Analysis
-
max time kernel
125s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2023 20:47
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20231023-en
windows7-x64
4 signatures
150 seconds
General
-
Target
testing.exe
-
Size
231KB
-
MD5
577b44ebe36cbc4f670656d144344492
-
SHA1
baafccf208195f1f075e0eeb09f9010711b448a9
-
SHA256
ab9240587e456c4fe2099e590ed42177d504580f6bd7ce6e8c83266b68b1e815
-
SHA512
911e8382f374ccdfdc0470c7ae844b39bdc42f2bf9fc0a6b7f5967727bfe714ff25aeb1d926424baa1e58e05d0d4bc7143574418491577e960ca5810cf23e951
-
SSDEEP
6144:BloZM+rIkd8g+EtXHkv/iD4lwsPGELnsdd42X3WAfb8e1mYUi:zoZtL+EP8lwsPGELnsdd42X3WGf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1916-0-0x000001DDD3C90000-0x000001DDD3CD0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1916 testing.exe Token: SeIncreaseQuotaPrivilege 4872 wmic.exe Token: SeSecurityPrivilege 4872 wmic.exe Token: SeTakeOwnershipPrivilege 4872 wmic.exe Token: SeLoadDriverPrivilege 4872 wmic.exe Token: SeSystemProfilePrivilege 4872 wmic.exe Token: SeSystemtimePrivilege 4872 wmic.exe Token: SeProfSingleProcessPrivilege 4872 wmic.exe Token: SeIncBasePriorityPrivilege 4872 wmic.exe Token: SeCreatePagefilePrivilege 4872 wmic.exe Token: SeBackupPrivilege 4872 wmic.exe Token: SeRestorePrivilege 4872 wmic.exe Token: SeShutdownPrivilege 4872 wmic.exe Token: SeDebugPrivilege 4872 wmic.exe Token: SeSystemEnvironmentPrivilege 4872 wmic.exe Token: SeRemoteShutdownPrivilege 4872 wmic.exe Token: SeUndockPrivilege 4872 wmic.exe Token: SeManageVolumePrivilege 4872 wmic.exe Token: 33 4872 wmic.exe Token: 34 4872 wmic.exe Token: 35 4872 wmic.exe Token: 36 4872 wmic.exe Token: SeIncreaseQuotaPrivilege 4872 wmic.exe Token: SeSecurityPrivilege 4872 wmic.exe Token: SeTakeOwnershipPrivilege 4872 wmic.exe Token: SeLoadDriverPrivilege 4872 wmic.exe Token: SeSystemProfilePrivilege 4872 wmic.exe Token: SeSystemtimePrivilege 4872 wmic.exe Token: SeProfSingleProcessPrivilege 4872 wmic.exe Token: SeIncBasePriorityPrivilege 4872 wmic.exe Token: SeCreatePagefilePrivilege 4872 wmic.exe Token: SeBackupPrivilege 4872 wmic.exe Token: SeRestorePrivilege 4872 wmic.exe Token: SeShutdownPrivilege 4872 wmic.exe Token: SeDebugPrivilege 4872 wmic.exe Token: SeSystemEnvironmentPrivilege 4872 wmic.exe Token: SeRemoteShutdownPrivilege 4872 wmic.exe Token: SeUndockPrivilege 4872 wmic.exe Token: SeManageVolumePrivilege 4872 wmic.exe Token: 33 4872 wmic.exe Token: 34 4872 wmic.exe Token: 35 4872 wmic.exe Token: 36 4872 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1916 wrote to memory of 4872 1916 testing.exe 87 PID 1916 wrote to memory of 4872 1916 testing.exe 87