteFile
LocalAlloc
LocalFree
GetThreadPriority
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
GetACP
SetConsoleCtrlHandler
GetFullPathNameW
GetFullPathNameA
SetStdHandle
GetFileType
HeapAlloc
HeapFree
ExitThread
HeapReAlloc
ExitProcess
GetCommandLineA
GetCommandLineW
CreateFileW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
SetFilePointerEx
HeapSize
user32
WaitForInputIdle
GetSystemMetrics
GetClientRect
WindowFromPoint
shell32
FindExecutableW
SHGetKnownFolderPath
ShellExecuteW
winmm
timeEndPeriod
timeBeginPeriod
shlwapi
PathFindFileNameW
PathIsUNCW
PathRemoveFileSpecW
PathFileExistsW
PathStripToRootW
PathIsRelativeA
PathIsDirectoryW
PathFindExtensionW
PathIsRelativeW
PathCombineW
d3d11
D3D11CreateDevice
dxgi
CreateDXGIFactory
d3d9
Direct3DCreate9Ex
dxva2
DXVA2CreateDirect3DDeviceManager9
avifil32
AVIFileGetStream
AVIFileInfoW
AVIFileExit
AVIStreamGetFrameOpen
AVIFileInit
AVIStreamGetFrameClose
AVIStreamRead
AVIStreamInfoW
AVIFileRelease
AVIFileOpenW
AVIStreamGetFrame
AVIStreamRelease
advapi32
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclA
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 611KB - Virtual size: 611KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