Skip to content

Report: full_cape_synthetic

Note

Generated by specimen report from a bundled fixture (trimmed public Avast-CTU report, or a synthetic one).

Verdict: suspicious (score 0.7396, confidence low-static/behavior-disagree)
Detonated: yes (recorded trace replay)

Static triage

score 0.3543 / entropy 0.0

  • pe_executable impact +0.80
  • few_imports impact +0.60

Behavior

P(malicious)=0.7396 label=suspicious scorer=api-ngram-lr (MalbehavD-V1) | family match unknown (closest: Zeus) (p=0.363, avast-ctu-logreg (behaviour+static))

  • writeprocessmemory = 0.3416, impact +0.82
  • createremotethread = 0.4172, impact +0.52
  • isdebuggerpresent = 0.1694, impact -0.42
  • regsetvalueexw = 0.1956, impact +0.36
  • deletefilew = 0.207, impact +0.33
  • deletefilew>ntopenfile = 0.5225, impact +0.14

Family evidence

Top tokens supporting unknown (closest: Zeus) (avast-ctu-logreg (behaviour+static)):

  • tech:T1055 (+0.433)
  • tech:T1622 (+0.384)
  • tactic:defense-evasion (+0.188)
  • file_delete_ext:exe (+0.185)
  • exec:cmd.exe (+0.145)
  • tech:T1070.004 (+0.115)

Timeline

t event ATT&CK anomaly
0.00 invoice_lab.exe called IsDebuggerPresent T1622 defense-evasion 1.0
0.00 invoice_lab.exe spawned cmd.exe `cmd.exe /c vssadmin delete shadows /all /quiet` T1490 impact 1.0
0.10 invoice_lab.exe created Global\LabMutex-77 1.0
0.20 invoice_lab.exe set HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\labupdater T1547.001 persistence 1.0
0.30 invoice_lab.exe injected into pid 3300 T1055 defense-evasion 1.0
0.40 invoice_lab.exe injected into pid 3300 T1055 defense-evasion 1.0
0.50 invoice_lab.exe deleted C:\Users\lab\Downloads\invoice_lab.exe T1070.004 defense-evasion 1.0
0.90 invoice_lab.exe wrote C:\Users\lab\AppData\Roaming\labupd.exe T1105 command-and-control 0.537
0.90 invoice_lab.exe resolved c2.lab[.]invalid T1071.004 command-and-control 0.451
0.91 invoice_lab.exe connected 203[.]0[.]113[.]66:8443 T1071 command-and-control 0.58

Provenance graph

flowchart LR
  n0["process: invoice_lab.exe (2100)"]
  n1["api: IsDebuggerPresent"]
  n2["process: cmd.exe (2200)"]
  n3["mutex: Global\LabMutex-77"]
  n4["registry: HKEY_CURRENT_USER\Software\Mi~\CurrentVersion\Run\labupdater"]
  n5["process: pid 3300 (3300)"]
  n6["file: C:\Users\lab\Downloads\invoice_lab.exe"]
  n7["process: invoice_lab.exe (1000)"]
  n8["file: C:\Users\lab\AppData\Roaming\labupd.exe"]
  n9["domain: c2.lab[.]invalid"]
  n10["network: 203[.]0[.]113[.]66:8443"]
  n0 -->|"called"| n1
  n0 -->|"spawned"| n2
  n0 -->|"created"| n3
  n0 -->|"set"| n4
  n0 -->|"injected"| n5
  n0 -->|"injected"| n5
  n0 -->|"deleted"| n6
  n7 -->|"wrote"| n8
  n7 -->|"resolved"| n9
  n7 -->|"connected"| n10

IOCs (defanged)

  • network: 203[.]0[.]113[.]66:8443
  • domains: c2.lab[.]invalid
  • dropped_files: C:\Users\lab\AppData\Roaming\labupd.exe
  • registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\labupdater

Sigma 1 - file_event

title: 'SPECIMEN auto - file_event pattern'
status: experimental
description: Auto-synthesized from one sandbox run of 5d1f0a0c3a2f7e6b; generalisation rung 2; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
tags:
    - attack.t1105
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\\Users\\*\\AppData\\*\\labupd.exe'
    condition: selection
level: medium

Sigma 2 - process_creation

title: 'SPECIMEN auto - process_creation pattern'
status: experimental
description: Auto-synthesized from one sandbox run of 5d1f0a0c3a2f7e6b; generalisation rung 0; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image: 'cmd.exe'
        CommandLine: '*/c vssadmin delete shadows /all /quiet*'
    condition: selection
level: medium

Sigma 3 - registry_set

title: 'SPECIMEN auto - registry_set pattern'
status: experimental
description: Auto-synthesized from one sandbox run of 5d1f0a0c3a2f7e6b; generalisation rung 0; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
tags:
    - attack.t1547.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject: 'HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\labupdater'
    condition: selection
level: medium

Specificity: 0 Sigma candidate(s) dropped because no generalisation rung was specific enough.

Evidence manifest

{
  "sample_sha256": "5d1f0a0c3a2f7e6b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b",
  "trace_sha256": "1c6780cf6a678c2cc7b0d0f74d9677973ae5e1129642ec16cbf156ade159800d",
  "trace_run_id": "full_cape_synthetic",
  "python": "3.12.14",
  "specimen_version": "1.1.4",
  "execution": "report-only (sandbox report replay; no sample bytes handled)",
  "report_content_sha256": "7c763dc585a8418b9b37c08cd12e811ae4f09e31383898da4025d44901150879",
  "report_sha256": "1c6780cf6a678c2cc7b0d0f74d9677973ae5e1129642ec16cbf156ade159800d",
  "negative_corpus": {
    "packaged": true,
    "excluded_family": "Zeus"
  },
  "behaviour_model": {
    "path": "specimen/data/api_behaviour.json",
    "sha256": "2a4ee22390a10061ea420e7817fe1181f42f0c316d7f9537028b1d8c479a73f9"
  }
}