a145ed4548a7450ccd70b2062f79ff7af57d11c0b7f55af14fe301b21f55c99a | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 16:13

Sharing

Report Analysis Logs

General

Target

Umbral-Stealer-main/Umbral.builder/packages.config
Size

290B
MD5

8d27d393afa23117e10adccd73a0db08
SHA1

8743df90b8f1f7fedf5cd74142ce40d38b66168e
SHA256

b707717ed529ff1bfc12099592822efc5a7e5d8387a44bf99c1989bfa2eb4881
SHA512

2ecb46f66164eadf07be2f92f813b4c6cff411541b18b9f71dc183fa0a1c2f6f0cec27852a0d5bffce31ecaae22b1aa34efebe5d29ff4269d3b522c22725f5d2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Umbral-Stealer-main\Umbral.builder\packages.config
1⤵
- Modifies registry class
PID:1260

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...