Analysis
-
max time kernel
89s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 02:30
Behavioral task
behavioral1
Sample
Havoc.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Havoc.exe
-
Size
392KB
-
MD5
8448d218a68f469274aeb8d8703a3dca
-
SHA1
318db25307d656f07afb2dda531a563a2e8a9fa1
-
SHA256
647b526e892e5b786e5b797e19f91a33fb73776caf46a70138fe6321283aa992
-
SHA512
f363e15557c78257dc3c2d6dae408aa2766b4f4466e32dbdb9b2057b140f882e427f73b88cb5b76322dbf034a4f846cb7fc27d70a46720b0c84cfb93428df521
-
SSDEEP
6144:XloZMLrIkd8g+EtXHkv/iD4WnD+tBPUonLWvRsY9Atb8e1m7i/G:1oZ0L+EP8WnD+tBPUonLWvRsY9kB+
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1188-0-0x0000020FA8330000-0x0000020FA8398000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 1188 Havoc.exe Token: SeIncreaseQuotaPrivilege 4564 wmic.exe Token: SeSecurityPrivilege 4564 wmic.exe Token: SeTakeOwnershipPrivilege 4564 wmic.exe Token: SeLoadDriverPrivilege 4564 wmic.exe Token: SeSystemProfilePrivilege 4564 wmic.exe Token: SeSystemtimePrivilege 4564 wmic.exe Token: SeProfSingleProcessPrivilege 4564 wmic.exe Token: SeIncBasePriorityPrivilege 4564 wmic.exe Token: SeCreatePagefilePrivilege 4564 wmic.exe Token: SeBackupPrivilege 4564 wmic.exe Token: SeRestorePrivilege 4564 wmic.exe Token: SeShutdownPrivilege 4564 wmic.exe Token: SeDebugPrivilege 4564 wmic.exe Token: SeSystemEnvironmentPrivilege 4564 wmic.exe Token: SeRemoteShutdownPrivilege 4564 wmic.exe Token: SeUndockPrivilege 4564 wmic.exe Token: SeManageVolumePrivilege 4564 wmic.exe Token: 33 4564 wmic.exe Token: 34 4564 wmic.exe Token: 35 4564 wmic.exe Token: 36 4564 wmic.exe Token: SeIncreaseQuotaPrivilege 4564 wmic.exe Token: SeSecurityPrivilege 4564 wmic.exe Token: SeTakeOwnershipPrivilege 4564 wmic.exe Token: SeLoadDriverPrivilege 4564 wmic.exe Token: SeSystemProfilePrivilege 4564 wmic.exe Token: SeSystemtimePrivilege 4564 wmic.exe Token: SeProfSingleProcessPrivilege 4564 wmic.exe Token: SeIncBasePriorityPrivilege 4564 wmic.exe Token: SeCreatePagefilePrivilege 4564 wmic.exe Token: SeBackupPrivilege 4564 wmic.exe Token: SeRestorePrivilege 4564 wmic.exe Token: SeShutdownPrivilege 4564 wmic.exe Token: SeDebugPrivilege 4564 wmic.exe Token: SeSystemEnvironmentPrivilege 4564 wmic.exe Token: SeRemoteShutdownPrivilege 4564 wmic.exe Token: SeUndockPrivilege 4564 wmic.exe Token: SeManageVolumePrivilege 4564 wmic.exe Token: 33 4564 wmic.exe Token: 34 4564 wmic.exe Token: 35 4564 wmic.exe Token: 36 4564 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4564 1188 Havoc.exe 87 PID 1188 wrote to memory of 4564 1188 Havoc.exe 87