Analysis
-
max time kernel
35s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 12:55
Behavioral task
behavioral1
Sample
Cynosys.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Cynosys.exe
-
Size
229KB
-
MD5
44712f3532cebbe19d97d59c16baad09
-
SHA1
77d521294b8deac4745dab8b843ebc5f875ac26c
-
SHA256
6dc0348b0f789df9b0f10d3ec7710be4b968f49c1dd047d3ac5402ad5e14fbd6
-
SHA512
06433d35fc99d4cf6b05322659672f41901bb788fde0e89a2e61b32fca33fb67fcf01a69d196adeafa7e90b254d2ca68a805cd612a5e2352fe0a9ba07dbcaf2a
-
SSDEEP
6144:lloZMxrIkd8g+EtXHkv/iD4wPAVdLocD0abtIExe5Y+lU8e1mXUi:noZiL+EP84AVdLocD0abtIExUIKd
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3180-0-0x0000018A7E040000-0x0000018A7E080000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1792 taskmgr.exe 1792 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3180 Cynosys.exe Token: SeIncreaseQuotaPrivilege 1808 wmic.exe Token: SeSecurityPrivilege 1808 wmic.exe Token: SeTakeOwnershipPrivilege 1808 wmic.exe Token: SeLoadDriverPrivilege 1808 wmic.exe Token: SeSystemProfilePrivilege 1808 wmic.exe Token: SeSystemtimePrivilege 1808 wmic.exe Token: SeProfSingleProcessPrivilege 1808 wmic.exe Token: SeIncBasePriorityPrivilege 1808 wmic.exe Token: SeCreatePagefilePrivilege 1808 wmic.exe Token: SeBackupPrivilege 1808 wmic.exe Token: SeRestorePrivilege 1808 wmic.exe Token: SeShutdownPrivilege 1808 wmic.exe Token: SeDebugPrivilege 1808 wmic.exe Token: SeSystemEnvironmentPrivilege 1808 wmic.exe Token: SeRemoteShutdownPrivilege 1808 wmic.exe Token: SeUndockPrivilege 1808 wmic.exe Token: SeManageVolumePrivilege 1808 wmic.exe Token: 33 1808 wmic.exe Token: 34 1808 wmic.exe Token: 35 1808 wmic.exe Token: 36 1808 wmic.exe Token: SeDebugPrivilege 1792 taskmgr.exe Token: SeSystemProfilePrivilege 1792 taskmgr.exe Token: SeCreateGlobalPrivilege 1792 taskmgr.exe Token: SeIncreaseQuotaPrivilege 1808 wmic.exe Token: SeSecurityPrivilege 1808 wmic.exe Token: SeTakeOwnershipPrivilege 1808 wmic.exe Token: SeLoadDriverPrivilege 1808 wmic.exe Token: SeSystemProfilePrivilege 1808 wmic.exe Token: SeSystemtimePrivilege 1808 wmic.exe Token: SeProfSingleProcessPrivilege 1808 wmic.exe Token: SeIncBasePriorityPrivilege 1808 wmic.exe Token: SeCreatePagefilePrivilege 1808 wmic.exe Token: SeBackupPrivilege 1808 wmic.exe Token: SeRestorePrivilege 1808 wmic.exe Token: SeShutdownPrivilege 1808 wmic.exe Token: SeDebugPrivilege 1808 wmic.exe Token: SeSystemEnvironmentPrivilege 1808 wmic.exe Token: SeRemoteShutdownPrivilege 1808 wmic.exe Token: SeUndockPrivilege 1808 wmic.exe Token: SeManageVolumePrivilege 1808 wmic.exe Token: 33 1808 wmic.exe Token: 34 1808 wmic.exe Token: 35 1808 wmic.exe Token: 36 1808 wmic.exe Token: 33 1792 taskmgr.exe Token: SeIncBasePriorityPrivilege 1792 taskmgr.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe 1792 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3180 wrote to memory of 1808 3180 Cynosys.exe 90 PID 3180 wrote to memory of 1808 3180 Cynosys.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cynosys.exe"C:\Users\Admin\AppData\Local\Temp\Cynosys.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1792
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4436