| File name: | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver |
| Full analysis: | https://app.any.run/tasks/50fa9120-3b19-41ab-95c4-c4c7f927cead |
| Verdict: | Malicious activity |
| Analysis date: | November 24, 2024, 14:47:22 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (console) x86-64, for MS Windows, 7 sections |
| MD5: | 0DEC7A4CDDCE109AA0751D76812BD1FA |
| SHA1: | 3D9CFCBA83FE1A0047CB404E48D6F95A58C7EFC8 |
| SHA256: | E12EF05B83961679C909608889B56E06E8229F87C0A3BD6D0616274DF9E457C0 |
| SSDEEP: | 98304:p/NkRdEtqLdOvOSWHO2mSxzbOep2irTPm0:n+dU0 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Uses WMIC.EXE to obtain operating system information
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
There is functionality for taking screenshot (YARA)
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Reads security settings of Internet Explorer
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
MeshAgent potential remote access (YARA)
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Application launched itself
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Reads the date of Windows installation
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Executable content was dropped or overwritten
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
Creates or modifies Windows services
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
Executes as Windows Service
- mpsvc.exe (PID: 720)
Creates a software uninstall entry
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
INFO
Reads the machine GUID from the registry
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
- mpsvc.exe (PID: 720)
Reads the computer name
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
- mpsvc.exe (PID: 720)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 3836)
The process uses the downloaded file
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Checks supported languages
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
- mpsvc.exe (PID: 720)
Process checks computer location settings
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 3812)
Creates files in the program directory
- 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe (PID: 2928)
- mpsvc.exe (PID: 720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2022:12:09 20:12:49+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14 |
| CodeSize: | 2122240 |
| InitializedDataSize: | 1293312 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1d9d8c |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | - |
| FileDescription: | - |
| FileVersion: | - |
| InternalName: | - |
| OriginalFileName: | - |
| ProductName: | System |
| ProductVersion: | Commit: 2022-Dec-2 11:42:16-0800 |
Total processes
120
Monitored processes
7
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 720 | "C:\Program Files\mpsvc\mpsvc.exe" --meshServiceName="mpsvc" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001" | C:\Program Files\mpsvc\mpsvc.exe | services.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Modules
| |||||||||||||||
| 2928 | "C:\Users\admin\Desktop\2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe" -fullinstall | C:\Users\admin\Desktop\2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3532 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3812 | "C:\Users\admin\Desktop\2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe" | C:\Users\admin\Desktop\2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3836 | wmic os get oslanguage /FORMAT:LIST | C:\Windows\System32\wbem\WMIC.exe | — | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4320 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6056 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | WMIC.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 417
Read events
1 398
Write events
19
Delete events
0
Modification events
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpsvc |
| Operation: | write | Name: | ImagePath |
Value: "C:\Program Files\mpsvc\mpsvc.exe" --meshServiceName="mpsvc" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001" | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mpsvc |
| Operation: | write | Name: | _InstalledBy |
Value: S-1-5-21-1693682860-607145093-2874071422-1001 | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | DisplayName |
Value: | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\mpsvc\mpsvc.exe | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\mpsvc\ | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | EstimatedSize |
Value: 3456 | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | NoRepair |
Value: 1 | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | UninstallString |
Value: C:\Program Files\mpsvc\mpsvc.exe -funinstall --meshServiceName="mpsvc" | |||
| (PID) Process: | (2928) 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpsvc |
| Operation: | write | Name: | DisplayVersion |
Value: 2022-12-02 19:42:16.000+00:00 | |||
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 720 | mpsvc.exe | C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\7C6B194E17D08C16BA1FAD614051E2F8150DDA81 | binary | |
MD5:5DAFF04FFAD1483DF75239633F481176 | SHA256:7BECA435121E0D168DFC55FA445C3F9BF007E3F5ED8ACC4CEB3AE72AA8D9EE95 | |||
| 720 | mpsvc.exe | C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\A329346CD9C56E968A2F0FF8BB52D8C9C38B411E | dbf | |
MD5:37CBDFEF0D3496F9EB567937C4786AC5 | SHA256:105199FD8CFF3CBF2BEE9AD2633C96EED9D601B6A32175D914F2C66714FB9CD7 | |||
| 720 | mpsvc.exe | C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\579E3EC8C7C63C1D316C07CDB4846118B821C215 | dbf | |
MD5:173230E6820530A05D1C222B53B49B7D | SHA256:6D910BB97B9C198BF9931E3FB309DFD5F4CC7F894D69DBC6106A3E7929539EB1 | |||
| 720 | mpsvc.exe | C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\7029ED8138721DF178C58E4BF573463998726CF3 | binary | |
MD5:1030E41FE8DE865954463C36640A9596 | SHA256:688EE7F22B532EC1632A3AE4263F3008121A97100C9664729584EE569FD12193 | |||
| 720 | mpsvc.exe | C:\Program Files\mpsvc\mpsvc.msh | text | |
MD5:E1BF97CE497D6F8581C579581F144724 | SHA256:33DF8BC44ED40E4062BA1A5114B1FF3CB7AE832C71B4F098BEFC4BF69A7EA75A | |||
| 2928 | 2024-11-24_0dec7a4cddce109aa0751d76812bd1fa_ismagent_ryuk_sliver.exe | C:\Program Files\mpsvc\mpsvc.exe | executable | |
MD5:0DEC7A4CDDCE109AA0751D76812BD1FA | SHA256:E12EF05B83961679C909608889B56E06E8229F87C0A3BD6D0616274DF9E457C0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
24
DNS requests
4
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 101 | 122.175.11.226:443 | https://remoteshare.in/agent.ashx | unknown | — | — | — |
— | — | GET | 101 | 116.73.117.214:443 | https://remoteshare.in/agent.ashx | unknown | — | — | — |
— | — | GET | 101 | 122.175.11.226:443 | https://remoteshare.in/agent.ashx | unknown | — | — | — |
— | — | GET | 101 | 116.73.117.214:443 | https://remoteshare.in/agent.ashx | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
720 | mpsvc.exe | 122.175.11.226:443 | remoteshare.in | Bharti Airtel Ltd., Telemedia Services | IN | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
remoteshare.in |
| unknown |
self.events.data.microsoft.com |
| whitelisted |