D:\jkp\workspace\INS_TOOLS_DRV_P4\11\INS_TOOLS_DRV0177\Source\InsToolsDrv\install_coms\wifi_drv_inst\x64\Release\SetupWLD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_120a02b6cc1652a0a8d986f6639665c8_ryuk.exe
Resource
win7-20240704-en
General
-
Target
2024-08-20_120a02b6cc1652a0a8d986f6639665c8_ryuk
-
Size
5.8MB
-
MD5
120a02b6cc1652a0a8d986f6639665c8
-
SHA1
2a125d9ead45f92af18e584bccd36addcf07f3c0
-
SHA256
2dcd2f8947eef022fd52d16312a6c68f1f9e853c6a5843b2f73a1f041d2ee2f9
-
SHA512
a8afe14f2ef55c0e59bcce12adadcae1936ceb6db49ed064ee6258dd188c8c9ac9a1f992ebff125d408b816dc36f61a51364491f47d81faf63d144b2d9608422
-
SSDEEP
49152:K8Byu1EKqSG9ia6rpGX77sMmk6yZ03KL7ple+R5KtswC1YERhFJ7MEo3sKIefpfe:Ykp4EMsyS3O1lj5Kt/hERl7u8KlfNcv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-20_120a02b6cc1652a0a8d986f6639665c8_ryuk
Files
-
2024-08-20_120a02b6cc1652a0a8d986f6639665c8_ryuk.exe windows:6 windows x64 arch:x64
e2b18724efa606d34b9e55e331e355b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
cfgmgr32
CM_Reenumerate_DevNode
CM_Locate_DevNodeA
shlwapi
StrFormatKBSizeA
PathStripToRootA
PathIsUNCA
PathRemoveExtensionA
PathFindExtensionA
PathRemoveFileSpecW
PathAddBackslashA
PathAppendA
PathFileExistsA
PathFindFileNameA
userenv
GetProfilesDirectoryA
kernel32
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
WriteConsoleW
FindNextFileW
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
GetTimeZoneInformation
GetStringTypeW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetFileAttributesExW
MoveFileExW
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetTimeFormatW
GetStartupInfoW
GetStdHandle
ExitProcess
QueryPerformanceFrequency
HeapQueryInformation
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualQuery
VirtualAlloc
UnhandledExceptionFilter
GetCommandLineW
GetCommandLineA
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFullPathNameW
GetDriveTypeW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
OutputDebugStringW
IsDebuggerPresent
IsProcessorFeaturePresent
GetDateFormatW
SetUnhandledExceptionFilter
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
SetFileAttributesA
CloseHandle
WaitForSingleObject
CreateMutexA
Sleep
TerminateProcess
GetCurrentThread
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
LocalUnlock
LocalLock
ReplaceFileA
GetDiskFreeSpaceA
SearchPathA
GetProfileIntA
GetTickCount
GetTempFileNameA
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
SetErrorMode
FindResourceExW
SystemTimeToTzSpecificLocalTime
SetFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
GetStringTypeExA
GetVolumeInformationA
MoveFileA
GetShortPathNameA
LoadLibraryExA
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
CreateFileA
GetACP
GetCPInfo
GetOEMCP
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GlobalFlags
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
GetAtomNameA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
ResumeThread
SuspendThread
SetThreadPriority
CreateEventA
SetEvent
GetModuleFileNameA
GetCurrentProcessId
CompareStringA
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
LoadLibraryW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleW
GetModuleFileNameW
FreeResource
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
MultiByteToWideChar
FormatMessageA
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SetLastError
K32GetModuleFileNameExA
K32EnumProcessModules
GetWindowsDirectoryA
GetExitCodeProcess
OutputDebugStringA
GetCurrentDirectoryA
SetCurrentDirectoryA
lstrcpyA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetUserDefaultLCID
GetSystemDefaultLangID
WideCharToMultiByte
GetSystemPowerStatus
CopyFileA
FindResourceExA
FindResourceW
LoadLibraryA
lstrlenA
lstrcpynA
OpenProcess
lstrcmpiA
lstrcmpA
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleA
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetSystemInfo
CreateProcessA
user32
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
GetMenuDefaultItem
CreatePopupMenu
LoadImageW
TrackMouseEvent
CharUpperA
DestroyIcon
InvalidateRect
KillTimer
SetTimer
DeleteMenu
GetDialogBaseUnits
MapDialogRect
GetAsyncKeyState
OffsetRect
SetRectEmpty
CopyImage
RealChildWindowFromPoint
IntersectRect
LoadCursorA
GetSysColorBrush
SystemParametersInfoA
InflateRect
GetMenuItemInfoA
DestroyMenu
SetCursor
ShowOwnedPopups
PostQuitMessage
GetCursorPos
GetMessageA
MapVirtualKeyA
GetKeyNameTextA
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
IsWindowEnabled
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
CallNextHookEx
SetWindowsHookExA
GetLastActivePopup
GetClassLongPtrA
GetClassLongA
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
GetWindowLongA
PtInRect
EqualRect
