Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe
-
Size
3.3MB
-
MD5
07a92fb246b33d9679c7a305b6825f0c
-
SHA1
d93de82a29b3982a9f076d7c30ab45a2064488a3
-
SHA256
ad993ba8cbeca459aaa36b5c11811ad811b1160e4f29c8b77825524e2f0553bb
-
SHA512
031a276169992a93382d166bf9d8e68a51c3cbaeb9ec934f72aa2d383d1b2f8dab8aa76c71baf7717467e13929bf46d632e0302044bb52d6ab224c4220461e6c
-
SSDEEP
49152:AX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QL:AlRsZ47/QXoHUOfAoj1x6L
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3668 wmic.exe Token: SeSecurityPrivilege 3668 wmic.exe Token: SeTakeOwnershipPrivilege 3668 wmic.exe Token: SeLoadDriverPrivilege 3668 wmic.exe Token: SeSystemProfilePrivilege 3668 wmic.exe Token: SeSystemtimePrivilege 3668 wmic.exe Token: SeProfSingleProcessPrivilege 3668 wmic.exe Token: SeIncBasePriorityPrivilege 3668 wmic.exe Token: SeCreatePagefilePrivilege 3668 wmic.exe Token: SeBackupPrivilege 3668 wmic.exe Token: SeRestorePrivilege 3668 wmic.exe Token: SeShutdownPrivilege 3668 wmic.exe Token: SeDebugPrivilege 3668 wmic.exe Token: SeSystemEnvironmentPrivilege 3668 wmic.exe Token: SeRemoteShutdownPrivilege 3668 wmic.exe Token: SeUndockPrivilege 3668 wmic.exe Token: SeManageVolumePrivilege 3668 wmic.exe Token: 33 3668 wmic.exe Token: 34 3668 wmic.exe Token: 35 3668 wmic.exe Token: 36 3668 wmic.exe Token: SeIncreaseQuotaPrivilege 3668 wmic.exe Token: SeSecurityPrivilege 3668 wmic.exe Token: SeTakeOwnershipPrivilege 3668 wmic.exe Token: SeLoadDriverPrivilege 3668 wmic.exe Token: SeSystemProfilePrivilege 3668 wmic.exe Token: SeSystemtimePrivilege 3668 wmic.exe Token: SeProfSingleProcessPrivilege 3668 wmic.exe Token: SeIncBasePriorityPrivilege 3668 wmic.exe Token: SeCreatePagefilePrivilege 3668 wmic.exe Token: SeBackupPrivilege 3668 wmic.exe Token: SeRestorePrivilege 3668 wmic.exe Token: SeShutdownPrivilege 3668 wmic.exe Token: SeDebugPrivilege 3668 wmic.exe Token: SeSystemEnvironmentPrivilege 3668 wmic.exe Token: SeRemoteShutdownPrivilege 3668 wmic.exe Token: SeUndockPrivilege 3668 wmic.exe Token: SeManageVolumePrivilege 3668 wmic.exe Token: 33 3668 wmic.exe Token: 34 3668 wmic.exe Token: 35 3668 wmic.exe Token: 36 3668 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4424 wrote to memory of 3668 4424 2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe 87 PID 4424 wrote to memory of 3668 4424 2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_07a92fb246b33d9679c7a305b6825f0c_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668
-