Analysis
-
max time kernel
102s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
17/03/2025, 01:30
Behavioral task
behavioral1
Sample
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
-
Size
11.5MB
-
MD5
8099f355d023f687efab26a1323977c7
-
SHA1
6839dd1d3b1c92ee02df1a9daa0771b83ab1a983
-
SHA256
bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9
-
SHA512
7afade18da1755a3811b8cf0ea980077896e67eb2523bea2bb874c34d0ad076933ebfb6c12cd5dea2f33e86101544c8a77f025a58c2fff6ccd1287debd9da314
-
SSDEEP
196608:aPXLYgk+yA9//qt++3HF9onJ5hrZEE3e9tGPqKM48RmU/3ZlsPvpEbPCTbPKRTvI:aY+Cl9c5hlEE/PNMtN3ZWqDC3PuTZU
Malware Config
Extracted
C:\Users\Admin\Pictures\README.txt
demonware
https://keys.zeznzo.nl
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Demonware family
-
Loads dropped DLL 36 IoCs
pid Process 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 4216 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2060 wrote to memory of 4216 2060 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 88 PID 2060 wrote to memory of 4216 2060 2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD52b6eac8d1d5cd08279f4c711f84e3953
SHA1c1b44d08dcf6fe7f50a1707d91f606b70538ce62
SHA256a05ffcf7b30d87021f67dc94324f4e7e0481809b07f59cbc77b6798aeb319e7b
SHA512827215a6894c20e9dde798a660ba49f5810d48d50f75cbbe88607254dbd5bad9518c612f1a06fdd932e3836e928ef9f04df7ce4800614e09ca74fffc0070b86d
-
Filesize
12KB
MD5b768eda0fa972c9cd34cebc1e7c4b54e
SHA195967222a6902226e9bc94bc1503c1638fbcc7cc
SHA2564e872e1aa9229a3e95a970af1b6a71c17c5ab84e53a57012c5c7c4412fafeb3f
SHA512fcf4de7f5be68bb029cd5f6a6413ce3fc1db0ea3d58152b766f86ae1c81653ac9c1b303b8622bb2a34b254f1b9f33e8422b42642992936512d80f435e5229690
-
Filesize
12KB
MD500afcb334aa9cbc635ffb7864d487bca
SHA19b0c29dc4c01984ef63d2b868b7d27637aeabde2
SHA25669e5945cde019e9dcdc23404e81fcc7dd2313eebf259daa3a5af537eaf418267
SHA512ef1b73b5906713f9b90afc41c60a29d45a1630a6ab1c22be1cc7aa72dc5db7b7bc90dfce1eefda9167a98e911952f7232c5c0f1c4e043428d292cf64fbae284b
-
Filesize
13KB
MD5d02012848d57be3b3967d379ea42426e
SHA169610f7f1f35830639cdcf74f99a20be5bb011c7
SHA256cc1782f000f855b66ff94ddbb34dae3aa520c3fbb98b972c5561f2745791849d
SHA51251f2dbc9f74b9190fa1f395cac5e8e1b60ac3181da169477e7510411700d42bdcf426285cce8a09983eaa84597621c892d5dc360c56231031e2fc702cddd1be1
-
Filesize
10KB
MD5ea90e3f80b3f3d089e20514e52cae4bb
SHA12bd4a5e1b0871ef7ca753b635101216422260eee
SHA256256f905da0b889b74dcc0ed69a090f26b92e82936e1b149ed1c6d413b45eff96
SHA5128a8715842b1773386aa75a4eb7136cb8c43da3330e54eddf952469e165c59fe8ce3ed439db6b89e24d1640cec3c64ca2bb3d673727d6a90e9cbd161602d7692c
-
Filesize
11KB
MD522d65fdceebad51d277a2d8db999b237
SHA1f65ed91b8bab5c2766f4aeaa86580de0017770ad
SHA2563a4a5aaaa9a80180601376412180b024dbd43c1a3c313dc408dcdd5ee208cd6a
SHA512d574e7ba77d4bcea014742678608ce46b51b585a6cc8b6e2a2c064b426042c769083f5a74cebe00800283e6efc8f7b079ef0720c2a7bf51098b5f51978419dc9
-
Filesize
14KB
MD5f79a4c8843675e13fc0d4f057faec76a
SHA180f8d466d2a42a3b278db0f6edb7e60c2f5afa26
SHA256e4f57da1c2ae72d2ab4980a2ffa370ac0cf1f3f8c76273dcea3c28fd5c858c1e
SHA5127955edd12c426599c5103fc71d4fa051092584e5bf6755beee5bbb76977927093ec6b73eaec0276de6e3e28e4f3e1ca0507d1b4a85eeba14f2e5b6032401715d
-
Filesize
15KB
MD59172a2fc5c66fff01f12676d16d8e882
