Analysis
-
max time kernel
59s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 05:59
Behavioral task
behavioral1
Sample
ZCCT.xlsx.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
60 seconds
General
-
Target
ZCCT.xlsx.exe
-
Size
287KB
-
MD5
828ec9e9d1fd89c29c09523f4553cf5b
-
SHA1
c07d1c3695bde351f14cf610e6237877b02d5cec
-
SHA256
d3492c1347976ac6e6cef64371d97351ec97ad8bac67d14d4be42bff471dc064
-
SHA512
16d89e6c48e2d25598ad203a9b2810d514a72e0c5daf2aa9af45b556691161d427c73653158cd75b00698fb8dffde728fa643c1102b9f8fb181aa5f47120e1ee
-
SSDEEP
6144:oloZM+rIkd8g+EtXHkv/iD4bTdZ1P8e1mFRAi/:2oZtL+EP8bT9K
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3828-0-0x0000022E78890000-0x0000022E788DE000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3828 ZCCT.xlsx.exe Token: SeIncreaseQuotaPrivilege 2608 wmic.exe Token: SeSecurityPrivilege 2608 wmic.exe Token: SeTakeOwnershipPrivilege 2608 wmic.exe Token: SeLoadDriverPrivilege 2608 wmic.exe Token: SeSystemProfilePrivilege 2608 wmic.exe Token: SeSystemtimePrivilege 2608 wmic.exe Token: SeProfSingleProcessPrivilege 2608 wmic.exe Token: SeIncBasePriorityPrivilege 2608 wmic.exe Token: SeCreatePagefilePrivilege 2608 wmic.exe Token: SeBackupPrivilege 2608 wmic.exe Token: SeRestorePrivilege 2608 wmic.exe Token: SeShutdownPrivilege 2608 wmic.exe Token: SeDebugPrivilege 2608 wmic.exe Token: SeSystemEnvironmentPrivilege 2608 wmic.exe Token: SeRemoteShutdownPrivilege 2608 wmic.exe Token: SeUndockPrivilege 2608 wmic.exe Token: SeManageVolumePrivilege 2608 wmic.exe Token: 33 2608 wmic.exe Token: 34 2608 wmic.exe Token: 35 2608 wmic.exe Token: 36 2608 wmic.exe Token: SeIncreaseQuotaPrivilege 2608 wmic.exe Token: SeSecurityPrivilege 2608 wmic.exe Token: SeTakeOwnershipPrivilege 2608 wmic.exe Token: SeLoadDriverPrivilege 2608 wmic.exe Token: SeSystemProfilePrivilege 2608 wmic.exe Token: SeSystemtimePrivilege 2608 wmic.exe Token: SeProfSingleProcessPrivilege 2608 wmic.exe Token: SeIncBasePriorityPrivilege 2608 wmic.exe Token: SeCreatePagefilePrivilege 2608 wmic.exe Token: SeBackupPrivilege 2608 wmic.exe Token: SeRestorePrivilege 2608 wmic.exe Token: SeShutdownPrivilege 2608 wmic.exe Token: SeDebugPrivilege 2608 wmic.exe Token: SeSystemEnvironmentPrivilege 2608 wmic.exe Token: SeRemoteShutdownPrivilege 2608 wmic.exe Token: SeUndockPrivilege 2608 wmic.exe Token: SeManageVolumePrivilege 2608 wmic.exe Token: 33 2608 wmic.exe Token: 34 2608 wmic.exe Token: 35 2608 wmic.exe Token: 36 2608 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3828 wrote to memory of 2608 3828 ZCCT.xlsx.exe 90 PID 3828 wrote to memory of 2608 3828 ZCCT.xlsx.exe 90