Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
07/08/2023, 14:16
Behavioral task
behavioral1
Sample
ManualWin10 (2).exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
General
-
Target
ManualWin10 (2).exe
-
Size
227KB
-
MD5
badc4c0e18209e84ab24fe8cccb5d1c9
-
SHA1
736fb2619ea2bab1992b6f6f7ac34a7dc315b565
-
SHA256
ebdb426e69d0c9f964fe2180372dbb24556588c8dfb37e6cb0d5f7ea5ba0c087
-
SHA512
0cf7d30ce41005e6aede39fff624c75e875fe5c0cf20adcf202a27c5459e437e1ce4dae9f7ecf1a75f8de0913401f390da64d96f2dfddc768bc95c4ee4eabff5
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4UxRPdmkrHMx9YW3X2ZNb8e1mbi:IoZtL+EP8UxRPdmkrHMx9YW3X2nV
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2888-54-0x00000000012B0000-0x00000000012F0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2888 ManualWin10 (2).exe Token: SeIncreaseQuotaPrivilege 2932 wmic.exe Token: SeSecurityPrivilege 2932 wmic.exe Token: SeTakeOwnershipPrivilege 2932 wmic.exe Token: SeLoadDriverPrivilege 2932 wmic.exe Token: SeSystemProfilePrivilege 2932 wmic.exe Token: SeSystemtimePrivilege 2932 wmic.exe Token: SeProfSingleProcessPrivilege 2932 wmic.exe Token: SeIncBasePriorityPrivilege 2932 wmic.exe Token: SeCreatePagefilePrivilege 2932 wmic.exe Token: SeBackupPrivilege 2932 wmic.exe Token: SeRestorePrivilege 2932 wmic.exe Token: SeShutdownPrivilege 2932 wmic.exe Token: SeDebugPrivilege 2932 wmic.exe Token: SeSystemEnvironmentPrivilege 2932 wmic.exe Token: SeRemoteShutdownPrivilege 2932 wmic.exe Token: SeUndockPrivilege 2932 wmic.exe Token: SeManageVolumePrivilege 2932 wmic.exe Token: 33 2932 wmic.exe Token: 34 2932 wmic.exe Token: 35 2932 wmic.exe Token: SeIncreaseQuotaPrivilege 2932 wmic.exe Token: SeSecurityPrivilege 2932 wmic.exe Token: SeTakeOwnershipPrivilege 2932 wmic.exe Token: SeLoadDriverPrivilege 2932 wmic.exe Token: SeSystemProfilePrivilege 2932 wmic.exe Token: SeSystemtimePrivilege 2932 wmic.exe Token: SeProfSingleProcessPrivilege 2932 wmic.exe Token: SeIncBasePriorityPrivilege 2932 wmic.exe Token: SeCreatePagefilePrivilege 2932 wmic.exe Token: SeBackupPrivilege 2932 wmic.exe Token: SeRestorePrivilege 2932 wmic.exe Token: SeShutdownPrivilege 2932 wmic.exe Token: SeDebugPrivilege 2932 wmic.exe Token: SeSystemEnvironmentPrivilege 2932 wmic.exe Token: SeRemoteShutdownPrivilege 2932 wmic.exe Token: SeUndockPrivilege 2932 wmic.exe Token: SeManageVolumePrivilege 2932 wmic.exe Token: 33 2932 wmic.exe Token: 34 2932 wmic.exe Token: 35 2932 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2932 2888 ManualWin10 (2).exe 28 PID 2888 wrote to memory of 2932 2888 ManualWin10 (2).exe 28 PID 2888 wrote to memory of 2932 2888 ManualWin10 (2).exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ManualWin10 (2).exe"C:\Users\Admin\AppData\Local\Temp\ManualWin10 (2).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2932
-