Overview

overview

7

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2024 01:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-07_8d2ef4f6ad35f95ffbbb12f4b482631b_ryuk.exe

  • Size

    13.7MB

  • MD5

    8d2ef4f6ad35f95ffbbb12f4b482631b

  • SHA1

    16b56befb0e23866b0fc55c7e0105f97b6c67094

  • SHA256

    c45332a8a375aed775e1f5399d74c318cd874efa9941ec7dab8ef9f0ec1997b4

  • SHA512

    4a44dd201b8c66c1e45632b545e5fac9ff8998ee01e59a8e51e87eafd106a8c6a147f10fef152ed4fb39bceb52e0074e37bd2cd35953f41f57986e46f7f86454

  • SSDEEP

    393216:R4nVzt+SC8d9vqZQCBBGStN3ZWqDzTGfb4:RyztlCl1TVtN3VP

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Loads dropped DLL 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_8d2ef4f6ad35f95ffbbb12f4b482631b_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_8d2ef4f6ad35f95ffbbb12f4b482631b_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_8d2ef4f6ad35f95ffbbb12f4b482631b_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_8d2ef4f6ad35f95ffbbb12f4b482631b_ryuk.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\VCRUNTIME140.dll
    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\_ctypes.pyd
    Filesize

    130KB

    MD5

    985d2c5623def9d80d1408c01a8628be

    SHA1

    317c298cb2e1728f9c7f14de2f7764c9861be101

    SHA256

    7257178f704cd43e68cd7bc80f9814385b2e5d4f35d6e198ae99dce9f4118976

    SHA512

    be6a9d3465a5e00e6752a4b681fb8ef75126b132965624d4373b8817d68ed11337b068034ebedcfe59fb9486b86a03e67e81badc29375a776f366bf7f834f0dc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\_tkinter.pyd
    Filesize

    65KB

    MD5

    d6ff505bd63d587563bd919e68b5ef34

    SHA1

    a1cf80cadd3ba777ff95ab0e3476e0bee6e24190

    SHA256

    03abcedc663f2f77ba93ca6ff2fcd71b3ad3b4cb7563f0a22a613ed827b08eb7

    SHA512

    0e997c3f45dbfc1d31b220047891d1504561ce50e8b693b8976fb0ddd17bea5ce07f9c788fe7d453af081c8c809c876dcc798ab3fc5c03b1f560b424317e94fd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    07aa9916d3383d7e040a88665a6df67f

    SHA1

    549c5cd800dc3b51ffb552333777d92cddfb299d

    SHA256

    650555a4c89bfa77054e453ea61f2fe9f095f15a13629f964b903ec7fc07dd12

    SHA512

    d4c70acb84004d27cfe5db22dddccd90217f95d6d2425bbe4359f318056817b669c98907e2679111c49ccf0321011a60cac88c7156566e825b1ea9b1a12e2189

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    966f1686b72929b452c7c0999791d42f

    SHA1

    20961fd566d789b5657f65595c3a39622c569a22

    SHA256

    2f7553fc7b0e511813ef7639cab9b2466348eeb78ffc534a12e2e271af8e7ce8

    SHA512

    b427eea99d197889e4a4b8801a45baebd20824983f38794ef0e81723c9592c28d75f39744691f650e220208e5f072d61470add4fc99221383e0a89369de5ab93

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    13KB

    MD5

    3c40a9d1ae0b5e72b2f90761a0fd49cf

    SHA1

    567282eedcb721a7137dde2f135704a50f3cd883

    SHA256

    91c4f107fe8e8c902728e131672bd6953d94964b7a0f1edcc004ae5f471a2a42

    SHA512

    d8f69f1c6ea2837e56c98a2591dbd3a336c40e2ad0af45550406cd00c70fbbc3d7c7594509bef4418aa45e0faf0cb7ce739e6e986ab505b4cd32ce595c236243

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    25cd5a26ea59e6f4c082b8945b16fc3a

