analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ryuk.exe

Full analysis: https://app.any.run/tasks/d2a90c8f-8971-4d3b-89be-968d3e204cf3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 16, 2020, 11:51:00
OS: Windows 8.1 Professional (build: 9600, 32 bit)
Tags:
ransomware
ryuk
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

6BFDA9EF91AF32C3D47C521C5AAEA618

SHA1:

D5325AAA25DAFE9AEFDCA791FC108B1D9517A7EF

SHA256:

D6E66598876136C507AADF10929E663F3CE109D1BC2EF88E3B02CC939458C450

SSDEEP:

12288:YN/Z9nhD8Qxo8b1ZRlOAJnn6vSS/ArOzfiy7hn+O9Rb:YN/Z/8mf66S/ASuO9l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • ryuk.exe (PID: 3344)

    • RYUK was detected

      • ryuk.exe (PID: 3344)

    • Deletes shadow copies

      • cmd.exe (PID: 2444)
      • cmd.exe (PID: 3860)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 2516)

    • Writes to a start menu file

      • ryuk.exe (PID: 3344)

    • Writes file to Word startup folder

      • ryuk.exe (PID: 3344)

    • Renames files like Ransomware

      • ryuk.exe (PID: 3344)

    • Actions looks like stealing of personal data

      • ryuk.exe (PID: 3344)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ryuk.exe (PID: 3344)

    • Starts itself from another location

      • ryuk.exe (PID: 3344)

    • Starts CMD.EXE for commands execution

      • ryuk.exe (PID: 3344)

    • Creates files in the program directory

      • ryuk.exe (PID: 3344)
      • firefox.exe (PID: 73212)
      • NpdQrMrlHlan.exe (PID: 1364)

    • Uses ICACLS.EXE to modify access control list

      • ryuk.exe (PID: 3344)

    • Executed via COM

      • OpenWith.exe (PID: 73060)

    • Creates files like Ransomware instruction

      • ryuk.exe (PID: 3344)

    • Checks supported languages

      • OpenWith.exe (PID: 73060)

    • Creates files in the Windows directory

      • ryuk.exe (PID: 3344)

    • Creates files in the user directory

      • ryuk.exe (PID: 3344)

  • INFO

    • Reads Internet Cache Settings

      • firefox.exe (PID: 73212)

    • Reads CPU info

      • firefox.exe (PID: 73212)

    • Application launched itself

      • firefox.exe (PID: 73212)

    • Creates files in the user directory

      • firefox.exe (PID: 73212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

ProductVersion: 5.3.5.8
ProductName: ScratchingTreos
LegalCopyright: (C)Adobe Systems, Incorporated 2007-2015
FileDescription: Most Platter Keypress Yuve Opos
CompanyName: Adobe Systems, Incorporated
Comments: Most Platter Keypress Yuve Opos
LegalTrademarks: (C)Adobe Systems, Incorporated 2007-2015
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 5.3.5.8
FileVersionNumber: 5.3.5.8
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0xbc320
UninitializedDataSize: 380928
InitializedDataSize: 65536
CodeSize: 389120
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:01:27 15:12:52+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Jan-2020 14:12:52
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 27-Jan-2020 14:12:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x0005D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x0005E000
0x0005F000
0x0005E600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.89771
.rsrc
0x000BD000
0x000AE000
0x0000F600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.82209
.l2
0x0016B000
0x00034000
0x00034000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.48316

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00129
821
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.74604
16936
Latin 1 / Western European
English - United States
RT_ICON
3
5.859
9640
Latin 1 / Western European
English - United States
RT_ICON
4
6.02956
4264
Latin 1 / Western European
English - United States
RT_ICON
5
6.11353
2440
Latin 1 / Western European
English - United States
RT_ICON
6
6.04255
1128
Latin 1 / Western European
English - United States
RT_ICON
101
2.90476
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
102
7.68741
5801
Latin 1 / Western European
English - United States
TEMPLATES
692
7.90072
9884
Latin 1 / Western European
English - United States
SKINS
693
7.89268
9599
Latin 1 / Western European
English - United States
SKINS

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
CRYPT32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
MPR.dll
OLEACC.dll
OLEAUT32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
120
Monitored processes
84
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start #RYUK ryuk.exe npdqrmrlhlan.exe zcbtzvofelan.exe net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs net.exe no specs vssadmin.exe no specs bcdedit.exe no specs conhost.exe no specs bcdedit.exe no specs net1.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs conhost.exe no specs conhost.exe no specs net.exe no specs net.exe no specs conhost.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs openwith.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs firefox.exe net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe net.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3344"C:\Users\admin\AppData\Local\Temp\ryuk.exe" C:\Users\admin\AppData\Local\Temp\ryuk.exe
explorer.exe
User:
admin
Company:
Adobe Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Most Platter Keypress Yuve Opos
1364"C:\Users\admin\AppData\Local\Temp\NpdQrMrlHlan.exe" 8 LANC:\Users\admin\AppData\Local\Temp\NpdQrMrlHlan.exe
ryuk.exe
User:
admin
Company:
Adobe Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Most Platter Keypress Yuve Opos
3876"C:\Users\admin\AppData\Local\Temp\zCbTzvOfElan.exe" 8 LANC:\Users\admin\AppData\Local\Temp\zCbTzvOfElan.exe
ryuk.exe
User:
admin
Company:
Adobe Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Most Platter Keypress Yuve Opos
3560"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /yC:\Windows\System32\net.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.3.9600.17415 (winblue_r4.141028-1500)
3836\??\C:\Windows\system32\conhost.exe 0xffffffffC:\Windows\system32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
1736C:\Windows\system32\net1 stop "audioendpointbuilder" /yC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.3.9600.17415 (winblue_r4.141028-1500)
612"C:\Windows\System32\net.exe" stop "samss" /yC:\Windows\System32\net.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.3.9600.17415 (winblue_r4.141028-1500)
3132\??\C:\Windows\system32\conhost.exe 0xffffffffC:\Windows\system32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
3916C:\Windows\system32\net1 stop "samss" /yC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.3.9600.17415 (winblue_r4.141028-1500)
2444cmd.exe /c "WMIC.exe shadowcopy delete"C:\Windows\SYSTEM32\cmd.exe—ryuk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2147749908
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
Total events
1 384
Read events
1 320
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1 546
Text files
694
Unknown types
73

Dropped files

PID
Process
Filename
Type
3344ryuk.exeC:\ProgramData\Microsoft\User Account Pictures\admin.dat.RYK —
MD5:—
SHA256:—
3344ryuk.exeC:\$Recycle.Bin\S-1-5-21-2655973190-2785740294-2321183924-1001\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\ProgramData\Adobe\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\Users\admin\AppData\Local\Temp\NpdQrMrlHlan.exeexecutable
MD5:6BFDA9EF91AF32C3D47C521C5AAEA618
SHA256:D6E66598876136C507AADF10929E663F3CE109D1BC2EF88E3B02CC939458C450
3344ryuk.exeC:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\Transforms\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\Users\admin\AppData\Local\Temp\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\ProgramData\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\Users\Public\Documents\RyukReadMe.htmltext
MD5:848D9D87FE86F4DBA08DA8BEEBA241A4
SHA256:C36837A11BC7651C3EB5AA9262C90C00FE6EC8F898FE6CC71A33108074DD8787
3344ryuk.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_a089baac-824f-4418-8d0b-81b24b8ed1b5dbf
MD5:93A5AADEEC082FFC1BCA5AA27AF70F52
SHA256:A1A21799E98F97F271657CE656076F33DCB020D9370F1F2671D783CAFD230294
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
18
DNS requests
55
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
73212
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
73212
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
73212
firefox.exe
POST
200
172.217.16.131:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
73212
firefox.exe
GET
200
23.53.41.16:80
http://detectportal.firefox.com/success.txt
NL
text
8 b
whitelisted
73212
firefox.exe
GET
200
23.53.41.16:80
http://detectportal.firefox.com/success.txt
NL
text
8 b
whitelisted
73212
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
73212
firefox.exe
23.53.41.16:80
detectportal.firefox.com
Telia Company AB
NL
unknown
73212
firefox.exe
216.58.207.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
73212
firefox.exe
52.11.143.45:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
73212
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
192.168.100.146:59728
—
—
—
malicious
73212
firefox.exe
52.222.182.106:443
aus5.mozilla.org
Amazon.com, Inc.
US
unknown
73212
firefox.exe
52.222.182.107:443
snippets.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
—
—
192.168.100.146:59729
—
—
—
malicious
73212
firefox.exe
35.166.45.90:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 23.53.41.16
  • 23.53.40.248
whitelisted
a1089.dscd.akamai.net
  • 23.53.40.248
  • 23.53.41.16
whitelisted
aus5.mozilla.org
  • 52.222.182.106
  • 52.222.182.127
  • 52.222.182.102
  • 52.222.182.15
whitelisted
balrog-cloudfront.prod.mozaws.net
  • 52.222.182.15
  • 52.222.182.102
  • 52.222.182.127
  • 52.222.182.106
whitelisted
search.services.mozilla.com
  • 52.11.143.45
  • 52.38.153.3
  • 54.149.124.142
whitelisted
search.r53-2.services.mozilla.com
  • 54.149.124.142
  • 52.38.153.3
  • 52.11.143.45
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
snippets.cdn.mozilla.net
  • 52.222.182.107
  • 52.222.182.28
  • 52.222.182.85
  • 52.222.182.51
whitelisted
d228z91au11ukj.cloudfront.net
  • 52.222.182.51
  • 52.222.182.85
  • 52.222.182.28
  • 52.222.182.107
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
Process
Message
ryuk.exe
SHIMVIEW: ShimInfo(Complete)
NpdQrMrlHlan.exe
SHIMVIEW: ShimInfo(Complete)
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ryuk.exe