Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 17:27
Behavioral task
behavioral1
Sample
ExumNOVA (1).exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
ExumNOVA (1).exe
-
Size
228KB
-
MD5
f3d936c9efade8ccd0a43ba19ee3ad80
-
SHA1
5aafc1994763497e589203d08c727cdbf481a474
-
SHA256
685aea80db0fd039accee42b17bb7110e3c26529f361dac85f2a6d751982ce89
-
SHA512
b81fa072dc5c0ad1cf08dfcf4d81984d1430f0dbf595d736d0b51249fb302229f116feb908f78e329d0cff5b81b0d517457f4b92c46dcdb0d552a78143c24f55
-
SSDEEP
6144:uloZMzrIkd8g+EtXHkv/iD4Nhi9fVeGJlMFXSy3g2b8e1mWi:4oZcL+EP8Nhi9fVeGJlMFXSy3/o
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2292-0-0x0000000001280000-0x00000000012C0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2292 ExumNOVA (1).exe Token: SeIncreaseQuotaPrivilege 2776 wmic.exe Token: SeSecurityPrivilege 2776 wmic.exe Token: SeTakeOwnershipPrivilege 2776 wmic.exe Token: SeLoadDriverPrivilege 2776 wmic.exe Token: SeSystemProfilePrivilege 2776 wmic.exe Token: SeSystemtimePrivilege 2776 wmic.exe Token: SeProfSingleProcessPrivilege 2776 wmic.exe Token: SeIncBasePriorityPrivilege 2776 wmic.exe Token: SeCreatePagefilePrivilege 2776 wmic.exe Token: SeBackupPrivilege 2776 wmic.exe Token: SeRestorePrivilege 2776 wmic.exe Token: SeShutdownPrivilege 2776 wmic.exe Token: SeDebugPrivilege 2776 wmic.exe Token: SeSystemEnvironmentPrivilege 2776 wmic.exe Token: SeRemoteShutdownPrivilege 2776 wmic.exe Token: SeUndockPrivilege 2776 wmic.exe Token: SeManageVolumePrivilege 2776 wmic.exe Token: 33 2776 wmic.exe Token: 34 2776 wmic.exe Token: 35 2776 wmic.exe Token: SeIncreaseQuotaPrivilege 2776 wmic.exe Token: SeSecurityPrivilege 2776 wmic.exe Token: SeTakeOwnershipPrivilege 2776 wmic.exe Token: SeLoadDriverPrivilege 2776 wmic.exe Token: SeSystemProfilePrivilege 2776 wmic.exe Token: SeSystemtimePrivilege 2776 wmic.exe Token: SeProfSingleProcessPrivilege 2776 wmic.exe Token: SeIncBasePriorityPrivilege 2776 wmic.exe Token: SeCreatePagefilePrivilege 2776 wmic.exe Token: SeBackupPrivilege 2776 wmic.exe Token: SeRestorePrivilege 2776 wmic.exe Token: SeShutdownPrivilege 2776 wmic.exe Token: SeDebugPrivilege 2776 wmic.exe Token: SeSystemEnvironmentPrivilege 2776 wmic.exe Token: SeRemoteShutdownPrivilege 2776 wmic.exe Token: SeUndockPrivilege 2776 wmic.exe Token: SeManageVolumePrivilege 2776 wmic.exe Token: 33 2776 wmic.exe Token: 34 2776 wmic.exe Token: 35 2776 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2776 2292 ExumNOVA (1).exe 28 PID 2292 wrote to memory of 2776 2292 ExumNOVA (1).exe 28 PID 2292 wrote to memory of 2776 2292 ExumNOVA (1).exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExumNOVA (1).exe"C:\Users\Admin\AppData\Local\Temp\ExumNOVA (1).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
-