Analysis
-
max time kernel
27s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-de -
resource tags
-
submitted
01-12-2023 10:05
General
-
Target
nopen.exe
-
Size
229KB
-
MD5
d1763b6d491b8027a8812b3337e4fb03
-
SHA1
d4a446e00e1c14e6dc4481ab0f9e97773e9cad7d
-
SHA256
154115262885b920680ca7d9160a046a1d3d01ddadbe43ae9af80dad1c0b03d0
-
SHA512
0a4711e51463ca4ec5bd65c6b518e4d89af654b44fe88dee68e2107b6a56a930d7cd5fa6d785947cedb4e7d42172c55190c4b28a981923dcce7bb31575a4c53e
-
SSDEEP
6144:tloZMifsXtioRkts/cnnK6cMlaeTRR/k4XpG/BcoNqhyvI8e1mbi:voZetlRk83MlaeTRR/k4XpG/BcoNqZ1
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 21 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 21 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 20 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nopen.exe"C:\Users\Admin\AppData\Local\Temp\nopen.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\afc59c9e27674337a8850492c116900d /t 3272 /p 32681⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97B
MD558ed46f158bed1abf076e00201274843
SHA1a7d8ae1491d3d12f363d33a12379d5730e6f1dfb
SHA25675bce75c49737202f1f4848a02f52952499d8bbcf28e3c2e45474c7b5e9f0a72
SHA512e7e195475bbd9ce55f2452af7baa08f6dbb3b0a71f100bab3e5c07312d9c37896aa2685f1fc8cb13ee5c289c265be605fc43052ca82db79fb7f706c96144eebd
-
Filesize
97B
MD558ed46f158bed1abf076e00201274843
SHA1a7d8ae1491d3d12f363d33a12379d5730e6f1dfb
SHA25675bce75c49737202f1f4848a02f52952499d8bbcf28e3c2e45474c7b5e9f0a72
SHA512e7e195475bbd9ce55f2452af7baa08f6dbb3b0a71f100bab3e5c07312d9c37896aa2685f1fc8cb13ee5c289c265be605fc43052ca82db79fb7f706c96144eebd
-
Filesize
97B
MD558ed46f158bed1abf076e00201274843
SHA1a7d8ae1491d3d12f363d33a12379d5730e6f1dfb
SHA25675bce75c49737202f1f4848a02f52952499d8bbcf28e3c2e45474c7b5e9f0a72
SHA512e7e195475bbd9ce55f2452af7baa08f6dbb3b0a71f100bab3e5c07312d9c37896aa2685f1fc8cb13ee5c289c265be605fc43052ca82db79fb7f706c96144eebd
-
Filesize
97B
MD558ed46f158bed1abf076e00201274843
SHA1a7d8ae1491d3d12f363d33a12379d5730e6f1dfb
SHA25675bce75c49737202f1f4848a02f52952499d8bbcf28e3c2e45474c7b5e9f0a72
SHA512e7e195475bbd9ce55f2452af7baa08f6dbb3b0a71f100bab3e5c07312d9c37896aa2685f1fc8cb13ee5c289c265be605fc43052ca82db79fb7f706c96144eebd
-
Filesize
97B
MD558ed46f158bed1abf076e00201274843
SHA1a7d8ae1491d3d12f363d33a12379d5730e6f1dfb
SHA25675bce75c49737202f1f4848a02f52952499d8bbcf28e3c2e45474c7b5e9f0a72
SHA512e7e195475bbd9ce55f2452af7baa08f6dbb3b0a71f100bab3e5c07312d9c37896aa2685f1fc8cb13ee5c289c265be605fc43052ca82db79fb7f706c96144eebd
-
Filesize
10KB
MD59aa546f6033a556bcbf63aa8b5e45a18
SHA159599fb14fbc50f7394591df3e53caac1d41b1ff
SHA2565d2178b8ae0d82c023e40c6938215365a68c11a8f66dfb9c72703fe728ef993b
SHA5120cb0743e6638b7a4d7847d415ec97b05afea660e7bc38659787da222cb64a91300271f0bde4a5a59c70dc513b90c6dd527ca508564a3be1b097f4c42aa0e1532
-
Filesize
11KB
MD51f3f032d20209df9be97b81f42599e74
SHA19e1025e88cea491e5d59caa317e119851e24e866
SHA2561086ab72021586ebbacd354985997b0d433e189f554afc3693d723407e3c8200
