Analysis
- max time kernel
95s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
02/10/2024, 12:25
Behavioral task
behavioral1
Sample
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe
- Size 3.3MB
- Sample241002-plq5hazcle
- SHA256 03fa67e4742681ac4b3c19356fb4164c97f2a2502f84a6d5d17df8c6d5efc295
- MD5 3d59117dde5704c16153ebf400e981d2
- SHA1 8d6ffb65e2b8462cabbead01a87c4f5c0ad58a5d
- SHA512 78e0b8ef63465ac5038d7c13515c8763256a72411ae8d9eaa2e04d5056f0b5171d9cc9c6b02bbb591872dff835e96beb493c11cd8841c42a5f202d8d848da669
- SSDEEP 49152:mX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q0:mlRsZ47/QXoHUOfAoj1x60
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4268 wmic.exe Token: SeSecurityPrivilege 4268 wmic.exe Token: SeTakeOwnershipPrivilege 4268 wmic.exe Token: SeLoadDriverPrivilege 4268 wmic.exe Token: SeSystemProfilePrivilege 4268 wmic.exe Token: SeSystemtimePrivilege 4268 wmic.exe Token: SeProfSingleProcessPrivilege 4268 wmic.exe Token: SeIncBasePriorityPrivilege 4268 wmic.exe Token: SeCreatePagefilePrivilege 4268 wmic.exe Token: SeBackupPrivilege 4268 wmic.exe Token: SeRestorePrivilege 4268 wmic.exe Token: SeShutdownPrivilege 4268 wmic.exe Token: SeDebugPrivilege 4268 wmic.exe Token: SeSystemEnvironmentPrivilege 4268 wmic.exe Token: SeRemoteShutdownPrivilege 4268 wmic.exe Token: SeUndockPrivilege 4268 wmic.exe Token: SeManageVolumePrivilege 4268 wmic.exe Token: 33 4268 wmic.exe Token: 34 4268 wmic.exe Token: 35 4268 wmic.exe Token: 36 4268 wmic.exe Token: SeIncreaseQuotaPrivilege 4268 wmic.exe Token: SeSecurityPrivilege 4268 wmic.exe Token: SeTakeOwnershipPrivilege 4268 wmic.exe Token: SeLoadDriverPrivilege 4268 wmic.exe Token: SeSystemProfilePrivilege 4268 wmic.exe Token: SeSystemtimePrivilege 4268 wmic.exe Token: SeProfSingleProcessPrivilege 4268 wmic.exe Token: SeIncBasePriorityPrivilege 4268 wmic.exe Token: SeCreatePagefilePrivilege 4268 wmic.exe Token: SeBackupPrivilege 4268 wmic.exe Token: SeRestorePrivilege 4268 wmic.exe Token: SeShutdownPrivilege 4268 wmic.exe Token: SeDebugPrivilege 4268 wmic.exe Token: SeSystemEnvironmentPrivilege 4268 wmic.exe Token: SeRemoteShutdownPrivilege 4268 wmic.exe Token: SeUndockPrivilege 4268 wmic.exe Token: SeManageVolumePrivilege 4268 wmic.exe Token: 33 4268 wmic.exe Token: 34 4268 wmic.exe Token: 35 4268 wmic.exe Token: 36 4268 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2392 wrote to memory of 4268 2392 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe 83 PID 2392 wrote to memory of 4268 2392 2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-02_3d59117dde5704c16153ebf400e981d2_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268
-