SHA1ee71eafd922f0ee24f1559c63dd8c82b16dbba00
SHA2561143956ef572524ca0a4db6e55b918d7e3e137fa87d15df31ae4f8a4d5c6334b
SHA5128a70a90edbac647d04444e5c926d7619d200632192e978fb56f9597583d3cd4ed8dcb5a0db89f0d3f89a41157388d51a3ab3eca7bc19d37da6917ca954ee0741
-
Filesize
18KB
MD5609daa8ccbefeda1291d663235c257eb
SHA13a7232f1f6c6b1c03963316c45b7ae335fd9ede6
SHA25628cca9038d7f709a8cc251cc664195c68f65d61832547459fb8b3021044fe6da
SHA512028a198e5c8b2f2f7bf8df716a06b5ffae0a875a9ac4d42c1bc64e4232e1d0700f79a01485a87c8fa7515e7c458912ef89487f4aea77fd769bd32e02ce3b1c64
-
Filesize
20KB
MD5fd2bab04dcf785080fd7e6aa1abdb566
SHA19eece186b95a4a6ffa8fadca283ebd2e1f60a340
SHA256a660650ba2a0914d510d931458bf93a2e2479cf5922bd830f55ff74deebb19c9
SHA5125ba2a7e097506c18c5ac74c0adac276b137b04185286fc7f2151dc7e7628c044a99d062b123c56dcf2d409dea1b9a5624a08899f5b7735a233f465317e8cfac5
-
Filesize
13KB
MD59e94efa7a0bd313c473c1f65001a5cca
SHA195e645f35d3a83780efd552b415e3f1dd77cc37f
SHA25694abdf6cb2e0137aa8b3148076134e1e5237d8de7d010965d7d72b9cb782369f
SHA51291feb7058c51291a437e65f012a6397277f4a9b80fb485e754231884a529e84b081489ffb1592f989f8c5e10424ae21f5b67b9bf538debeb59e40ff6aa5be34c
-
Filesize
12KB
MD5f9d715d7bbf155fe0b9c930c5f6ff6f2
SHA1b85174e52601470927cc8e79e211b0ca4e01bbc4
SHA256a7ba14b6a5989776e50a2bcbd7d13b9215c91c6c975373c2b52f7ba529eba294
SHA512b69f96aa216ca38fd6405998ea948dce03607ee1a8ef2235fb48c6974199acac6aa44750f43d0b20d8029e750f1dd9bb9f3b90099f6c18be8d5bacb7cb6b134f
-
Filesize
12KB
MD5456a382953f5b0eff12b5ab55bd15026
SHA148b2e5c7dbc617ea7c3fa00fe356c53da6055c9f
SHA25686949f24ecf1fb5bba5b045e0a65bdf2e4ee653855900e810044b35912ac5cf1
SHA5126ed5ef3a0c870f2eb6e5db8e9cc60be08c3d138e588b5440b95df2977cb22f925d44496db168c8cedea981c09f73a06c0a5e25479fb7ed2174b4193480919133
-
Filesize
10KB
MD5ec54e8bd34ce4048fcc056f7c1819c90
SHA13d658a5497bba41ae7df11f0c9c49461ec7425d5
SHA256b5d6738c2283b14d22383dd04d5fa9b7349d81e3bfa4abbbdd587c9306f4e62e
SHA512f994449d4bcf8b659cf0055ae00cbb67d986e9520193bdd08424f89cf286a2b15a2db216fc2f927096a2768376589cee51e0eb4ed3288ad1acf9a3a09b4f36e3
-
Filesize
10KB
MD57d2ed7ed7b5f765f13123a905abdd190
SHA16c99d801d39c13f86352762d3c150f0c4ff2918b
SHA2560dcbf6c5d564b77d40cc71096769ab89092b946dd8ebde2a0effb0c28b36ef3a
SHA5129d5f307ae558ba62abc2b44b8dd3205a7a7c7524253662ba6f427288695aa41e02ac28785ab77b95a0961bff8b5860fd5b20b54438b280bf9f6cb2523dcedac6
-
Filesize
2.5MB
MD54950d9d67d4661237ed76d8011dde67e
SHA11f2229ccabea756d1ce883ee2469dac54403bf93
SHA25670557af68ecc14faa19b03c5f1bc4ac3c26e742b9a2232f0eaad3bba2def0701
SHA51202380d434591a7061d2051d6926b9f6260bebc49c70656844538e166cfd88026f1f9caeee2e39fced576ad81c5d57daef2a9930e8fbb2454d43d8d3f72a7afda
-
Filesize
85KB
MD589a24c66e7a522f1e0016b1d0b4316dc
SHA15340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42
SHA2563096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
SHA512e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a
-
Filesize
92KB
MD5cf77513525fc652bad6c7f85e192e94b
SHA123ec3bb9cdc356500ec192cac16906864d5e9a81
SHA2568bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
SHA512dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9
-
Filesize
129KB
MD55e869eebb6169ce66225eb6725d5be4a
SHA1747887da0d7ab152e1d54608c430e78192d5a788
SHA256430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
