Analysis
-
max time kernel
13s -
max time network
11s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
08-10-2023 06:24
Behavioral task
behavioral1
Sample
Syncronized (2.0).exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Syncronized (2.0).exe
-
Size
378KB
-
MD5
f722fd75ed010251ca9ea71a34c480f0
-
SHA1
7e2edd16c5f0f25afb209cd9667421ee5c57ebb9
-
SHA256
818603cc9f08d52c05d296d894d22b8b922e43d07e5181fe2f812866cb72955c
-
SHA512
4c4c52297215984170b516c26e97cb5132ab9f95449449cd3c99a53cd1039e4f8c51692a32768321da3bdf6da4ee8b55bb7a0f44346d11a69750094c990d34cb
-
SSDEEP
6144:FloZM+rIkd8g+EtXHkv/iD4eE/KrVOsTPkyFQu//OoEb8e1mOQC6i:HoZtL+EP89/KrVOsTPkyFQu//Ohn/
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2040-0-0x0000000000C60000-0x0000000000CC4000-memory.dmp family_umbral behavioral1/memory/2040-2-0x000000001B110000-0x000000001B190000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2040 Syncronized (2.0).exe Token: SeIncreaseQuotaPrivilege 2908 wmic.exe Token: SeSecurityPrivilege 2908 wmic.exe Token: SeTakeOwnershipPrivilege 2908 wmic.exe Token: SeLoadDriverPrivilege 2908 wmic.exe Token: SeSystemProfilePrivilege 2908 wmic.exe Token: SeSystemtimePrivilege 2908 wmic.exe Token: SeProfSingleProcessPrivilege 2908 wmic.exe Token: SeIncBasePriorityPrivilege 2908 wmic.exe Token: SeCreatePagefilePrivilege 2908 wmic.exe Token: SeBackupPrivilege 2908 wmic.exe Token: SeRestorePrivilege 2908 wmic.exe Token: SeShutdownPrivilege 2908 wmic.exe Token: SeDebugPrivilege 2908 wmic.exe Token: SeSystemEnvironmentPrivilege 2908 wmic.exe Token: SeRemoteShutdownPrivilege 2908 wmic.exe Token: SeUndockPrivilege 2908 wmic.exe Token: SeManageVolumePrivilege 2908 wmic.exe Token: 33 2908 wmic.exe Token: 34 2908 wmic.exe Token: 35 2908 wmic.exe Token: SeIncreaseQuotaPrivilege 2908 wmic.exe Token: SeSecurityPrivilege 2908 wmic.exe Token: SeTakeOwnershipPrivilege 2908 wmic.exe Token: SeLoadDriverPrivilege 2908 wmic.exe Token: SeSystemProfilePrivilege 2908 wmic.exe Token: SeSystemtimePrivilege 2908 wmic.exe Token: SeProfSingleProcessPrivilege 2908 wmic.exe Token: SeIncBasePriorityPrivilege 2908 wmic.exe Token: SeCreatePagefilePrivilege 2908 wmic.exe Token: SeBackupPrivilege 2908 wmic.exe Token: SeRestorePrivilege 2908 wmic.exe Token: SeShutdownPrivilege 2908 wmic.exe Token: SeDebugPrivilege 2908 wmic.exe Token: SeSystemEnvironmentPrivilege 2908 wmic.exe Token: SeRemoteShutdownPrivilege 2908 wmic.exe Token: SeUndockPrivilege 2908 wmic.exe Token: SeManageVolumePrivilege 2908 wmic.exe Token: 33 2908 wmic.exe Token: 34 2908 wmic.exe Token: 35 2908 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2908 2040 Syncronized (2.0).exe 28 PID 2040 wrote to memory of 2908 2040 Syncronized (2.0).exe 28 PID 2040 wrote to memory of 2908 2040 Syncronized (2.0).exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Syncronized (2.0).exe"C:\Users\Admin\AppData\Local\Temp\Syncronized (2.0).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-