File name:

ryuk_patched.exe

Full analysis: https://app.any.run/tasks/cfc4fe72-f192-41c4-a794-543ecef82150
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:53:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ryuk
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

382C3E71C5EF5C70620DDF2FA1FB89F4

SHA1:

245B9532F08FBF6D1B079A734592689EB2824422

SHA256:

A5CA3347655BFF0F1153BDD26F9AF0632173DA87B780536537FE35D9A63CFB8A

SSDEEP:

24576:pNq59rBSJKv8vm1LGkfdv59gjsoqJT6QlLAM0xAMd6cTxkc:puLGkfdv59gjsoqJT6QlLAM0xAMd6cTD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RYUK mutex has been found

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 768)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 1660)
      • cmd.exe (PID: 4808)

    • Create files in the Startup directory

      • cmd.exe (PID: 188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 188)

    • Starts CMD.EXE for commands execution

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 4808)
      • ryuk_patched.exe (PID: 1052)
      • cmd.exe (PID: 5896)
      • cmd.exe (PID: 5372)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 6640)
      • cmd.exe (PID: 4412)
      • cmd.exe (PID: 4312)
      • cmd.exe (PID: 5616)
      • cmd.exe (PID: 3584)

    • Application launched itself

      • cmd.exe (PID: 5232)
      • cmd.exe (PID: 4808)
      • cmd.exe (PID: 5896)
      • cmd.exe (PID: 5372)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4808)
      • cmd.exe (PID: 5876)
      • cmd.exe (PID: 5896)
      • cmd.exe (PID: 888)

    • Executes application which crashes

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Creates file in the systems drive root

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 6948)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1812)
      • cmd.exe (PID: 2664)

  • INFO

    • Checks supported languages

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Creates files in the program directory

      • ryuk_patched.exe (PID: 5168)
      • cmd.exe (PID: 3460)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 4520)
      • cmd.exe (PID: 6128)

    • Launching a file from the Startup directory

      • cmd.exe (PID: 188)

    • Reads the machine GUID from the registry

      • ryuk_patched.exe (PID: 5168)
      • ryuk_patched.exe (PID: 1052)

    • Manual execution by a user

      • ryuk_patched.exe (PID: 1052)

    • Checks proxy server information

      • WerFault.exe (PID: 5644)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 6892)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5644)

    • Reads the software policy settings

      • WerFault.exe (PID: 5644)
      • WerFault.exe (PID: 3100)
      • slui.exe (PID: 6892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:11:09 18:02:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.32
CodeSize: 622592
InitializedDataSize: 295424
UninitializedDataSize: -
EntryPoint: 0x623b0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
220
Monitored processes
69
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #RYUK ryuk_patched.exe conhost.exe no specs cmd.exe schtasks.exe no specs cmd.exe cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs taskkill.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs werfault.exe #RYUK ryuk_patched.exe conhost.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe schtasks.exe no specs cmd.exe schtasks.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs icacls.exe no specs cmd.exe no specs werfault.exe slui.exe ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\WINDOWS\system32\cmd.exe /c copy C:\ProgramData\ryuk.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"C:\Windows\System32\cmd.exe
ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
420attrib +h +s ryuk.exeC:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
620C:\WINDOWS\system32\cmd.exe /c Copy hrmlog1 C:\ProgramData\hrmlog1C:\Windows\System32\cmd.exe—ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
724schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768C:\WINDOWS\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /FC:\Windows\System32\cmd.exe
ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
888cmd.exe /c taskkill /t /f /im sql* C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1052"C:\Users\admin\Desktop\ryuk_patched.exe" C:\Users\admin\Desktop\ryuk_patched.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\ryuk_patched.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1096C:\WINDOWS\system32\cmd.exe /c Copy hrmlog1 C:\ProgramData\hrmlog1C:\Windows\System32\cmd.exe—ryuk_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296taskkill /f /t /im veeam* C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
9 318
Read events
9 318
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
8
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ryuk_patched.exe_6ffcea2d7d98d143daa6de3374d1262c46555e75_b763ede1_79518bb2-f407-4c87-9d67-a62a28426594\Report.wer —
MD5:—
SHA256:—
3100WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ryuk_patched.exe_6ffcea2d7d98d143daa6de3374d1262c46555e75_b763ede1_7d1395e7-412b-4329-800e-3b55d636e27d\Report.wer —
MD5:—
SHA256:—
5168ryuk_patched.exeC:\Users\admin\Desktop\htext
MD5:CD76EB6BEE5D009400C8492C762B9096
SHA256:86D6EC8593E61340A92A30F1D17E3776D017209052486F3D5EEF0ED973F8132F
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5B2F.tmp.dmpbinary
MD5:94202B1DDA7F5ECB1A2B7D031F1F1D3A
SHA256:8E7D8B98936B4257B8F73F872C7256F787BBEB57ED38961E6790B2E2F4DF2DE0
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5BAE.tmp.xmlxml
MD5:42429AF9D702EF5E09E1962076865C97
SHA256:7FD4912E87B9B99352C98504AF185EA20804E7D9380AB7DEE906583559374838
5644WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:D310523737A0D4D05066857AC157F458
SHA256:0A0520D498306689AFA3CAC09ACE82E09229108FC9FABA5A906291D077004484
5644WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:0F7B8F6A846AA9CA52FA562DDDCDB5ED
SHA256:AFF90E65A81289B80D1FCC5E71B3D88E5D1AAFE22CE358EB6E28A56D1845263D
5644WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:75EA342072223DF611D45CEBCDD3C684
SHA256:6F1EB4C37DE4F422D848943C9BF7E908C7356A1CBDBCE57E026F22D638806AC8
5644WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5B7F.tmp.WERInternalMetadata.xmlxml
MD5:AD21503F7449A9BE57A5EF7E0F55EB0B
SHA256:542C0BD6A37ED1E7843BAA5B166FBAAB4DF9ED8F2FB60370E2CDC8C4654F3DE3
5644WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\ryuk_patched.exe.5168.dmpbinary
MD5:7A21225C2AAEDFCAFF0326AE6ECF627E
SHA256:295D06C966AECC4876A40EBEABDCB92E7DE70C59CBB75D86B2DC95E2417D9AF8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
51
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5644
WerFault.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5644
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
892
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4156
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2356
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5252
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5644
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5644
WerFault.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
5644
WerFault.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.206
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
  • 20.189.173.20
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.128
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.0
  • 40.126.31.0
  • 20.190.159.75
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ryuk_patched.exe