Static task
static1
Behavioral task
behavioral1
Sample
2024-04-10_e55f534a5a891ec26880355ba73da089_ryuk.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-10_e55f534a5a891ec26880355ba73da089_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-10_e55f534a5a891ec26880355ba73da089_ryuk
-
Size
645KB
-
MD5
e55f534a5a891ec26880355ba73da089
-
SHA1
11fc04690c349c36b5affe298a890993985c8dbc
-
SHA256
f83da4b6907d347a326c62d0a1a75f08ee05741ce1a06e6d4e162e9bffba05bb
-
SHA512
db2dbb2b5dadf7ab6f0ec390153c894bd810a8e17ffd86990d93c2e9090778767789d8d679241e01c07e4882568ebfccde271a4a4c9203c2a6c1cd7871047c51
-
SSDEEP
12288:Q6gKzq9V5rD9aXbjbi4goB7Vdxv5+u2j:+K2LD9aXb3iiXxF2j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-10_e55f534a5a891ec26880355ba73da089_ryuk
Files
-
2024-04-10_e55f534a5a891ec26880355ba73da089_ryuk.exe windows:5 windows x64 arch:x64
9965747fc275b375444ddf02676e2f40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msi
ord173
kernel32
RaiseException
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
GetLocalTime
GetModuleFileNameW
FlushFileBuffers
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
SetThreadLocale
GetSystemDefaultLCID
lstrlenW
CreateThread
DecodePointer
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetExitCodeThread
WaitForSingleObject
OpenProcess
GetExitCodeProcess
CreateProcessW
GetCommandLineW
CreateEventW
SetEvent
GlobalMemoryStatus
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
GetUserDefaultLangID
GetVersionExW
CompareStringW
FindNextFileA
WriteFile
LCMapStringW
GetStringTypeW
GetFileType
GetACP
GetCommandLineA
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
RtlUnwindEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
GetOEMCP
ResetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
ExpandEnvironmentStringsW
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindNextFileW
DeleteFileW
SetLastError
ReadFile
GetFileSize
CreateDirectoryW
GetLastError
FindFirstFileExA
RemoveDirectoryW
GetFullPathNameW
FindFirstFileW
FindClose
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
WriteConsoleW
user32
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetCursor
SetFocus
FillRect
EndPaint
BeginPaint
DestroyWindow
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
GetCursorPos
ScreenToClient
PtInRect
UpdateWindow
InvalidateRect
SetRectEmpty
GetClassNameW
SetWindowLongW
LoadCursorW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
GetDC
ReleaseDC
DrawTextW
OffsetRect
IsWindow
CallWindowProcW
DefWindowProcW
GetWindowLongPtrW
SendMessageW
EndDialog
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
EnableWindow
SetWindowTextW
GetDlgItem
SetWindowLongPtrW
DialogBoxParamW
PeekMessageW
GetActiveWindow
GetMessageW
RegisterWindowMessageW
PostThreadMessageW
UnregisterClassW
CharNextW
SystemParametersInfoW
gdi32
DeleteObject
SetTextColor
CreateFontIndirectW
SelectObject
GetObjectW
GetStockObject
SetBkMode
advapi32
CryptDestroyKey
CryptDestroyHash
CryptAcquireContextW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetServiceStatus
CloseServiceHandle
CryptDeriveKey
CryptCreateHash
CryptReleaseContext
CryptGetHashParam
CryptDecrypt
CryptHashData
shell32
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
oleaut32
VarUI4FromStr
comctl32
_TrackMouseEvent
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