Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/03/2025, 01:30
Behavioral task
behavioral1
Sample
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
-
Size
11.5MB
-
MD5
8099f355d023f687efab26a1323977c7
-
SHA1
6839dd1d3b1c92ee02df1a9daa0771b83ab1a983
-
SHA256
bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9
-
SHA512
7afade18da1755a3811b8cf0ea980077896e67eb2523bea2bb874c34d0ad076933ebfb6c12cd5dea2f33e86101544c8a77f025a58c2fff6ccd1287debd9da314
-
SSDEEP
196608:aPXLYgk+yA9//qt++3HF9onJ5hrZEE3e9tGPqKM48RmU/3ZlsPvpEbPCTbPKRTvI:aY+Cl9c5hlEE/PNMtN3ZWqDC3PuTZU
Malware Config
Extracted
C:\Users\Admin\Desktop\README.txt
demonware
https://keys.zeznzo.nl
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL 54 IoCs
pid Process 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2516 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2516 2472 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 31 PID 2472 wrote to memory of 2516 2472 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 31 PID 2472 wrote to memory of 2516 2472 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD589a24c66e7a522f1e0016b1d0b4316dc
SHA15340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42
SHA2563096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
SHA512e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a
-
Filesize
92KB
MD5cf77513525fc652bad6c7f85e192e94b
SHA123ec3bb9cdc356500ec192cac16906864d5e9a81
SHA2568bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
SHA512dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9
-
Filesize
68KB
MD509f66528018ffef916899845d6632307
SHA1cf9ddad46180ef05a306dcb05fdb6f24912a69ce
SHA25634d89fe378fc10351d127fb85427449f31595eccf9f5d17760b36709dd1449b9
SHA512ed406792d8a533db71bd71859edbb2c69a828937757afec1a83fd1eacb1e5e6ec9afe3aa5e796fa1f518578f6d64ff19d64f64c9601760b7600a383efe82b3de
-
Filesize
11KB
MD507aa9916d3383d7e040a88665a6df67f
SHA1549c5cd800dc3b51ffb552333777d92cddfb299d
SHA256650555a4c89bfa77054e453ea61f2fe9f095f15a13629f964b903ec7fc07dd12
SHA512d4c70acb84004d27cfe5db22dddccd90217f95d6d2425bbe4359f318056817b669c98907e2679111c49ccf0321011a60cac88c7156566e825b1ea9b1a12e2189
-
Filesize
11KB
MD5966f1686b72929b452c7c0999791d42f
SHA120961fd566d789b5657f65595c3a39622c569a22
SHA2562f7553fc7b0e511813ef7639cab9b2466348eeb78ffc534a12e2e271af8e7ce8
SHA512b427eea99d197889e4a4b8801a45baebd20824983f38794ef0e81723c9592c28d75f39744691f650e220208e5f072d61470add4fc99221383e0a89369de5ab93
-
Filesize
13KB
MD53c40a9d1ae0b5e72b2f90761a0fd49cf
SHA1567282eedcb721a7137dde2f135704a50f3cd883
SHA25691c4f107fe8e8c902728e131672bd6953d94964b7a0f1edcc004ae5f471a2a42
SHA512d8f69f1c6ea2837e56c98a2591dbd3a336c40e2ad0af45550406cd00c70fbbc3d7c7594509bef4418aa45e0faf0cb7ce739e6e986ab505b4cd32ce595c236243
-
Filesize
11KB
MD525cd5a26ea59e6f4c082b8945b16fc3a
SHA1851ea9bfebbbc901edc98f928d59fb03d15a0037
SHA256093b7168f6b64c655464d9bbf51bbc29456772ff747763c112ed206e023c69cf
SHA512dc001828c40e4a85791644d100eea7132951b2644b59f7f147f17feac515d405313289d5aafbf147ffb1913ce855a501ae79acf832c32ed08d348352c80e9cf3
-
Filesize
11KB
MD5cf403b7b90696ab2ded707ffdea27112
SHA18d25084c7d24143cf95303bfa0654a42d9cb0ca2
SHA256f5f5e3cfa9237bb04bd485f28cecd07892212335648d32e9e3e1b248784baeb6
SHA5120004a31e0982fc4007c7fdaf0d06b6d3a19dc35ca00feeb8f161b62695b063bb07fb409c0926a1f95a4698ca57c22f773d9a431eee586633b075366de0cbacca
-
Filesize
12KB
MD5ed14b64c94f543974b7fdc592fa0594b
SHA1dc66ca3de44c021d89ebd5160c447aaedc565514
SHA2569165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
SHA5125d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc
-
Filesize
12KB
MD5f97e7878a2b372291b1269d80327bbf6
SHA1cee6f776fe0aa5a6d4854058f20f675253f48998
SHA256c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
SHA512475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825
-
Filesize
11KB
MD5761ddd8669a661d57d9cf9c335949c06
SHA1251bbcad15771d80492f1deb001491a7abb6c563
SHA256fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
SHA5125ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a
-
Filesize
15KB
MD5bbae7b5436d6d1b0fc967ff67e35415f
SHA1f67bc165cefb119ad767b6bec27a1102c0fd2bac
SHA2568150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
SHA5124201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2
-
Filesize
17KB
MD553e9526af1fdce39f799bfe9217397a8
SHA1f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144
SHA256de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
SHA5128167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f
-
Filesize
17KB
MD5eccf5973b80d771a79643732017cea9a
SHA1e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c