    SHA1

    851ea9bfebbbc901edc98f928d59fb03d15a0037

    SHA256

    093b7168f6b64c655464d9bbf51bbc29456772ff747763c112ed206e023c69cf

    SHA512

    dc001828c40e4a85791644d100eea7132951b2644b59f7f147f17feac515d405313289d5aafbf147ffb1913ce855a501ae79acf832c32ed08d348352c80e9cf3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    cf403b7b90696ab2ded707ffdea27112

    SHA1

    8d25084c7d24143cf95303bfa0654a42d9cb0ca2

    SHA256

    f5f5e3cfa9237bb04bd485f28cecd07892212335648d32e9e3e1b248784baeb6

    SHA512

    0004a31e0982fc4007c7fdaf0d06b6d3a19dc35ca00feeb8f161b62695b063bb07fb409c0926a1f95a4698ca57c22f773d9a431eee586633b075366de0cbacca

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-conio-l1-1-0.dll
    Filesize

    12KB

    MD5

    ed14b64c94f543974b7fdc592fa0594b

    SHA1

    dc66ca3de44c021d89ebd5160c447aaedc565514

    SHA256

    9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c

    SHA512

    5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    15KB

    MD5

    1908861649e67cdc20c563c234a89914

    SHA1

    471ae3b9a3b40e63c880362892865ecf8bd80f67

    SHA256

    4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449

    SHA512

    dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-environment-l1-1-0.dll
    Filesize

    11KB

    MD5

    af851dfd0d9fecb76ff2b403f3c30f5b

    SHA1

    30f79fb4d4c91af847963c46882d095d1f42efbe

    SHA256

    6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda

    SHA512

    04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    13KB

    MD5

    0f143310fade4de116070a3917a79c18

    SHA1

    b9a092e885c73cb6d33c9e17d429ede950cf3a26

    SHA256

    2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a

    SHA512

    f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    12KB

    MD5

    f97e7878a2b372291b1269d80327bbf6

    SHA1

    cee6f776fe0aa5a6d4854058f20f675253f48998

    SHA256

    c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6

    SHA512

    475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    11KB

    MD5

    761ddd8669a661d57d9cf9c335949c06

    SHA1

    251bbcad15771d80492f1deb001491a7abb6c563

    SHA256

    fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3

    SHA512

    5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    20KB

    MD5

    56556659c691dd043dbe24b0a195d64c

    SHA1

    117b9a201d1e8bb9e5fadeae808141d3fa41fb60

    SHA256

    2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1

    SHA512

    a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-process-l1-1-0.dll
    Filesize

    12KB

    MD5

    6631c212f79350458589a5281374b38b

    SHA1

    88be6865aac123ffbdafec32a6fba34a26428875

    SHA256

    52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649

    SHA512

    e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    15KB

    MD5

    bbae7b5436d6d1b0fc967ff67e35415f

    SHA1

    f67bc165cefb119ad767b6bec27a1102c0fd2bac

    SHA256

    8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f

    SHA512

    4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    17KB

    MD5

    53e9526af1fdce39f799bfe9217397a8

    SHA1

    f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144

    SHA256

    de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f

    SHA512

    8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    17KB

    MD5

    eccf5973b80d771a79643732017cea9a

    SHA1

    e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c

    SHA256

    038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333

    SHA512

    b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-time-l1-1-0.dll
    Filesize

    13KB

    MD5

    090dd0bb2bddee3eaae5b6ff15fae209

    SHA1

    ddc5ac01227970a4925a08f29ba65eb10344edb1

    SHA256

    957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e

    SHA512

    2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\base_library.zip
    Filesize

    766KB

    MD5

    b98a0749df633f97dd01217b8f561677

    SHA1

    223ff87c62c3cf6fc390f409b1c8bccbab0ea637

    SHA256

    c7043132a47fb7daf6989229fafb1826eca444cc55438a9d3c2f91c7f435f10b

    SHA512

    d111514305028b0675c6b8a66d783e133ea716cf27e2a8e5c5e4285ee68fae680e14e2e954e14fb304d3b5cb271240b8bd54cd558362af93d30bc061af7c1f7a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\libcrypto-1_1-x64.dll
    Filesize

