Analysis
-
max time kernel
99s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2023 22:43
Behavioral task
behavioral1
Sample
MemCheckRc7.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
General
-
Target
MemCheckRc7.exe
-
Size
227KB
-
MD5
ce368bd6492ca074696e36eb8faed831
-
SHA1
c0cc7d66fb33d6582aac9f0c13210268fb8b3942
-
SHA256
4b088d7a956ee6a1a11987fd7e1205265ad86925e8b5463c8e9b733f6af527e0
-
SHA512
58d3f38b4a77c20d17dcf2a90cc31772cc3ffed78aa6081e1382c5ad510c3af5e4a18745d04566193566c003e28449589dde5f472bc3e0872a0a3f4588fcd41b
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4mm8UCg/7IQR0STTKuUb8e1m9i:ooZtL+EP8mm8UCg/7IQR0STTKPP
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/220-133-0x00000123E1780000-0x00000123E17C0000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 220 MemCheckRc7.exe Token: SeIncreaseQuotaPrivilege 2516 wmic.exe Token: SeSecurityPrivilege 2516 wmic.exe Token: SeTakeOwnershipPrivilege 2516 wmic.exe Token: SeLoadDriverPrivilege 2516 wmic.exe Token: SeSystemProfilePrivilege 2516 wmic.exe Token: SeSystemtimePrivilege 2516 wmic.exe Token: SeProfSingleProcessPrivilege 2516 wmic.exe Token: SeIncBasePriorityPrivilege 2516 wmic.exe Token: SeCreatePagefilePrivilege 2516 wmic.exe Token: SeBackupPrivilege 2516 wmic.exe Token: SeRestorePrivilege 2516 wmic.exe Token: SeShutdownPrivilege 2516 wmic.exe Token: SeDebugPrivilege 2516 wmic.exe Token: SeSystemEnvironmentPrivilege 2516 wmic.exe Token: SeRemoteShutdownPrivilege 2516 wmic.exe Token: SeUndockPrivilege 2516 wmic.exe Token: SeManageVolumePrivilege 2516 wmic.exe Token: 33 2516 wmic.exe Token: 34 2516 wmic.exe Token: 35 2516 wmic.exe Token: 36 2516 wmic.exe Token: SeIncreaseQuotaPrivilege 2516 wmic.exe Token: SeSecurityPrivilege 2516 wmic.exe Token: SeTakeOwnershipPrivilege 2516 wmic.exe Token: SeLoadDriverPrivilege 2516 wmic.exe Token: SeSystemProfilePrivilege 2516 wmic.exe Token: SeSystemtimePrivilege 2516 wmic.exe Token: SeProfSingleProcessPrivilege 2516 wmic.exe Token: SeIncBasePriorityPrivilege 2516 wmic.exe Token: SeCreatePagefilePrivilege 2516 wmic.exe Token: SeBackupPrivilege 2516 wmic.exe Token: SeRestorePrivilege 2516 wmic.exe Token: SeShutdownPrivilege 2516 wmic.exe Token: SeDebugPrivilege 2516 wmic.exe Token: SeSystemEnvironmentPrivilege 2516 wmic.exe Token: SeRemoteShutdownPrivilege 2516 wmic.exe Token: SeUndockPrivilege 2516 wmic.exe Token: SeManageVolumePrivilege 2516 wmic.exe Token: 33 2516 wmic.exe Token: 34 2516 wmic.exe Token: 35 2516 wmic.exe Token: 36 2516 wmic.exe Token: SeDebugPrivilege 2744 taskmgr.exe Token: SeSystemProfilePrivilege 2744 taskmgr.exe Token: SeCreateGlobalPrivilege 2744 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 220 wrote to memory of 2516 220 MemCheckRc7.exe 84 PID 220 wrote to memory of 2516 220 MemCheckRc7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\MemCheckRc7.exe"C:\Users\Admin\AppData\Local\Temp\MemCheckRc7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ConvertRestart.vbs"1⤵PID:4276
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ConvertRestart.vbs"1⤵PID:2432
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2744