Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 12:52
Behavioral task
behavioral1
Sample
proxy.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
proxy.exe
-
Size
246KB
-
MD5
4ef1cda1badeab461aa59991f9499754
-
SHA1
418fb087216cc11b6981a386fe4de673b089c3d8
-
SHA256
4656d69359cd36909ffafde605da9acaa44f231465c2cf04083f312997a79143
-
SHA512
2b4e6bcf02e18c8db8a703a109581928cdb741409e3b122a2fbdd387bac0aa8bcbcdc3e9b4673fe8309f1c885eed51b1feae505b18ccacfe9879712cf81aaf72
-
SSDEEP
6144:ploZM+rIkd8g+EtXHkv/iD4EXNmxfEY3vmfh8It2qI8e1mZi:boZtL+EP8EXNmxfEY3vmfh8ItcH
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2052-0-0x0000000000120000-0x0000000000164000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2052 proxy.exe Token: SeIncreaseQuotaPrivilege 2100 wmic.exe Token: SeSecurityPrivilege 2100 wmic.exe Token: SeTakeOwnershipPrivilege 2100 wmic.exe Token: SeLoadDriverPrivilege 2100 wmic.exe Token: SeSystemProfilePrivilege 2100 wmic.exe Token: SeSystemtimePrivilege 2100 wmic.exe Token: SeProfSingleProcessPrivilege 2100 wmic.exe Token: SeIncBasePriorityPrivilege 2100 wmic.exe Token: SeCreatePagefilePrivilege 2100 wmic.exe Token: SeBackupPrivilege 2100 wmic.exe Token: SeRestorePrivilege 2100 wmic.exe Token: SeShutdownPrivilege 2100 wmic.exe Token: SeDebugPrivilege 2100 wmic.exe Token: SeSystemEnvironmentPrivilege 2100 wmic.exe Token: SeRemoteShutdownPrivilege 2100 wmic.exe Token: SeUndockPrivilege 2100 wmic.exe Token: SeManageVolumePrivilege 2100 wmic.exe Token: 33 2100 wmic.exe Token: 34 2100 wmic.exe Token: 35 2100 wmic.exe Token: SeIncreaseQuotaPrivilege 2100 wmic.exe Token: SeSecurityPrivilege 2100 wmic.exe Token: SeTakeOwnershipPrivilege 2100 wmic.exe Token: SeLoadDriverPrivilege 2100 wmic.exe Token: SeSystemProfilePrivilege 2100 wmic.exe Token: SeSystemtimePrivilege 2100 wmic.exe Token: SeProfSingleProcessPrivilege 2100 wmic.exe Token: SeIncBasePriorityPrivilege 2100 wmic.exe Token: SeCreatePagefilePrivilege 2100 wmic.exe Token: SeBackupPrivilege 2100 wmic.exe Token: SeRestorePrivilege 2100 wmic.exe Token: SeShutdownPrivilege 2100 wmic.exe Token: SeDebugPrivilege 2100 wmic.exe Token: SeSystemEnvironmentPrivilege 2100 wmic.exe Token: SeRemoteShutdownPrivilege 2100 wmic.exe Token: SeUndockPrivilege 2100 wmic.exe Token: SeManageVolumePrivilege 2100 wmic.exe Token: 33 2100 wmic.exe Token: 34 2100 wmic.exe Token: 35 2100 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2100 2052 proxy.exe 28 PID 2052 wrote to memory of 2100 2052 proxy.exe 28 PID 2052 wrote to memory of 2100 2052 proxy.exe 28