File name:

ryuk.exe

Full analysis: https://app.any.run/tasks/5c1f8450-3889-4fb3-9414-5444b7211e9a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 22:51:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ryuk
ransomware
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

F99E6254C7325380677A7E9DE74C7399

SHA1:

2A035674F225172E9627B9E9247B5E1AB78F5787

SHA256:

79FFACBAEAB6CDCBACBE315113278CAC0A6CF84CD7084048E3DC1C150FF3DD0E

SSDEEP:

49152:puLGkfdv59gjsoqJT6QlLAM0xAMd6YTx1w:put59gc564Aq80

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RYUK mutex has been found

      • ryuk.exe (PID: 6680)

    • Create files in the Startup directory

      • cmd.exe (PID: 6668)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 6836)

    • Actions looks like stealing of personal data

      • ryuk.exe (PID: 6680)

    • Steals credentials from Web Browsers

      • ryuk.exe (PID: 6680)

    • Renames files like ransomware

      • ryuk.exe (PID: 6680)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ryuk.exe (PID: 6680)
      • cmd.exe (PID: 6668)

    • Starts CMD.EXE for commands execution

      • ryuk.exe (PID: 6680)
      • cmd.exe (PID: 4456)
      • cmd.exe (PID: 1328)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7140)
      • cmd.exe (PID: 5168)
      • cmd.exe (PID: 856)

    • Application launched itself

      • cmd.exe (PID: 4456)
      • cmd.exe (PID: 1328)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3864)
      • cmd.exe (PID: 1564)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 6868)
      • cmd.exe (PID: 3480)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6980)

    • Found strings related to reading or modifying Windows Defender settings

      • ryuk.exe (PID: 6680)

    • Uses pipe srvsvc via SMB (transferring data)

      • ryuk.exe (PID: 6680)

    • Creates file in the systems drive root

      • ryuk.exe (PID: 6680)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3540)
      • cmd.exe (PID: 1328)

  • INFO

    • Creates files in the program directory

      • ryuk.exe (PID: 6680)
      • cmd.exe (PID: 2296)

    • Checks supported languages

      • ryuk.exe (PID: 6680)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 6748)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 6668)

    • Reads the machine GUID from the registry

      • ryuk.exe (PID: 6680)

    • Manual execution by a user

      • notepad.exe (PID: 2136)
      • notepad.exe (PID: 3652)
      • mspaint.exe (PID: 6536)
      • mspaint.exe (PID: 6828)
      • notepad.exe (PID: 6232)
      • mspaint.exe (PID: 1800)

    • Reads the computer name

      • ryuk.exe (PID: 6680)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 2136)
      • notepad.exe (PID: 3652)
      • notepad.exe (PID: 6232)

    • Creates files or folders in the user directory

      • ryuk.exe (PID: 6680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:11:09 18:02:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.32
CodeSize: 622592
InitializedDataSize: 295424
UninitializedDataSize: -
EntryPoint: 0x623b0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
50
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #RYUK ryuk.exe conhost.exe no specs cmd.exe schtasks.exe no specs cmd.exe cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs icacls.exe no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs notepad.exe no specs rundll32.exe no specs notepad.exe no specs slui.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856C:\WINDOWS\system32\cmd.exe /c attrib +h +s C:\ProgramData\ryuk.exeC:\Windows\System32\cmd.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1080reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /FC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1296icacls * /grant Everyone:(OI)(CI)F /T /C /QC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1328C:\WINDOWS\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM Microsoft.Exchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exitC:\Windows\System32\cmd.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1564C:\WINDOWS\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /fC:\Windows\System32\cmd.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1644attrib +h +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1712C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1800"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Pictures\daysdescription.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2136"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\RyukReadMe.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
35 410
Read events
35 320
Write events
87
Delete events
3

Modification events

(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbHeight
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:UnitSetting
Value:
0
(PID) Process:(1800) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowRulers
Value:
0
Executable files
123
Suspicious files
974
Text files
418
Unknown types
0

Dropped files

PID
Process
Filename
Type
6680ryuk.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\AcroRdrDCx64Upd2300820470_MUI.msp.[Cara@onionmail.org].RYK —
MD5:—
SHA256:—
6680ryuk.exeC:\ProgramData\Microsoft\User Account Pictures\admin.dat.[Cara@onionmail.org].RYK —
MD5:—
SHA256:—
6680ryuk.exeC:\ProgramData\Microsoft OneDrive\setup\refcount.ini.[Cara@onionmail.org].RYK —
MD5:—
SHA256:—
6680ryuk.exeC:\ProgramData\ryuk.exeexecutable
MD5:F99E6254C7325380677A7E9DE74C7399
SHA256:79FFACBAEAB6CDCBACBE315113278CAC0A6CF84CD7084048E3DC1C150FF3DD0E
6680ryuk.exeC:\ProgramData\hrmlog2binary
MD5:D34568A443EDABD36ED705C64AED5D16
SHA256:8290D214A6D60C7873B247BDBBF6B236F8A4D5FF7868448AACC61FDFE9AF3773
2296cmd.exeC:\ProgramData\RYUKIDtext
MD5:579C365A815FA5CD23CFC6BF22ED2FAA
SHA256:A38B7D946C19E74DA95BDB117CE651DFAFB4324D4935184E727F005E75EFA349
6680ryuk.exeC:\ProgramData\RyukReadMe.html.[Cara@onionmail.org].RYKtext
MD5:CE4EFF51A051B7D03F22F4F28A97706E
SHA256:19D97C2CF647D7A31051D8BBEB082D2BF5DC7E7B70CF51A898BF269037E4110A
6680ryuk.exeC:\Users\admin\Desktop\hrmlog1text
MD5:3673B705620C7964915101DCD65DBB3A
SHA256:1D48794F17696832DF7092991C9ACE136DBD70A45F44F5C1D6CC44F06CC5F2D3
6668cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exeexecutable
MD5:F99E6254C7325380677A7E9DE74C7399
SHA256:79FFACBAEAB6CDCBACBE315113278CAC0A6CF84CD7084048E3DC1C150FF3DD0E
6680ryuk.exeC:\ProgramData\hrmlog1text
MD5:63D52E85A4C713CFEE848155F8053334
SHA256:E4A5C0EA3D558C6DB79B0D0B9DAE9941591B01594D1F8088CAB0D1AC42E7258E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
36
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2288
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2140
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2140
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6172
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.2:139
—
—
—
whitelisted
4
System
192.168.100.2:137
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2288
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.142
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 2.18.121.147
  • 2.18.121.139
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ryuk.exe