Skip to content

Report: Sysmon lab run

Note

Generated by specimen analyze --force-detonate from the inert lab_sample.bin and the synthetic Sysmon XML export bound to it.

Verdict: malicious (score 0.98, confidence medium (behavior-driven))
Detonated: yes (recorded trace replay)

Static triage

score 0.1192 / entropy 4.5124

  • no suspicious static features

Behavior

P(malicious)=0.98 label=malicious scorer=mvp-synthetic-logreg (ATT&CK features) | family match sim-persist-loader (jaccard 0.714)

  • n_drop = 0.6931, impact +1.74
  • n_inject = 0.6931, impact +1.34
  • n_persist = 0.6931, impact +1.18
  • frac_suspicious = 0.5, impact +0.80
  • n_exec_script = 0.6931, impact +0.51
  • n_c2 = 1.0986, impact -0.10

Timeline

t event ATT&CK anomaly
0.00 C:\Windows\explorer.exe spawned C:\Users\lab\Desktop\sample.exe `"C:\Users\lab\Desktop\sample.exe"` 1.0
1.15 C:\Users\lab\Desktop\sample.exe spawned C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe `powershell.exe -nop -w hidden -enc SQBFAFgA` T1059.001 execution 1.0
1.90 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe resolved update.example[.]invalid T1071.004 command-and-control 0.451
2.30 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe connected 203[.]0[.]113[.]10:443 T1071 command-and-control 0.58
2.90 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe wrote C:\Users\lab\AppData\Roaming\svcupd.exe T1105 command-and-control 0.537
3.50 C:\Users\lab\Desktop\sample.exe set HKU\S-1-5-21-1\Software\Microsoft\Windows\CurrentVersion\Run\svcupd T1547.001 persistence 1.0
3.90 C:\Users\lab\Desktop\sample.exe injected into pid 900 T1055 defense-evasion 1.0
4.90 C:\Users\lab\Desktop\sample.exe deleted C:\Users\lab\Desktop\sample.exe T1070.004 defense-evasion 1.0

Provenance graph

flowchart LR
  n0["process: C:\Windows\explorer.exe (3100)"]
  n1["process: C:\Users\lab\Desktop\sample.exe (4200)"]
  n2["process: C:\Windows\System32\WindowsPo~ell\v1.0\powershell.exe (4300)"]
  n3["domain: update.example[.]invalid"]
  n4["network: 203[.]0[.]113[.]10:443"]
  n5["file: C:\Users\lab\AppData\Roaming\svcupd.exe"]
  n6["registry: HKU\S-1-5-21-1\Software\Micro~dows\CurrentVersion\Run\svcupd"]
  n7["process: pid 900 (-1)"]
  n8["file: C:\Users\lab\Desktop\sample.exe"]
  n0 -->|"spawned"| n1
  n1 -->|"spawned"| n2
  n2 -->|"resolved"| n3
  n2 -->|"connected"| n4
  n2 -->|"wrote"| n5
  n1 -->|"set"| n6
  n1 -->|"injected"| n7
  n1 -->|"deleted"| n8

IOCs (defanged)

  • network: 203[.]0[.]113[.]10:443
  • domains: update.example[.]invalid
  • dropped_files: C:\Users\lab\AppData\Roaming\svcupd.exe
  • registry: HKU\S-1-5-21-1\Software\Microsoft\Windows\CurrentVersion\Run\svcupd

Sigma 1 - file_event

title: 'SPECIMEN auto - file_event pattern'
status: experimental
description: Auto-synthesized from one sandbox run of b81a2a0872b6f42e; generalisation rung 2; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
tags:
    - attack.t1105
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\\Users\\*\\AppData\\*\\svcupd.exe'
    condition: selection
level: medium

Sigma 2 - registry_set

title: 'SPECIMEN auto - registry_set pattern'
status: experimental
description: Auto-synthesized from one sandbox run of b81a2a0872b6f42e; generalisation rung 1; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
tags:
    - attack.t1547.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject: 'HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*'
    condition: selection
level: medium

Sigma 3 - process_creation

title: 'SPECIMEN auto - process_creation pattern'
status: experimental
description: Auto-synthesized from one sandbox run of b81a2a0872b6f42e; generalisation rung 0; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image: 'C:\\Users\\*\\Desktop\\sample.exe'
    condition: selection
level: medium

Sigma 4 - process_creation

title: 'SPECIMEN auto - process_creation pattern'
status: experimental
description: Auto-synthesized from one sandbox run of b81a2a0872b6f42e; generalisation rung 0; zero hits on the negative corpus at synthesis time. Review before deploy.
author: SPECIMEN
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image: 'powershell.exe'
    condition: selection
level: medium

Specificity: 0 Sigma candidate(s) dropped because no generalisation rung was specific enough.

Evidence manifest

{
  "sample_sha256": "b81a2a0872b6f42e1237dd33a08f48f687d7e1a4747be20c8805117148039bba",
  "trace_sha256": "55e2dfc4fbb59aeaed456c996efad13c541aec2eb786325b87ba9e92cfc7ac96",
  "trace_run_id": "lab_run",
  "python": "3.12.14",
  "specimen_version": "1.1.4",
  "execution": "trace-replay (no live detonation)",
  "trace_binding": "bound: the trace records this sample's SHA-256",
  "report_content_sha256": "c10af5e3c67479d618a0e546d77fd8ed5a6085ac531ff81eb3123780782a9855",
  "negative_corpus": {
    "packaged": true,
    "excluded_family": null
  }
}