Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-02-2024 22:18
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
test.exe
-
Size
229KB
-
MD5
389eb7f36e7c17764ad907f4a6ec9903
-
SHA1
c34370beda5170ab51f2dd1d44ec5bcf83559fb4
-
SHA256
c8af26db327c857cc8b739f0fc7a502fed4bf682b6d9e369b3d4f327f89eff90
-
SHA512
4633a433771e8e921968dec9f645497853f5d843e51af335e8247637aa00195613bfb9ba71786a35f531e6a3795aabea9e6ca33ae2abec7d07df0017327597ee
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4S0HULxCqVMQhTuOLueb8e1m8Bi:noZtL+EP8S0HULxCqVMQhTuOLdfY
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/3028-0-0x0000000000F80000-0x0000000000FC0000-memory.dmp family_umbral behavioral1/memory/3028-2-0x0000000000CD0000-0x0000000000D50000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 3028 test.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2720 3028 test.exe 28 PID 3028 wrote to memory of 2720 3028 test.exe 28 PID 3028 wrote to memory of 2720 3028 test.exe 28