Analysis date (UTC): 5 October 2024, 22:21Analysis environment: Windows 10 Pro, build 19045, x64

slinky.exe

MD5:7E26817146B9CA70F5A1F271B381FDC8

SHA1:A87A69FA8C6833F818F878F6C5A5EC010B99DAE4

SHA256:CEEACED15D7A6D72BEA0AA59BB3CACCC5D5E0089B4B980658C5709D3F96B31FB

Analysis result

Threat level:Malicious activity

Tags:

evasiondiscordstealeruacexfiltrationsusp-powershellcrypto-regexdiscordgrabbergenericims-apiip-checkskuld

Full analysis:Analysis slinky.exe (MD5: 7E26817146B9CA70F5A1F271B381FDC8) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Bypass User Account Control (Modify registry)

slinky.exe (PID: 5632)

Actions looks like stealing of personal data

slinky.exe (PID: 6844)

Adds path to the Windows Defender exclusion list

slinky.exe (PID: 6844)

Steals credentials from Web Browsers

slinky.exe (PID: 6844)

Bypass execution policy to execute commands

powershell.exe (PID: 4236)

Changes powershell execution policy (Bypass)

slinky.exe (PID: 6844)

Windows Defender preferences modified via 'Set-MpPreference'

slinky.exe (PID: 6844)

SKULD has been detected (YARA)

slinky.exe (PID: 6844)

DISCORDGRABBER has been detected (YARA)

slinky.exe (PID: 6844)

SUSPICIOUS

Changes default file association

slinky.exe (PID: 5632)

Uses WMIC.EXE to obtain a list of video controllers

slinky.exe (PID: 6844)

Starts CMD.EXE for commands execution

slinky.exe (PID: 5632)

Read disk information to detect sandboxing environments

slinky.exe (PID: 6844)

Script adds exclusion path to Windows Defender

slinky.exe (PID: 6844)

Starts POWERSHELL.EXE for commands execution

slinky.exe (PID: 6844)

Uses WMIC.EXE to obtain operating system information

slinky.exe (PID: 6844)

Accesses operating system name via WMI (SCRIPT)

WMIC.exe (PID: 1684)

Uses WMIC.EXE to obtain CPU information

slinky.exe (PID: 6844)

The process bypasses the loading of PowerShell profile settings

slinky.exe (PID: 6844)

Base64-obfuscated command line is found

slinky.exe (PID: 6844)

Uses WMIC.EXE to obtain Windows Installer data

slinky.exe (PID: 6844)

Uses NETSH.EXE to obtain data on the network

slinky.exe (PID: 6844)

BASE64 encoded PowerShell command has been detected

slinky.exe (PID: 6844)

CSC.EXE is used to compile C# code

csc.exe (PID: 3824)

Executable content was dropped or overwritten

csc.exe (PID: 3824)

Script disables Windows Defender's real-time protection

slinky.exe (PID: 6844)

Script disables Windows Defender's IPS

slinky.exe (PID: 6844)

Checks for external IP

slinky.exe (PID: 6844)
svchost.exe (PID: 2256)

There is functionality for capture public ip (YARA)

slinky.exe (PID: 6844)

Possible usage of Discord/Telegram API has been detected (YARA)

slinky.exe (PID: 6844)

Uses ATTRIB.EXE to modify file attributes

slinky.exe (PID: 6844)

Found regular expressions for crypto-addresses (YARA)

slinky.exe (PID: 6844)

INFO

Checks supported languages

slinky.exe (PID: 5632)

Reads the computer name

slinky.exe (PID: 5632)

Drops encrypted JS script (Microsoft Script Encoder)

slinky.exe (PID: 5632)
slinky.exe (PID: 6844)

The process uses the downloaded file

cmd.exe (PID: 2340)

Sends debugging messages

slinky.exe (PID: 6844)

Reads security settings of Internet Explorer

WMIC.exe (PID: 1684)
WMIC.exe (PID: 4892)

Create files in a temporary directory

slinky.exe (PID: 6844)

Attempting to use instant messaging service

slinky.exe (PID: 6844)
svchost.exe (PID: 2256)

Found Base64 encoded reflection usage via PowerShell (YARA)

slinky.exe (PID: 6844)

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
—	—	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
—	—	Device Retrieving External IP Address Detected	ET POLICY External IP Lookup api.ipify.org
—	—	Device Retrieving External IP Address Detected	POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
—	—	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent
2256	svchost.exe	Device Retrieving External IP Address Detected	ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2256	svchost.exe	Device Retrieving External IP Address Detected	INFO [ANY.RUN] External IP Check (ip-api .com)
6844	slinky.exe	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent
6844	slinky.exe	Device Retrieving External IP Address Detected	ET POLICY External IP Lookup ip-api.com
2256	svchost.exe	Potentially Bad Traffic	ET INFO Online File Storage Domain in DNS Lookup (gofile .io)

Rows per page