Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-03-2024 12:55
Behavioral task
behavioral1
Sample
Cynosys.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Cynosys.exe
-
Size
229KB
-
MD5
44712f3532cebbe19d97d59c16baad09
-
SHA1
77d521294b8deac4745dab8b843ebc5f875ac26c
-
SHA256
6dc0348b0f789df9b0f10d3ec7710be4b968f49c1dd047d3ac5402ad5e14fbd6
-
SHA512
06433d35fc99d4cf6b05322659672f41901bb788fde0e89a2e61b32fca33fb67fcf01a69d196adeafa7e90b254d2ca68a805cd612a5e2352fe0a9ba07dbcaf2a
-
SSDEEP
6144:lloZMxrIkd8g+EtXHkv/iD4wPAVdLocD0abtIExe5Y+lU8e1mXUi:noZiL+EP84AVdLocD0abtIExUIKd
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2192-0-0x00000000001B0000-0x00000000001F0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2192 Cynosys.exe Token: SeIncreaseQuotaPrivilege 2536 wmic.exe Token: SeSecurityPrivilege 2536 wmic.exe Token: SeTakeOwnershipPrivilege 2536 wmic.exe Token: SeLoadDriverPrivilege 2536 wmic.exe Token: SeSystemProfilePrivilege 2536 wmic.exe Token: SeSystemtimePrivilege 2536 wmic.exe Token: SeProfSingleProcessPrivilege 2536 wmic.exe Token: SeIncBasePriorityPrivilege 2536 wmic.exe Token: SeCreatePagefilePrivilege 2536 wmic.exe Token: SeBackupPrivilege 2536 wmic.exe Token: SeRestorePrivilege 2536 wmic.exe Token: SeShutdownPrivilege 2536 wmic.exe Token: SeDebugPrivilege 2536 wmic.exe Token: SeSystemEnvironmentPrivilege 2536 wmic.exe Token: SeRemoteShutdownPrivilege 2536 wmic.exe Token: SeUndockPrivilege 2536 wmic.exe Token: SeManageVolumePrivilege 2536 wmic.exe Token: 33 2536 wmic.exe Token: 34 2536 wmic.exe Token: 35 2536 wmic.exe Token: SeIncreaseQuotaPrivilege 2536 wmic.exe Token: SeSecurityPrivilege 2536 wmic.exe Token: SeTakeOwnershipPrivilege 2536 wmic.exe Token: SeLoadDriverPrivilege 2536 wmic.exe Token: SeSystemProfilePrivilege 2536 wmic.exe Token: SeSystemtimePrivilege 2536 wmic.exe Token: SeProfSingleProcessPrivilege 2536 wmic.exe Token: SeIncBasePriorityPrivilege 2536 wmic.exe Token: SeCreatePagefilePrivilege 2536 wmic.exe Token: SeBackupPrivilege 2536 wmic.exe Token: SeRestorePrivilege 2536 wmic.exe Token: SeShutdownPrivilege 2536 wmic.exe Token: SeDebugPrivilege 2536 wmic.exe Token: SeSystemEnvironmentPrivilege 2536 wmic.exe Token: SeRemoteShutdownPrivilege 2536 wmic.exe Token: SeUndockPrivilege 2536 wmic.exe Token: SeManageVolumePrivilege 2536 wmic.exe Token: 33 2536 wmic.exe Token: 34 2536 wmic.exe Token: 35 2536 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2536 2192 Cynosys.exe 28 PID 2192 wrote to memory of 2536 2192 Cynosys.exe 28 PID 2192 wrote to memory of 2536 2192 Cynosys.exe 28