SHA5120145bc12462cf3cc29d3fdbd7f8c5bdf42ab813e177e1e985470fb373c837041c3920fc60ff048eba71a8a85ff69e930f7b4e9d4dd593b0fb2f9ab91e3d6eb52
-
Filesize
7KB
MD50fd3329e66a209f7fce9a811227bfd58
SHA14548f835139977bb47872713addca89195776568
SHA2561ed9fa52c4700850d1f2b6eaecaa96a3893690ce5763f0b0dcf1f3d5a311abdb
SHA512c42fb97c41aed6d6fa5e09551da3b37de29d462ed85225e31b4916d0c6a48811bd0e0cfc025f3e9fb7b39c91c604b9d175b3bab6154606ec7b4fa4dbc5e5430e
-
Filesize
10KB
MD5339f38a34a45b88ec9b97addd8d2202f
SHA17ad12de33ab86b395ff3a349ece5ef7a0044c05a
SHA25692590015426e3d83e5e6e385a2fb55af4c45d5ec1442f5802f5ce2f2998471c8
SHA5123d7049221faec3b3e968ee0feee711058248ec314a66108a9669ba01ef851bb379cb8e087bab491e6878dc3e55d68944ec033f94fb117aebb6cbd2253eeb8506
-
Filesize
101KB
MD596bde3f3ee615050ab3fa6937d4c6596
SHA15b35368095ceec94603869e964a22d4f4991af38
SHA256f8b087c21b2b9d262b98c2a2ecb8b51c5e7976fc36235d1324157abea0982a60
SHA5129929e077ce3150515176a7efa1b196faa09a7e325ff7f771dba5b439fe725d6c357bbd7941824f1f0d9e083ae8e21c38217319d7f70210a99b38b02135ab1168
-
Filesize
150KB
MD55bde6d4d6aa6ab1e0577abfbe930abc2
SHA11edfc596dcd05a275ddfa42cc36e0ec7e457cee0
SHA256cf53a27dd806035fb8cde8220df000e07f7c1a276032be466fc75395a5562195
SHA5127ab1d5c04797aa5d56a2b9bb982e7dd55b84d0dcc5e36e74ca1af49ea49d844ea9c288455a205447c39ef84e7e351bfd01855df2ce6c98b3cac5caa1832a7e9a
-
Filesize
115KB
MD5646a0dc2bcc4bfd1b76552ace050ed11
SHA160dff58d08fdff5f60fec15bbe06f137c0ae6d71
SHA256773a5d3ed1b08a3b8004a3492b774fe9e6c0f3eaed6a23d0aff712ccd57dbd80
SHA5126a3be23c19e939b90eb03cc151f9e3b8002130893e4e9db3b88123ce92d3079b830649857b1a7b8a9bb6e62192210a1cc68ba68452e6144f36a6374cf0e10d15
-
Filesize
1.1MB
MD5e9b047f9b469ef7627d3ebe47ec23740
SHA10c40d7c5ad92f147f1854d8e4590162ef9795bbb
SHA256636938a8142a92c8cf249b88f4571a388a9ff963c2c7b2d06e5735a134f427d4
SHA512ca677a50f558930f9958aac9fa74d32f23274bfd8140dd6e345d563a24fcd5d46e8a56b16bd4e9a05db557bd221718d66d656a732121ab019b7e742f986481a3
-
Filesize
68KB
MD5ea4728892c7ec108577a2444babe32d8
SHA1266296b45a4d09781d4a7c92041b87332f584d7c
SHA256bdbe29fcfd16673521d4df9b073230050a205ee2478b0df53aa01d0f9a78254b
SHA5121f2f200452ac6550a2d1672e4dd43d1b726ffa4c8e66df1ed10599cf8da8895cd28d658b1f46f601d0f3abcd87fad1afb1db5fc3a7dbf6f4a968c6fae7a94526
-
Filesize
96KB
MD51bbe5d72e8dd5342f62d6888e968d1bf
SHA1510c49182738b88dfbf889da7c8743f4ed756cbe
SHA25645f3e9ccd1f974bd6aed1c2526d29864afd0ba1319a285cf62bec03083440d47
SHA512b1def84cb283ef0c3a96200ccdbdc42db1785f4b7b090a2f8d8ce1063ffa2cc8b3c48be402925ba860069a2ab81e9d65262c8f4b8dc74058c6e11cf15efb785d
-
Filesize
7KB
MD5679a48857aad32a6c85f3f3a2c929f2a
SHA18105b7b7aaa84dfd2b00a331b41ef957045662e4
SHA2564e0fabe3ca86b62195c7f3de089b5a14abfd0e19423c800b614977403918c5d1
SHA512af564bbaca37e0c8a9ee28a6ef7d5cc3008069521342552c790582d41d9f06b3bce53696c852f28165b74825cfd7d163ca053174baaaac79f728bf40810d1a8c
-
Filesize
21KB
MD51c67ee0504ad4dd5cf6f5431b5aee155
SHA10e49f4a36e56ca3a679e381236754da2135f911a
SHA256658b9e6959f413a743af8d474a26fab53253b3f70e6e9f5670a16f2db6920244
