Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-02-2024 22:18
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
test.exe
-
Size
229KB
-
MD5
389eb7f36e7c17764ad907f4a6ec9903
-
SHA1
c34370beda5170ab51f2dd1d44ec5bcf83559fb4
-
SHA256
c8af26db327c857cc8b739f0fc7a502fed4bf682b6d9e369b3d4f327f89eff90
-
SHA512
4633a433771e8e921968dec9f645497853f5d843e51af335e8247637aa00195613bfb9ba71786a35f531e6a3795aabea9e6ca33ae2abec7d07df0017327597ee
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4S0HULxCqVMQhTuOLueb8e1m8Bi:noZtL+EP8S0HULxCqVMQhTuOLdfY
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4260-0-0x0000026BC1DF0000-0x0000026BC1E30000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4260 test.exe Token: SeIncreaseQuotaPrivilege 5064 wmic.exe Token: SeSecurityPrivilege 5064 wmic.exe Token: SeTakeOwnershipPrivilege 5064 wmic.exe Token: SeLoadDriverPrivilege 5064 wmic.exe Token: SeSystemProfilePrivilege 5064 wmic.exe Token: SeSystemtimePrivilege 5064 wmic.exe Token: SeProfSingleProcessPrivilege 5064 wmic.exe Token: SeIncBasePriorityPrivilege 5064 wmic.exe Token: SeCreatePagefilePrivilege 5064 wmic.exe Token: SeBackupPrivilege 5064 wmic.exe Token: SeRestorePrivilege 5064 wmic.exe Token: SeShutdownPrivilege 5064 wmic.exe Token: SeDebugPrivilege 5064 wmic.exe Token: SeSystemEnvironmentPrivilege 5064 wmic.exe Token: SeRemoteShutdownPrivilege 5064 wmic.exe Token: SeUndockPrivilege 5064 wmic.exe Token: SeManageVolumePrivilege 5064 wmic.exe Token: 33 5064 wmic.exe Token: 34 5064 wmic.exe Token: 35 5064 wmic.exe Token: 36 5064 wmic.exe Token: SeIncreaseQuotaPrivilege 5064 wmic.exe Token: SeSecurityPrivilege 5064 wmic.exe Token: SeTakeOwnershipPrivilege 5064 wmic.exe Token: SeLoadDriverPrivilege 5064 wmic.exe Token: SeSystemProfilePrivilege 5064 wmic.exe Token: SeSystemtimePrivilege 5064 wmic.exe Token: SeProfSingleProcessPrivilege 5064 wmic.exe Token: SeIncBasePriorityPrivilege 5064 wmic.exe Token: SeCreatePagefilePrivilege 5064 wmic.exe Token: SeBackupPrivilege 5064 wmic.exe Token: SeRestorePrivilege 5064 wmic.exe Token: SeShutdownPrivilege 5064 wmic.exe Token: SeDebugPrivilege 5064 wmic.exe Token: SeSystemEnvironmentPrivilege 5064 wmic.exe Token: SeRemoteShutdownPrivilege 5064 wmic.exe Token: SeUndockPrivilege 5064 wmic.exe Token: SeManageVolumePrivilege 5064 wmic.exe Token: 33 5064 wmic.exe Token: 34 5064 wmic.exe Token: 35 5064 wmic.exe Token: 36 5064 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4260 wrote to memory of 5064 4260 test.exe 84 PID 4260 wrote to memory of 5064 4260 test.exe 84