Analysis
- max time kernel
133s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
29/08/2024, 00:49
Behavioral task
behavioral1
Sample
2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe
- Size 3.3MB
- Sample240829-a6f3psvfma
- SHA256 7801999b550a9d0f4e417cb797ff32815a813c6dc2b0473cd8af9473b76428df
- MD5 2bd8f78877a21b8c250264a9ec5256ec
- SHA1 32f395998abf6246b5607fcfb7a072844edadf7f
- SHA512 303f7796f7be6e60b1949a7ec08ae5880cfe88f1681bd03076ef23a2c0a37bdf166307413e9ac5c7a4689c1cedb7656c343deb5542a3420e6f04f8ae701247e8
- SSDEEP 49152:JX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQet5i:JlRsZ47/QXoHUOfAoj14U
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 224 wmic.exe Token: SeSecurityPrivilege 224 wmic.exe Token: SeTakeOwnershipPrivilege 224 wmic.exe Token: SeLoadDriverPrivilege 224 wmic.exe Token: SeSystemProfilePrivilege 224 wmic.exe Token: SeSystemtimePrivilege 224 wmic.exe Token: SeProfSingleProcessPrivilege 224 wmic.exe Token: SeIncBasePriorityPrivilege 224 wmic.exe Token: SeCreatePagefilePrivilege 224 wmic.exe Token: SeBackupPrivilege 224 wmic.exe Token: SeRestorePrivilege 224 wmic.exe Token: SeShutdownPrivilege 224 wmic.exe Token: SeDebugPrivilege 224 wmic.exe Token: SeSystemEnvironmentPrivilege 224 wmic.exe Token: SeRemoteShutdownPrivilege 224 wmic.exe Token: SeUndockPrivilege 224 wmic.exe Token: SeManageVolumePrivilege 224 wmic.exe Token: 33 224 wmic.exe Token: 34 224 wmic.exe Token: 35 224 wmic.exe Token: 36 224 wmic.exe Token: SeIncreaseQuotaPrivilege 224 wmic.exe Token: SeSecurityPrivilege 224 wmic.exe Token: SeTakeOwnershipPrivilege 224 wmic.exe Token: SeLoadDriverPrivilege 224 wmic.exe Token: SeSystemProfilePrivilege 224 wmic.exe Token: SeSystemtimePrivilege 224 wmic.exe Token: SeProfSingleProcessPrivilege 224 wmic.exe Token: SeIncBasePriorityPrivilege 224 wmic.exe Token: SeCreatePagefilePrivilege 224 wmic.exe Token: SeBackupPrivilege 224 wmic.exe Token: SeRestorePrivilege 224 wmic.exe Token: SeShutdownPrivilege 224 wmic.exe Token: SeDebugPrivilege 224 wmic.exe Token: SeSystemEnvironmentPrivilege 224 wmic.exe Token: SeRemoteShutdownPrivilege 224 wmic.exe Token: SeUndockPrivilege 224 wmic.exe Token: SeManageVolumePrivilege 224 wmic.exe Token: 33 224 wmic.exe Token: 34 224 wmic.exe Token: 35 224 wmic.exe Token: 36 224 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4312 wrote to memory of 224 4312 2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe 86 PID 4312 wrote to memory of 224 4312 2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_2bd8f78877a21b8c250264a9ec5256ec_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:224
-