CopyRect
MapWindowPoints
MessageBoxA
AdjustWindowRectEx
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
DrawFocusRect
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
CopyIcon
FrameRect
UnionRect
SendMessageA
UnregisterClassA
EnableWindow
GetClientRect
GetWindowRect
GetDlgCtrlID
GetDlgItem
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
LoadBitmapW
GetParent
wsprintfA
TranslateMessage
IsRectEmpty
LoadImageA
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
LoadCursorW
NotifyWinEvent
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongPtrA
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetWindowRgn
DispatchMessageA
PeekMessageA
ExitWindowsEx
MsgWaitForMultipleObjects
GetDesktopWindow
PostMessageA
FlashWindow
IsIconic
GetSystemMetrics
GetSystemMenu
AppendMenuA
DrawIcon
GetClassNameA
GetTopWindow
GetWindowThreadProcessId
GetWindow
LoadIconW
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
RemoveMenu
UnhookWindowsHookEx
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetDC
GetWindowDC
ReleaseDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
FillRect
GetFocus
CheckMenuItem
DrawStateA
DrawEdge
DrawFrameControl
IsZoomed
LoadMenuW
SetCursorPos
BringWindowToTop
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
GetMenuBarInfo
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetTabbedTextExtentW
GetTabbedTextExtentA
GetDCEx
DestroyCursor
GetKeyboardState
WindowFromDC
CreateMenu
InSendMessage
SendNotifyMessageA
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
EnumChildWindows
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffA
RegisterClipboardFormatA
ModifyMenuA
GetDoubleClickTime
SetMenuDefaultItem
LockWindowUpdate
SetRect
CopyAcceleratorTableA
DestroyAcceleratorTable
CreateAcceleratorTableA
LoadAcceleratorsW
ValidateRect
ToAsciiEx
gdi32
CreateRectRgn
CopyMetaFileA
CreateDCA
GetDeviceCaps
BitBlt
CreateBitmap
CreateCompatibleDC
CreateDIBPatternBrushPt
CreateHatchBrush
CreatePen
CreatePatternBrush
DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkColor
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextColor
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
GetObjectA
MoveToEx
TextOutA
ExtTextOutA
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CreateFontIndirectA
GetTextExtentPoint32A
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetTextMetricsA
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
GetDIBits
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
CreateFontA
GetCharWidthA
StretchDIBits
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
CreateSolidBrush
msimg32
AlphaBlend
TransparentBlt
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
GetJobA
advapi32
SystemFunction036
AdjustTokenPrivileges
AllocateAndInitializeSid
GetFileSecurityA
SetFileSecurityA
RegOpenKeyExW
RegQueryValueA
RegEnumKeyA
RegSetValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
LookupPrivilegeValueA
ImpersonateSelf
FreeSid
CheckTokenMembership
OpenThreadToken
shell32
SHBrowseForFolderA
SHGetFolderPathA
SHAddToRecentDocs
ExtractIconA
SHGetFileInfoA
SHGetPathFromIDListA
SHAppBarMessage
DragFinish
DragQueryFileA
ShellExecuteExA
SHGetMalloc
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
uxtheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetThemePartSize
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
ole32
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CLSIDFromProgID
CoRegisterMessageFilter
OleRegGetMiscStatus
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
CreateGenericComposite
CreateItemMoniker
WriteClassStm
OleCreate
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
CreateILockBytesOnHGlobal
CreateFileMoniker
StgIsStorageFile
StgOpenStorageOnILockBytes
OleSave
OleSaveToStream
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
PropVariantCopy
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromString
CoDisconnectObject
StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
OleSetContainedObject
OleGetIconOfClass
GetHGlobalFromILockBytes
OleRun
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
oleaut32
LoadRegTypeLi
RegisterTypeLi
SysStringLen
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetUBound
LoadTypeLi
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
SysAllocString
SysAllocStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantInit
SafeArrayGetLBound
VariantChangeType
VariantClear
oledlg
ord8
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
gdiplus
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
winmm
PlaySoundA
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 644KB - Virtual size: 648KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE