File name:

ryuk_patched.exe

Full analysis: https://app.any.run/tasks/cfc4fe72-f192-41c4-a794-543ecef82150
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:53:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ryuk
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

382C3E71C5EF5C70620DDF2FA1FB89F4

SHA1:

245B9532F08FBF6D1B079A734592689EB2824422

SHA256:

A5CA3347655BFF0F1153BDD26F9AF0632173DA87B780536537FE35D9A63CFB8A

SSDEEP:

24576:pNq59rBSJKv8vm1LGkfdv59gjsoqJT6QlLAM0xAMd6cTxkc:puLGkfdv59gjsoqJT6QlLAM0xAMd6cTD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 188)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 768)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 1660)
      • cmd.exe (PID: 4808)

    • RYUK mutex has been found

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 188)

    • Starts CMD.EXE for commands execution

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 4808)
      • ryuk_patched.exe (PID: 1052)
      • cmd.exe (PID: 5896)
      • cmd.exe (PID: 5372)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 6640)
      • cmd.exe (PID: 4412)
      • cmd.exe (PID: 4312)
      • cmd.exe (PID: 3584)
      • cmd.exe (PID: 5616)

    • Application launched itself

      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 4808)
      • cmd.exe (PID: 5372)
      • cmd.exe (PID: 5896)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4808)
      • cmd.exe (PID: 5876)
      • cmd.exe (PID: 888)
      • cmd.exe (PID: 5896)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 6948)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1812)
      • cmd.exe (PID: 2664)

    • Creates file in the systems drive root

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Executes application which crashes

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

  • INFO

    • Checks supported languages

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Creates files in the program directory

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 3460)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 188)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 4520)
      • cmd.exe (PID: 6128)

    • Reads the machine GUID from the registry

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Checks proxy server information

      • WerFault.exe (PID: 5644)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 6892)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5644)

    • Reads the software policy settings

      • WerFault.exe (PID: 5644)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 6892)

    • Manual execution by a user

      • ryuk_patched.exe (PID: 1052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:11:09 18:02:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.32
CodeSize: 622592
InitializedDataSize: 295424
UninitializedDataSize: -
EntryPoint: 0x623b0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
220
Monitored processes
69
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #RYUK ryuk_patched.exe conhost.exe no specs cmd.exe schtasks.exe no specs cmd.exe cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs werfault.exe #RYUK ryuk_patched.exe conhost.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs werfault.exe slui.exe ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\WINDOWS\system32\cmd.exe /c copy C:\ProgramData\ryuk.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"C:\Windows\System32\cmd.exe
ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
420attrib +h +s ryuk.exeC:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
620C:\WINDOWS\system32\cmd.exe /c Copy hrmlog1 C:\ProgramData\hrmlog1C:\Windows\System32\cmd.exe—ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
724schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768C:\WINDOWS\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\System32\cmd.exe
ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
888cmd.exe /c taskkill /t /f /im sql* C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1052"C:\Users\admin\Desktop\ryuk_patched.exe" C:\Users\admin\Desktop\ryuk_patched.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\ryuk_patched.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1096C:\WINDOWS\system32\cmd.exe /c Copy hrmlog1 C:\ProgramData\hrmlog1C:\Windows\System32\cmd.exe—ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296taskkill /f /t /im veeam* C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
9 318
Read events
9 318
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
8
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ryuk_patched.exe_6ffcea2d7d98d143daa6de3374d1262c46555e75_b763ede1_79518bb2-f407-4c87-9d67-a62a28426594\Report.wer —
MD5:—
SHA256:—
3100WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ryuk_patched.exe_6ffcea2d7d98d143daa6de3374d1262c46555e75_b763ede1_7d1395e7-412b-4329-800e-3b55d636e27d\Report.wer —
MD5:—
SHA256:—
5168ryuk_patched.exeC:\Users\admin\Desktop\htext
MD5:CD76EB6BEE5D009400C8492C762B9096
SHA256:86D6EC8593E61340A92A30F1D17E3776D017209052486F3D5EEF0ED973F8132F
5168ryuk_patched.exeC:\ProgramData\ryuk.exeexecutable
MD5:382C3E71C5EF5C70620DDF2FA1FB89F4
SHA256:A5CA3347655BFF0F1153BDD26F9AF0632173DA87B780536537FE35D9A63CFB8A
5168ryuk_patched.exeC:\Users\admin\Desktop\'binary
MD5:4A20AA4EE44187EAD818777641A0A7CF
SHA256:4808BE36A8ACFDF46F37B0B99426BC5202B5B983485790F8242E29E999B68762
188cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exeexecutable
MD5:382C3E71C5EF5C70620DDF2FA1FB89F4
SHA256:A5CA3347655BFF0F1153BDD26F9AF0632173DA87B780536537FE35D9A63CFB8A
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5BAE.tmp.xmlxml
MD5:42429AF9D702EF5E09E1962076865C97
SHA256:7FD4912E87B9B99352C98504AF185EA20804E7D9380AB7DEE906583559374838
5168ryuk_patched.exeC:\Users\admin\Desktop\RYUKIDtext
MD5:46004414E936366BD02B3C3929E8E10A
SHA256:3241F2AEB2423771A95B43B34039F925A3E81FC1CC0F96F12AE489E9D9690CE9
5644WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:75EA342072223DF611D45CEBCDD3C684
SHA256:6F1EB4C37DE4F422D848943C9BF7E908C7356A1CBDBCE57E026F22D638806AC8
3460cmd.exeC:\ProgramData\RYUKIDtext
MD5:46004414E936366BD02B3C3929E8E10A
SHA256:3241F2AEB2423771A95B43B34039F925A3E81FC1CC0F96F12AE489E9D9690CE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
51
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5644
WerFault.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5644
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
892
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2356
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5252
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5644
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5644
WerFault.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5644
WerFault.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.206
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
  • 20.189.173.20
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.0
  • 40.126.31.0
  • 20.190.159.75
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ryuk_patched.exe