SHA256038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
SHA512b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e
-
Filesize
13KB
MD5090dd0bb2bddee3eaae5b6ff15fae209
SHA1ddc5ac01227970a4925a08f29ba65eb10344edb1
SHA256957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
SHA5122e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3
-
Filesize
769KB
MD5fa5d95091901e5fcb3f30956da007aa2
SHA1f49ca7f7e422af6cd6461a70627ef1cd30d6f562
SHA2567ae597d785381425377fc205f26ed0fa6fb031e0adca29d9c80b802c0a6270f3
SHA51228167fbdd5737c974e8fa6af62f3f4cf1ae61a24bd0f6759d5b2cff580db4704eea7d21404fdc11714e7580299d43b070455290558f280115a3701f24da24274
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
3.6MB
MD5c4709f84e6cf6e082b80c80b87abe551
SHA1c0c55b229722f7f2010d34e26857df640182f796
SHA256ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
SHA512e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4
-
Filesize
961KB
MD52381e189321ead521ff71e72d08a6b17
SHA10db7fea07b4bc14f0f9d71ecfa6ddf3097229875
SHA2564918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806
SHA5122d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5
-
Filesize
575B
MD5efd54055b28e173ea64831fc59a0aca8
SHA1cdf18b0692a53cbeed66ee14fa0f54666cf04013
SHA256e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99
SHA5125ecf69dbdf824a6e0221e7f953ed58889bbd76ee563e9fc7e5d95b68245d0f4af0e0ec5f13f002975b65bacf0cd29027964b9f8c4174134ed08358e41b58f4d5
-
Filesize
2.5MB
MD54950d9d67d4661237ed76d8011dde67e
SHA11f2229ccabea756d1ce883ee2469dac54403bf93
SHA25670557af68ecc14faa19b03c5f1bc4ac3c26e742b9a2232f0eaad3bba2def0701
SHA51202380d434591a7061d2051d6926b9f6260bebc49c70656844538e166cfd88026f1f9caeee2e39fced576ad81c5d57daef2a9930e8fbb2454d43d8d3f72a7afda
-
Filesize
129KB
MD55e869eebb6169ce66225eb6725d5be4a
SHA1747887da0d7ab152e1d54608c430e78192d5a788
SHA256430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
SHA512feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16
-
Filesize
203KB
MD57d0c4ab57fdc1bd30c0e8e42ccc2aa35
SHA181bff07b6b5dd843e2227a3e8054500cfec65983
SHA256ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db
SHA51256ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe
-
Filesize
38KB
MD5b32cb9615a9bada55e8f20dcea2fbf48
SHA1a9c6e2d44b07b31c898a6d83b7093bf90915062d
SHA256ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
SHA5125c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe
-
Filesize
172KB
MD55fbb728a3b3abbdd830033586183a206
SHA1066fde2fa80485c4f22e0552a4d433584d672a54
SHA256f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
SHA51231e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb
-
Filesize
75KB
MD58ea18d0eeae9044c278d2ea7a1dbae36
SHA1de210842da8cb1cb14318789575d65117d14e728
SHA2569822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
SHA512d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0
-
Filesize
15KB
MD51908861649e67cdc20c563c234a89914
SHA1471ae3b9a3b40e63c880362892865ecf8bd80f67
SHA2564aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
SHA512dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353
-
Filesize
11KB
MD5af851dfd0d9fecb76ff2b403f3c30f5b
SHA130f79fb4d4c91af847963c46882d095d1f42efbe
SHA2566a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
SHA51204509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5
-
Filesize
13KB
MD50f143310fade4de116070a3917a79c18
SHA1b9a092e885c73cb6d33c9e17d429ede950cf3a26
SHA2562def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
SHA512f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60
-
Filesize
20KB
MD556556659c691dd043dbe24b0a195d64c
SHA1117b9a201d1e8bb9e5fadeae808141d3fa41fb60
SHA2562e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
SHA512a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0
-
Filesize
12KB
MD56631c212f79350458589a5281374b38b
SHA188be6865aac123ffbdafec32a6fba34a26428875
SHA25652cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
SHA512e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298
-
Filesize
11KB
MD5cc337898e64d9078cb697ac19f995c7f
SHA12ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c
SHA256e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18
SHA5126960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca
-
Filesize
198KB
MD56500aa010c8b50ffd1544f08af03fa4f
SHA1a03f9f70d4ecc565f0fae26ef690d63e3711a20a
SHA256752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec
SHA512f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1
-
Filesize
26KB
MD5fb4a0d7abaeaa76676846ad0f08fefa5
SHA1755fd998215511506edd2c5c52807b46ca9393b2
SHA25665a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
SHA512f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f