Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_3e36420a812955eeccf9529591d5b773_ryuk.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-05_3e36420a812955eeccf9529591d5b773_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_3e36420a812955eeccf9529591d5b773_ryuk
-
Size
1.6MB
-
MD5
3e36420a812955eeccf9529591d5b773
-
SHA1
792151772106bde1e2a5d9bae3e38ab5ccb5a6e6
-
SHA256
bc512addfa528945765b2f2b7698ac666229a6c78399bc3a0230048b83156894
-
SHA512
7eb93fddf178182a7b7f833d2e578ec4956abc8811976a091de35db4d9567cbdaa9d6eb4296d9404141b5d6fc4e446cf9ea71be2e7568f25c152c0404863be6d
-
SSDEEP
24576:0divjS8NHTiMQ15+1sqjnhMgeiCl7G0nehbGZpbD:cive8NHTcipDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-05_3e36420a812955eeccf9529591d5b773_ryuk
Files
-
2024-08-05_3e36420a812955eeccf9529591d5b773_ryuk.exe windows:6 windows x64 arch:x64
0c0b093f48ddf6253912e4158b12951a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateDirectoryW
SetFileAttributesW
CreateProcessW
GetSystemDirectoryW
lstrlenW
OpenEventW
WaitForMultipleObjects
IsDebuggerPresent
OutputDebugStringW
CreateFileW
WriteConsoleW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetCurrentDirectoryW
MultiByteToWideChar
WTSGetActiveConsoleSessionId
GetSystemPowerStatus
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetTickCount
GetCurrentThreadId
GetCurrentThread
CreateThread
GetCurrentProcess
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
CloseHandle
DecodePointer
ReadFile
CreateFileA
GetCommandLineW
GlobalFree
GlobalLock
IsValidCodePage
FindNextFileW
SetEndOfFile
FindFirstFileExW
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetACP
GetModuleHandleExW
ExitProcess
WriteFile
GetStdHandle
DeleteFileW
RtlPcToFileHeader
GlobalUnlock
GlobalAlloc
SetLastError
GetLastError
RtlUnwindEx
GetCPInfo
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
WideCharToMultiByte
GetStringTypeW
user32
CharNextW
MessageBoxW
LoadStringW
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterDeviceNotificationW
UnregisterDeviceNotification
advapi32
GetLengthSid
OpenThreadToken
CopySid
GetTokenInformation
SetSecurityDescriptorDacl
StartServiceW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
IsValidSid
InitializeSecurityDescriptor
OpenProcessToken
ole32
CoInitializeEx
CoUninitialize
CoRegisterClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
PropVariantClear
CoRevokeClassObject
oleaut32
RegisterTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
UnRegisterTypeLi
SysAllocStringLen
VarBstrCat
SysAllocString
shlwapi
PathFileExistsW
gdi32
D3DKMTCloseAdapter
D3DKMTEscape
D3DKMTOpenAdapterFromDeviceName
setupapi
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiOpenDevRegKey
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
wtsapi32
WTSQueryUserToken
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE