C:\PROG\HPNotifications\x64\Release\HPNotifications.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_b9890640bd6bf55c05c653042518f32b_ryuk.exe
Resource
win7-20240729-en
General
-
Target
2024-08-05_b9890640bd6bf55c05c653042518f32b_ryuk
-
Size
2.1MB
-
MD5
b9890640bd6bf55c05c653042518f32b
-
SHA1
81404caeda6e6b0304c11a9d899c0023b139e036
-
SHA256
7a8e181e30d97eb0575b355ae2a7493a4b5d5de29348dc885c2564a325005813
-
SHA512
981d5558364cf70192cb20f6fc349f831ae765da5d4e1417568caf1171c6e1f2db8f824d6e8c2199f8f9abe2440ca99563d7d356a06e3efc22991900c30ae071
-
SSDEEP
49152:0Ix5yCn2/zDKEsQc6sa6wvB9r2Oi/WvA+b:0Ib5kzeEsQc6sa6aBC+b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-05_b9890640bd6bf55c05c653042518f32b_ryuk
Files
-
2024-08-05_b9890640bd6bf55c05c653042518f32b_ryuk.exe windows:6 windows x64 arch:x64
f17f66b3a9c8c933f6ff6185f5042510
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
wtsapi32
WTSRegisterSessionNotification
kernel32
GetUserDefaultLCID
GetTempPathW
Sleep
SetEvent
CreateEventW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
DeviceIoControl
WaitForSingleObject
WaitForMultipleObjects
InitializeCriticalSectionEx
DecodePointer
lstrlenA
GlobalAlloc
GlobalFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RaiseException
GetCurrentProcess
FindResourceExW
FindResourceW
LoadResource
CloseHandle
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
SetEndOfFile
WriteConsoleW
SetFilePointerEx
GetCurrentDirectoryW
ReadConsoleW
ReadFile
FlushFileBuffers
SetStdHandle
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
CreateThread
GetLastError
CreateMutexW
VerifyVersionInfoW
LockResource
HeapDestroy
GetModuleHandleW
GetProcAddress
TlsFree
FreeLibrary
LoadLibraryExW
VerSetConditionMask
GetConsoleMode
GetConsoleCP
GetDriveTypeW
GetStringTypeW
GetFileType
FreeLibraryAndExitThread
ExitThread
GetACP
GetModuleHandleExW
ExitProcess
RtlUnwindEx
EncodePointer
RtlPcToFileHeader
LocalFree
CompareStringW
WriteFile
QueryUnbiasedInterruptTime
SetLastError
MoveFileW
GetStdHandle
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetLocalTime
CreateDirectoryW
ReleaseMutex
GetFileAttributesExW
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
GetTempFileNameW
user32
LoadAcceleratorsW
LoadIconW
LoadStringW
GetMessageW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
DialogBoxParamW
PostMessageW
DefWindowProcW
PostQuitMessage
SetPropW
GetWindowLongPtrW
SetWindowTextW
GetParent
SetWindowLongPtrW
CallWindowProcW
MessageBoxW
SetCursor
ReleaseCapture
PtInRect
ClientToScreen
GetWindowRect
SetCapture
InvalidateRect
GetCapture
RemovePropW
GetPropW
EndDialog
GetSysColorBrush
GetDlgCtrlID
SetForegroundWindow
SendDlgItemMessageW
SendMessageW
SetDlgItemTextW
GetDlgItem
LoadImageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
gdi32
GetObjectW
CreateFontIndirectW
DeleteObject
SetBkMode
SetTextColor
advapi32
CloseEventLog
ReadEventLogW
OpenEventLogW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
ShellExecuteW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ole32
CoSetProxyBlanket
CLSIDFromProgID
CoInitializeEx
CoInitializeSecurity
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
GetErrorInfo
VariantChangeType
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysStringLen
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
CM_Get_Parent
CM_Get_Device_IDW
SetupDiGetDeviceRegistryPropertyW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Sections
.text Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE