Overview
overview
7Static
static
7SkySky/Man...co.exe
windows7-x64
7SkySky/Man...co.exe
windows10-2004-x64
7SkySky/QQMusic.dll
windows7-x64
3SkySky/QQMusic.dll
windows10-2004-x64
3SkySky/Test.dll
windows7-x64
3SkySky/Test.dll
windows10-2004-x64
3SkySky/_1.dll
windows7-x64
3SkySky/_1.dll
windows10-2004-x64
3SkySky/_2.dll
windows7-x64
1SkySky/_2.dll
windows10-2004-x64
3SkySky/fntestdll.dll
windows7-x64
3SkySky/fntestdll.dll
windows10-2004-x64
5SkySky/vcr...40.dll
windows7-x64
1SkySky/vcr...40.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07-09-2023 09:51
Behavioral task
behavioral1
Sample
SkySky/ManicTimeVico.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
SkySky/ManicTimeVico.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SkySky/QQMusic.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral4
Sample
SkySky/QQMusic.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SkySky/Test.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral6
Sample
SkySky/Test.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SkySky/_1.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral8
Sample
SkySky/_1.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SkySky/_2.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral10
Sample
SkySky/_2.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SkySky/fntestdll.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral12
Sample
SkySky/fntestdll.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SkySky/vcruntime140.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral14
Sample
SkySky/vcruntime140.dll
Resource
win10v2004-20230831-en
windows10-2004-x64
General
-
Target
SkySky/ManicTimeVico.exe
-
Size
623KB
-
MD5
d9746c8d55bed7b372ccef704f96ddda
-
SHA1
61c6b8ba9108fc7617264bb7d58e163457946e5b
-
SHA256
afbfea15784c32277edf9d4c985d210c5c46baef46db1c6bed2d2a964d2b70fd
-
SHA512
e00d687bd7cee039c6eddddab2b89e26136f842bda19630de53220f3459a73a4bd2ba0c76267b977e265d7cdf98d21cd94d327fa143477a427ccd0a5fd57910e
-
SSDEEP
12288:N7djaB7OoRTQTR7djaB7OoRTQTDiiiiiiiiiiiiii:rGBJRTQTHGBJRTQTDiiiiiiiiiiiiii
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1772-8-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-11-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-13-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1584-21-0x0000000001C00000-0x0000000001C39000-memory.dmp upx behavioral1/memory/1584-25-0x0000000001C00000-0x0000000001C39000-memory.dmp upx behavioral1/memory/1772-40-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-56-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-55-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-54-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx behavioral1/memory/1772-57-0x0000000001DD0000-0x0000000001E09000-memory.dmp upx -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\LOWORCAPP = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\WallPaper.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CORCentRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\MiniStorPlay.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ManisORRun = "C:\\Users\\Public\\Documents\\RECSLLE.BIN\\system\\QQMusic.exe" rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe 1772 ManicTimeVico.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2548 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe Token: SeRestorePrivilege 2516 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1584 1772 ManicTimeVico.exe 28 PID 1772 wrote to memory of 1584 1772 ManicTimeVico.exe 28 PID 1772 wrote to memory of 1584 1772 ManicTimeVico.exe 28 PID 1772 wrote to memory of 1584 1772 ManicTimeVico.exe 28 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2548 1772 ManicTimeVico.exe 29 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30 PID 1772 wrote to memory of 2516 1772 ManicTimeVico.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\SkySky\ManicTimeVico.exe"C:\Users\Admin\AppData\Local\Temp\SkySky\ManicTimeVico.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\SkySky\ManicTimeVico.exe"C:\Users\Admin\AppData\Local\Temp\SkySky\ManicTimeVico.exe"2⤵PID:1584
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,322⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" advpack.dll,LaunchINFSectionEx C:\Users\Admin\AppData\Roaming\apple\Runinf.inf ,DefaultInstall,,322⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
826B
MD562bb69ff89b339b279b69d1a13e9294e
SHA16a4daa541fea6807fd50bb2cc47e4e75be40a593
SHA256cd1ed1c4d9194b87b10e0869af03bcecf01c084a1ba3b933bbb7468db89c0bad
SHA512a45fd7b3b7d387e31285a20cc8c6aaa2a4630b08d9cedcd663e13659d56049d75017fdeca171c997d5e02857c945f56917776d4fd80a0c8f7966942116d5b8e6
-
Filesize
918B
MD575e1faaad7962900effbb8f1553edac0
SHA1efe98c3167ee337c1724173d6c43ddd91f097c27
SHA2568b905fc3a4d85b3c9a1a5dbf0244caebc4a9e9b01056f83ab166852ab88b9d9a
SHA51231a50f7e929ea97f8d2992b5fc78356d7e0c0772f764468c348b482bf605c1f40e904fa256746e94e565665804686692a569cc9d98d63a1c23cfbc42da12f633