Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 12:25
Behavioral task
behavioral1
Sample
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
-
Size
3.3MB
-
MD5
3d59117dde5704c16153ebf400e981d2
-
SHA1
8d6ffb65e2b8462cabbead01a87c4f5c0ad58a5d
-
SHA256
03fa67e4742681ac4b3c19356fb4164c97f2a2502f84a6d5d17df8c6d5efc295
-
SHA512
78e0b8ef63465ac5038d7c13515c8763256a72411ae8d9eaa2e04d5056f0b5171d9cc9c6b02bbb591872dff835e96beb493c11cd8841c42a5f202d8d848da669
-
SSDEEP
49152:mX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q0:mlRsZ47/QXoHUOfAoj1x60
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
wmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 3028 wmic.exe Token: SeSecurityPrivilege 3028 wmic.exe Token: SeTakeOwnershipPrivilege 3028 wmic.exe Token: SeLoadDriverPrivilege 3028 wmic.exe Token: SeSystemProfilePrivilege 3028 wmic.exe Token: SeSystemtimePrivilege 3028 wmic.exe Token: SeProfSingleProcessPrivilege 3028 wmic.exe Token: SeIncBasePriorityPrivilege 3028 wmic.exe Token: SeCreatePagefilePrivilege 3028 wmic.exe Token: SeBackupPrivilege 3028 wmic.exe Token: SeRestorePrivilege 3028 wmic.exe Token: SeShutdownPrivilege 3028 wmic.exe Token: SeDebugPrivilege 3028 wmic.exe Token: SeSystemEnvironmentPrivilege 3028 wmic.exe Token: SeRemoteShutdownPrivilege 3028 wmic.exe Token: SeUndockPrivilege 3028 wmic.exe Token: SeManageVolumePrivilege 3028 wmic.exe Token: 33 3028 wmic.exe Token: 34 3028 wmic.exe Token: 35 3028 wmic.exe Token: SeIncreaseQuotaPrivilege 3028 wmic.exe Token: SeSecurityPrivilege 3028 wmic.exe Token: SeTakeOwnershipPrivilege 3028 wmic.exe Token: SeLoadDriverPrivilege 3028 wmic.exe Token: SeSystemProfilePrivilege 3028 wmic.exe Token: SeSystemtimePrivilege 3028 wmic.exe Token: SeProfSingleProcessPrivilege 3028 wmic.exe Token: SeIncBasePriorityPrivilege 3028 wmic.exe Token: SeCreatePagefilePrivilege 3028 wmic.exe Token: SeBackupPrivilege 3028 wmic.exe Token: SeRestorePrivilege 3028 wmic.exe Token: SeShutdownPrivilege 3028 wmic.exe Token: SeDebugPrivilege 3028 wmic.exe Token: SeSystemEnvironmentPrivilege 3028 wmic.exe Token: SeRemoteShutdownPrivilege 3028 wmic.exe Token: SeUndockPrivilege 3028 wmic.exe Token: SeManageVolumePrivilege 3028 wmic.exe Token: 33 3028 wmic.exe Token: 34 3028 wmic.exe Token: 35 3028 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exedescription pid process target process PID 2056 wrote to memory of 3028 2056 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe wmic.exe PID 2056 wrote to memory of 3028 2056 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe wmic.exe PID 2056 wrote to memory of 3028 2056 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028