Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 17:17
Behavioral task
behavioral1
Sample
202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe
Resource
win7-20240903-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe
-
Size
3.3MB
-
MD5
3d59117dde5704c16153ebf400e981d2
-
SHA1
8d6ffb65e2b8462cabbead01a87c4f5c0ad58a5d
-
SHA256
03fa67e4742681ac4b3c19356fb4164c97f2a2502f84a6d5d17df8c6d5efc295
-
SHA512
78e0b8ef63465ac5038d7c13515c8763256a72411ae8d9eaa2e04d5056f0b5171d9cc9c6b02bbb591872dff835e96beb493c11cd8841c42a5f202d8d848da669
-
SSDEEP
49152:mX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q0:mlRsZ47/QXoHUOfAoj1x60
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
wmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2512 wmic.exe Token: SeSecurityPrivilege 2512 wmic.exe Token: SeTakeOwnershipPrivilege 2512 wmic.exe Token: SeLoadDriverPrivilege 2512 wmic.exe Token: SeSystemProfilePrivilege 2512 wmic.exe Token: SeSystemtimePrivilege 2512 wmic.exe Token: SeProfSingleProcessPrivilege 2512 wmic.exe Token: SeIncBasePriorityPrivilege 2512 wmic.exe Token: SeCreatePagefilePrivilege 2512 wmic.exe Token: SeBackupPrivilege 2512 wmic.exe Token: SeRestorePrivilege 2512 wmic.exe Token: SeShutdownPrivilege 2512 wmic.exe Token: SeDebugPrivilege 2512 wmic.exe Token: SeSystemEnvironmentPrivilege 2512 wmic.exe Token: SeRemoteShutdownPrivilege 2512 wmic.exe Token: SeUndockPrivilege 2512 wmic.exe Token: SeManageVolumePrivilege 2512 wmic.exe Token: 33 2512 wmic.exe Token: 34 2512 wmic.exe Token: 35 2512 wmic.exe Token: SeIncreaseQuotaPrivilege 2512 wmic.exe Token: SeSecurityPrivilege 2512 wmic.exe Token: SeTakeOwnershipPrivilege 2512 wmic.exe Token: SeLoadDriverPrivilege 2512 wmic.exe Token: SeSystemProfilePrivilege 2512 wmic.exe Token: SeSystemtimePrivilege 2512 wmic.exe Token: SeProfSingleProcessPrivilege 2512 wmic.exe Token: SeIncBasePriorityPrivilege 2512 wmic.exe Token: SeCreatePagefilePrivilege 2512 wmic.exe Token: SeBackupPrivilege 2512 wmic.exe Token: SeRestorePrivilege 2512 wmic.exe Token: SeShutdownPrivilege 2512 wmic.exe Token: SeDebugPrivilege 2512 wmic.exe Token: SeSystemEnvironmentPrivilege 2512 wmic.exe Token: SeRemoteShutdownPrivilege 2512 wmic.exe Token: SeUndockPrivilege 2512 wmic.exe Token: SeManageVolumePrivilege 2512 wmic.exe Token: 33 2512 wmic.exe Token: 34 2512 wmic.exe Token: 35 2512 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
202410023d59117dde5704c16153ebf400e981d2ryuksliver.exedescription pid process target process PID 2420 wrote to memory of 2512 2420 202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe wmic.exe PID 2420 wrote to memory of 2512 2420 202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe wmic.exe PID 2420 wrote to memory of 2512 2420 202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe"C:\Users\Admin\AppData\Local\Temp\202410023d59117dde5704c16153ebf400e981d2ryuksliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512