SHA512feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16
-
Filesize
203KB
MD57d0c4ab57fdc1bd30c0e8e42ccc2aa35
SHA181bff07b6b5dd843e2227a3e8054500cfec65983
SHA256ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db
SHA51256ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe
-
Filesize
38KB
MD5b32cb9615a9bada55e8f20dcea2fbf48
SHA1a9c6e2d44b07b31c898a6d83b7093bf90915062d
SHA256ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
SHA5125c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe
-
Filesize
172KB
MD55fbb728a3b3abbdd830033586183a206
SHA1066fde2fa80485c4f22e0552a4d433584d672a54
SHA256f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
SHA51231e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb
-
Filesize
75KB
MD58ea18d0eeae9044c278d2ea7a1dbae36
SHA1de210842da8cb1cb14318789575d65117d14e728
SHA2569822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
SHA512d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0
-
Filesize
68KB
MD509f66528018ffef916899845d6632307
SHA1cf9ddad46180ef05a306dcb05fdb6f24912a69ce
SHA25634d89fe378fc10351d127fb85427449f31595eccf9f5d17760b36709dd1449b9
SHA512ed406792d8a533db71bd71859edbb2c69a828937757afec1a83fd1eacb1e5e6ec9afe3aa5e796fa1f518578f6d64ff19d64f64c9601760b7600a383efe82b3de
-
Filesize
769KB
MD5fa5d95091901e5fcb3f30956da007aa2
SHA1f49ca7f7e422af6cd6461a70627ef1cd30d6f562
SHA2567ae597d785381425377fc205f26ed0fa6fb031e0adca29d9c80b802c0a6270f3
SHA51228167fbdd5737c974e8fa6af62f3f4cf1ae61a24bd0f6759d5b2cff580db4704eea7d21404fdc11714e7580299d43b070455290558f280115a3701f24da24274
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
198KB
MD56500aa010c8b50ffd1544f08af03fa4f
SHA1a03f9f70d4ecc565f0fae26ef690d63e3711a20a
SHA256752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec
SHA512f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1
-
Filesize
3.6MB
MD5c4709f84e6cf6e082b80c80b87abe551
SHA1c0c55b229722f7f2010d34e26857df640182f796
SHA256ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
SHA512e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4
-
Filesize
26KB
MD5fb4a0d7abaeaa76676846ad0f08fefa5
SHA1755fd998215511506edd2c5c52807b46ca9393b2
SHA25665a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
SHA512f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f
-
Filesize
1.6MB
MD5c0b23815701dbae2a359cb8adb9ae730
SHA15be6736b645ed12e97b9462b77e5a43482673d90
SHA256f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
SHA512ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
1.4MB
MD5fdc8a5d96f9576bd70aa1cadc2f21748
SHA1bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA2561a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
SHA512816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
-
Filesize
961KB
MD52381e189321ead521ff71e72d08a6b17
SHA10db7fea07b4bc14f0f9d71ecfa6ddf3097229875
SHA2564918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806
SHA5122d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5
-
Filesize
575B
MD5efd54055b28e173ea64831fc59a0aca8
SHA1cdf18b0692a53cbeed66ee14fa0f54666cf04013
SHA256e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99
SHA5125ecf69dbdf824a6e0221e7f953ed58889bbd76ee563e9fc7e5d95b68245d0f4af0e0ec5f13f002975b65bacf0cd29027964b9f8c4174134ed08358e41b58f4d5