D:\Workspace\sgorenbo\9.5_COMMON\SW\Src\Apps\PAVP2\PAVP30\IntelCpHeciSvc\x64\Release\IntelCpHeciSvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_be35ea2b1a7e282ee197088977c47ed8_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-12_be35ea2b1a7e282ee197088977c47ed8_ryuk.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_be35ea2b1a7e282ee197088977c47ed8_ryuk
-
Size
1.0MB
-
MD5
be35ea2b1a7e282ee197088977c47ed8
-
SHA1
10d8e2047af9b6fbca109e30b0c02cf037d1b2ae
-
SHA256
c69a4909723654d7d5c3c503350e20451f8395558e0de6a4f2da1038c554aed8
-
SHA512
90b9b07d4d4330f87736ff71f4798adf3be66c33d7087c95f5244947e8ab7ce2af2f56173cf96c548fbd0384d41c2906a6e5b2b150c617b1d13d33a38f891bee
-
SSDEEP
24576:VMA7qf/ccqNgPgcfSLexL2gyX6WH1Mr3nQzh:VMAWpqNoNfSsLUX6WH1aUh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_be35ea2b1a7e282ee197088977c47ed8_ryuk
Files
-
2024-06-12_be35ea2b1a7e282ee197088977c47ed8_ryuk.exe windows:6 windows x64 arch:x64
6f5c0db94888579840ca838fd2a3500d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
setupapi
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
kernel32
ReadFile
WriteFile
GetOverlappedResult
DeviceIoControl
GetCommandLineW
DecodePointer
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentThread
LocalFree
WriteConsoleW
ReadConsoleW
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
Sleep
MultiByteToWideChar
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
OpenProcess
ResumeThread
CreateThread
CreateEventW
WaitForMultipleObjectsEx
WaitForSingleObject
SetEvent
InitializeCriticalSectionEx
GetLastError
RaiseException
SetEndOfFile
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
ExpandEnvironmentStringsW
ExitThread
FreeLibraryAndExitThread
SetStdHandle
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
RtlUnwindEx
IsValidLocale
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetACP
GetStdHandle
ExitProcess
HeapReAlloc
RtlPcToFileHeader
OutputDebugStringW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
WideCharToMultiByte
GetStringTypeW
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleExW
user32
RegisterDeviceNotificationW
UnregisterDeviceNotification
LoadStringW
RegisterWindowMessageW
GetMessageA
GetMessageW
TranslateMessage
DispatchMessageA
DispatchMessageW
PeekMessageW
PostThreadMessageW
CharUpperW
MsgWaitForMultipleObjectsEx
IsWindowUnicode
MessageBoxW
CharNextW
advapi32
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExA
RegQueryValueExA
RegOpenKeyW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeAbsoluteSD
IsValidSid
InitializeSecurityDescriptor
GetTokenInformation
GetSecurityDescriptorLength
GetLengthSid
CopySid
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
oleaut32
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
VariantClear
VariantInit
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayRedim
SafeArrayDestroy
SafeArrayCreate
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
Sections
.text Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE