z:\build\build\src\obj-firefox\toolkit\mozapps\update\updater\updater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-24_d30a71ae6291d4d272c299812ed321ad_ryuk.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-24_d30a71ae6291d4d272c299812ed321ad_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-24_d30a71ae6291d4d272c299812ed321ad_ryuk
-
Size
903KB
-
MD5
d30a71ae6291d4d272c299812ed321ad
-
SHA1
113cc9f94db73607ce2335c5e8ef838c1b60e59f
-
SHA256
67896b01a01e4d623d75a0a292760c5e9fe6ff688a4434c17bc077949933ae09
-
SHA512
3ac4ad4ebc986f2763895f7e88e3158785677145ee28bf6639914e6b5bc19772c4e7f609dec70aa220e43a6572907410bda9a4f959b5cccc98556a01dbbc0204
-
SSDEEP
24576:tW2h+zSDeFJ+R+sqjnhMgeiCl7G0nehbGZpbD:QzBwSDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-24_d30a71ae6291d4d272c299812ed321ad_ryuk
Files
-
2024-08-24_d30a71ae6291d4d272c299812ed321ad_ryuk.exe windows:6 windows x64 arch:x64
f53a16027ff4ff5daf39579c580aaf47
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateProcessW
CopyFileW
WideCharToMultiByte
GetTempFileNameW
LocalAlloc
SetLastError
GetCurrentProcess
FreeLibrary
GetFullPathNameW
DeleteFileW
MoveFileW
WriteFile
GetDriveTypeW
GetTimeZoneInformation
MoveFileExW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
FlushFileBuffers
SetFilePointerEx
LCMapStringW
UnlockFile
LocalFree
CloseHandle
GetLastError
FormatMessageW
GetPrivateProfileStringW
OpenProcess
GetFileAttributesW
CreateFileW
WaitForSingleObject
FindClose
SetEndOfFile
SetFilePointer
LockFile
GetLongPathNameW
FindNextFileW
FindFirstFileW
Sleep
MultiByteToWideChar
DeactivateActCtx
GetModuleFileNameW
ActivateActCtx
CreateActCtxW
LoadLibraryExW
SetDllDirectoryW
GetModuleHandleW
GetProcAddress
WriteConsoleW
GetSystemDirectoryW
CompareStringW
ReadConsoleW
HeapSize
GetConsoleMode
GetConsoleCP
GetStringTypeW
HeapAlloc
HeapFree
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
CreateDirectoryW
SetStdHandle
RemoveDirectoryW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFileAttributesW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
ReadFile
ExitProcess
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
user32
OffsetRect
wsprintfW
GetWindowRect
GetDC
SetWindowPos
SetWindowLongPtrW
ReleaseDC
SendMessageW
EndDialog
SetWindowTextW
GetWindowLongPtrW
ScreenToClient
SetTimer
CopyRect
LoadIconW
GetClientRect
GetDlgItem
DrawTextW
GetDesktopWindow
GetParent
DialogBoxParamW
gdi32
SelectObject
advapi32
OpenSCManagerA
StartServiceW
QueryServiceConfigW
OpenServiceW
QueryServiceStatusEx
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
RegQueryInfoKeyW
RegEnumKeyExW
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptDestroyKey
CryptVerifySignatureA
CryptAcquireContextA
CryptCreateHash
CryptHashData
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
CloseServiceHandle
wintrust
WinVerifyTrust
shell32
ShellExecuteExW
shlwapi
PathIsUNCServerShareW
PathCanonicalizeW
PathStripToRootW
PathRemoveFileSpecW
PathAppendW
PathUnquoteSpacesW
PathCommonPrefixW
Sections
.text Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE