Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17-07-2023 23:59
Behavioral task
behavioral1
Sample
rc7.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
General
-
Target
rc7.exe
-
Size
235KB
-
MD5
fa5aa7c2bfbc245ebee8440c1b3defe4
-
SHA1
20ecd06fbedbb5bdd5f4e2f52d73009e046cc86a
-
SHA256
e9a5a1a833ca3d4c9cb4ffbc3df56b9afca877820407075819ffd44935220728
-
SHA512
415f11596e8e4f821be610beb75142597c324a1c600f6993aa21a64280e7333996eebea7ff308eb0aa4da44ab53d6b4bdf53fef2755924c1c4fcf5dfbf742371
-
SSDEEP
6144:BloZM+rIkd8g+EtXHkv/iD4y7IRbhS6FuAxDeebrtb8e1mM0Ii:zoZtL+EP8y7IRbhS6FuAxDeebBMx
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2284-54-0x0000000000160000-0x00000000001A0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2284 rc7.exe Token: SeIncreaseQuotaPrivilege 2920 wmic.exe Token: SeSecurityPrivilege 2920 wmic.exe Token: SeTakeOwnershipPrivilege 2920 wmic.exe Token: SeLoadDriverPrivilege 2920 wmic.exe Token: SeSystemProfilePrivilege 2920 wmic.exe Token: SeSystemtimePrivilege 2920 wmic.exe Token: SeProfSingleProcessPrivilege 2920 wmic.exe Token: SeIncBasePriorityPrivilege 2920 wmic.exe Token: SeCreatePagefilePrivilege 2920 wmic.exe Token: SeBackupPrivilege 2920 wmic.exe Token: SeRestorePrivilege 2920 wmic.exe Token: SeShutdownPrivilege 2920 wmic.exe Token: SeDebugPrivilege 2920 wmic.exe Token: SeSystemEnvironmentPrivilege 2920 wmic.exe Token: SeRemoteShutdownPrivilege 2920 wmic.exe Token: SeUndockPrivilege 2920 wmic.exe Token: SeManageVolumePrivilege 2920 wmic.exe Token: 33 2920 wmic.exe Token: 34 2920 wmic.exe Token: 35 2920 wmic.exe Token: SeIncreaseQuotaPrivilege 2920 wmic.exe Token: SeSecurityPrivilege 2920 wmic.exe Token: SeTakeOwnershipPrivilege 2920 wmic.exe Token: SeLoadDriverPrivilege 2920 wmic.exe Token: SeSystemProfilePrivilege 2920 wmic.exe Token: SeSystemtimePrivilege 2920 wmic.exe Token: SeProfSingleProcessPrivilege 2920 wmic.exe Token: SeIncBasePriorityPrivilege 2920 wmic.exe Token: SeCreatePagefilePrivilege 2920 wmic.exe Token: SeBackupPrivilege 2920 wmic.exe Token: SeRestorePrivilege 2920 wmic.exe Token: SeShutdownPrivilege 2920 wmic.exe Token: SeDebugPrivilege 2920 wmic.exe Token: SeSystemEnvironmentPrivilege 2920 wmic.exe Token: SeRemoteShutdownPrivilege 2920 wmic.exe Token: SeUndockPrivilege 2920 wmic.exe Token: SeManageVolumePrivilege 2920 wmic.exe Token: 33 2920 wmic.exe Token: 34 2920 wmic.exe Token: 35 2920 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2920 2284 rc7.exe 28 PID 2284 wrote to memory of 2920 2284 rc7.exe 28 PID 2284 wrote to memory of 2920 2284 rc7.exe 28