    2.4MB

    MD5

    8c75bca5ea3bea4d63f52369e3694d01

    SHA1

    a0c0fd3d9e5688d75386094979171dbde2ce583a

    SHA256

    8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

    SHA512

    6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\python37.dll
    Filesize

    3.6MB

    MD5

    28f9065753cc9436305485567ce894b0

    SHA1

    36ebb3188a787b63fb17bd01a847511c7b15e88e

    SHA256

    6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

    SHA512

    c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI16762\ucrtbase.dll
    Filesize

    961KB

    MD5

    2381e189321ead521ff71e72d08a6b17

    SHA1

    0db7fea07b4bc14f0f9d71ecfa6ddf3097229875

    SHA256

    4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806

    SHA512

    2d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\_bz2.pyd
    Filesize

    87KB

    MD5

    429ad9f0d7240a1eb9c108b2d7c1382f

    SHA1

    f54e1c1d31f5dd6698e47750daf48b9291b9ea69

    SHA256

    d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

    SHA512

    bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\_hashlib.pyd
    Filesize

    38KB

    MD5

    d61618c28373d7bbdf1dec7ec2b2b1c1

    SHA1

    51f4bab84620752aedf7d71dcccb577ed518e9fd

    SHA256

    33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

    SHA512

    ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\_lzma.pyd
    Filesize

    251KB

    MD5

    5e7a6b749a05dd934ee4471411420053

    SHA1

    fcd1e54011b98928edbb3820a5838568b9573453

    SHA256

    4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

    SHA512

    ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\_socket.pyd
    Filesize

    74KB

    MD5

    7c5c5e6e4ed888dd26c7aa063bb9f88e

    SHA1

    a7a3694739b27c3d34beb1a9730fc3dcbae6744a

    SHA256

    2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

    SHA512

    9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\_ssl.pyd
    Filesize

    120KB

    MD5

    a3c9649e68206c25eff2d09a0bd323f0

    SHA1

    0f485f37ac3960da624b80667410061efe1f888d

    SHA256

    b9100db5d225c4103f781a6ea4074ce76387467c3a4bba2ac5bfc65870ab6123

    SHA512

    aeef27bf73cb7dd96b06c3403fc74c108a8a7d80aa25db35a4b1a96b8931aef63b3037a9a51075ead1e5ad1c001d6afe6f3c3e19af30344177fd562751b00d63

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\api-ms-win-crt-utility-l1-1-0.dll
    Filesize

    11KB

    MD5

    cc337898e64d9078cb697ac19f995c7f

    SHA1

    2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c

    SHA256

    e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18

    SHA512

    6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\libssl-1_1-x64.dll
    Filesize

    511KB

    MD5

    0205c08024bf4bb892b9f31d751531a0

    SHA1

    60875676bc6f2494f052769aa7d644ef4a28c5e5

    SHA256

    ebe7ffc7eb0b79e29bfc4e408ea27e9b633584dd7bc8e0b5ffc46af19263844b

    SHA512

    45da0c128bfb706cb0340ad40fbc691696f3483a0235faaac864dea4580b57e36aa5b4b55a60322081d2d2e2df788c550fd43c317582a9b6a2d66712df215bd0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\pyexpat.pyd
    Filesize

    195KB

    MD5

    a045432966523928d20b7dce4537c776

    SHA1

    0869868b4548ec7b0bddf7539b6022185bc3f6da

    SHA256

    d4ca4589c6c8ff5a9f71da2f63c1d214bfeb8662375b42ee201b7c9e07c586a6

    SHA512

    bdab5104b9cc278608cdc6662f38855c3a7c348d372034790c120209cbdf9730bbcece9dd1a59f8060d3dc29f5f193b988c9273b6eec5987bddc94cc28a9bc9b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI16762\select.pyd
    Filesize

    26KB

    MD5

    1650617f3378c5bd469906ae1256a54c

    SHA1

    dd89ffd426b6820fd79631e4c99760cb485d3a67

    SHA256

    5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

    SHA512

    89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

    Download Submit