SHA512760859f4072a0881517be9d7d7b619f5c228775090d09f2f1d779b52a5e9c4038295e71ce884e182332464a6b5e39f36ba7261440d15f97c222eeab4a7832f45
-
Filesize
7KB
MD535fb4341824596a3c13bba99cfef0cca
SHA143f63b5dc6aed82deb3933d87df80ea61ef5dca0
SHA256be33568cdd1a75733160ff35538a8e1ef0b5bbed9b8b34d804120d61da0ed963
SHA51251d8dbf4b86726da805430c7a759afa79a283c1b431296b14cb08e3970d724729235aa5799c0918f4750b7804739cd0f751226a27268f1a8f0239471bb915151
-
Filesize
7KB
MD525a1e3ad33bec735a3002425f16d1bec
SHA15fefa45a6bba09d06ec921133c47d3bf6e5d693c
SHA2560c3959fd0f8d2dae0dddcb7d48b68ef9cb6db29f91689e2dc90c09753b7f4366
SHA512b0a428674a9aa19b995fca6e0878fb728003f7d57befd09d1fe4c301bd12b5dbba7703621dae7d49d6c8fc943ded37b0ec9ec0794f8903dc398f2660480f3f74
-
Filesize
7KB
MD5a1833cfde4cf86fe3b9311a9b4c724d5
SHA1265a39b3301dab3bf27d5254098d60854d4f9256
SHA256c7055e91842d6786cdda51c1f0d363fcc847d8f14928c76d76469dba15306cc6
SHA51267b6a458c322f36a3df5a55070ebb70585b422f59c43d56179d4489ef772fb53e6db91f1587395b54fb291e0ead343ce7751ddf9acfefd79a5aadd81916d1852
-
Filesize
9KB
MD552cfabf0b3271ee556d79840bc7e61aa
SHA193fbb931a4a00891583b12635b9366372debc7cc
SHA256927218e56dc9a9678206e75347fec62bf90400394281c7c6b79c1a02f21472e7
SHA5122fabc57ff58df7cd511f1f7be324f6a882268d5f45be744425885451d795026ff5a8a3393ce2add5e4727461c1ed3acf4ea060f109bdfbfccb368c8759699bca
-
Filesize
146KB
MD5830adf61bd79ad412e1b57bb09bb27fa
SHA19fbc5fe7c2b18f239bc67801eb11af7bffc72833
SHA25620511453d4721a15c6c0dcc6e2351662e52f8ae0bb355cc3aefa920939e81cff
SHA512c2f7c1877cc4a5ed767a37738ddc675ecca7d2fcb5a4f874e7d595b3ea05f179f4c9bcf2f82d70a8ecb80c7d6e7df3dfc010433e25d0c96c80b638b2be6f42c7
-
Filesize
8KB
MD5ae5821ef430886abbe29d9562fd02f51
SHA1ea1cef8365608012a4b2f4bf4de21a6f118fdbb1
SHA256e5857daa7825d488fa6f3878bf09c4508d200a6bef271a199fb945d93b9a5c1f
SHA51283e01733bc12d94939dd3271ae7c6ed2b5114ab32aadfab8cfc8fc984ca79b07637685e6d81d597772ccc5caf322772e6ccde285aca98faa1151f01f5fb1c40c
-
Filesize
7KB
MD52d385ca324d13e8d067fd4151deaad0e
SHA159e2c2d6a537d7921dd8f37aacef7df48666096f
SHA25675aa17d885f133639a94164e91e7df2f4c708547e98257bd990abf5f18e050e5
SHA512cdc13172acf6dadbf6eb32bac00825a3e87219dc5424e2292e6dcf1d3062148cd43d19a50dcb83cbf36b98c1e1769251b481d864f17e72e155e990b75317abe8
-
Filesize
8KB
MD599164849c3aff3c649a7b416705cfb94
SHA153365469638a5038152cdb921ae0d74365313bd6
SHA256dfef65f1f962b78df5d640ca7fb314c30283f4fd28a0b5eefa3931cfe87b3535
SHA5122b3775265d8a7f5b1721459dea8bdd0b01da1592194807fc0e72155b8f0bb6a7f331845be3b9d9a4f002ce510030f9a3339f1674772a1ed5a8f6b5d2931cfba2
-
Filesize
5KB
MD5c67d0e539cf61c0d6d9dc959e826401c
SHA143a2961fa427893def9982273fe9e5ebdde053c6
SHA25688f880cf5ba1204f000764613b6cdd895ba57b71b4b111e1d0aebd524553161f
SHA512afc9c251913debd410ad8be041228611e5c8c95c222e8aa8c70b03b28c8e6acef112e8dbb4cbd99dc5d3a12fe45551af6504afe7c41913476b849361f0df9ea9
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
264KB
-
Filesize
1.0MB
-
Filesize
256KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB