Resubmissions
20-02-2024 04:33
240220-e6v9vaba5w 1020-02-2024 04:30
240220-e42c3sah9z 1020-02-2024 04:20
240220-eyb61aag6y 10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-02-2024 04:30
General
-
Target
UMF.Installer.exe
-
Size
10.4MB
-
MD5
5a7ecc12107019e47294f27f4d40572c
-
SHA1
01891d681fd8b6baa0599e335999d427e55179db
-
SHA256
c81e2a3b15785a5fb548c5552be839fd92e2fc5423b372fba2f890ad488371b9
-
SHA512
77da7350f3cc4358e07250ee9c6cbd035a9a27a934c019967942841cbf3d49839cb765dc6a22bc121e34ef1494b33050dc5752beff5e1938b82848b3190d4ad1
-
SSDEEP
196608:DJ06wpSjt1RoahEDQH6TdBy5AY6TdVp/6TdvpPC:d0xpqloDQajPTpCppPC
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UMF.Installer.exe"C:\Users\Admin\AppData\Local\Temp\UMF.Installer.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x46c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RemoveTrace.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SkipUnlock.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD59597ee77c49ab9ddbb21f79f347da929
SHA169b46af36fe413bcfdc74b8ecf5c99539d0e5aa7
SHA2568a5ef475d93adf889d8ef5e879ce498773c43ab35da5b0b26e09832055cbcf7d
SHA5125237207ee3cba33e6343b80503d5ef9459e376f4faf78903261ee1a00b909868e99246e37847661ff81aa1fe89a640659f2a7f30ddd49613da28ed4c73161133
-
Filesize
412B
MD524837df48398b61c9600f8202cdcf4ff
SHA122d59641da2b10b00f737b3801ab61fb967fe643
SHA25680ebfff0cd88755607941aee73902e34606ecce88af0ef8c807400dca1fe6333
SHA5126f5f86970b9e0ae6085d7d44aea2ef48cd667e726929a1779e5f8c4798114b1c8395119fa157114878e0373e80a1708748a20107a5eeeb1053b10325ebf2dc28
-
Filesize
159KB
MD5fb30335e3432fb04681bea0f39bfd93e
SHA12097543616640bdd9de6cc04591615afc8bc3ae5
SHA256cc2d379217501ab1d7db60d8e5fb210b8d915eb083f468dc6656f63b920fb091
SHA5125a0e30bcdc6fa4214ad7e9df018aec5e10124bbc1b5f5239a26697a0c2a0246644636a388e8feae3f97395db08b7153b5626632287590d56db8989d4c6d4b01b
-
Filesize
2KB
MD53de490003601a02e9cdb5705b20f6874
SHA13e3ef93d99d78a1992a8ed29d29646f342581104
SHA256d19c297caf4059fa9115fb3c41e75513d1e910b4f381af16cc0ca9438715fa74
SHA512fe12c44838f42a94ca12d0d6ff72d7e5eab9a94b993b0cd93eb80223b7d6518008d050a65b9a94d8dfe39ef8c2a1a9028844a869b8bd36c560ac39b16b4cc316
-
Filesize
2KB
MD511bfd5bd9d1e2eb53f89498ab78bc1b7
SHA17b303e28eef4758409eb77dc708441292d1de825
SHA256264403640f1fde2b6ed699aa2106808b8591c21fe05f26753e23126a516cc77d
SHA51281f943831652bcbf432dfdb77bc5f829c8daaee4019c6e2bdca10d1fd1e0d13a33db459c2d6cef9b42efabf647ef66446bb9822ec2e774c7989ecd32591fe887
-
Filesize
306B
MD5ab6f06bb8b677d48de8fbea9ee2b83ca
SHA1eec7705a7d2007658951b89d36538c93d331d539
SHA25696c785b94751d3ead4cc8c624dca432efec181ade605f2a28527b8e0233fb577
SHA512236cbc41a6e7f712db98e7aa1f3a982b378148a3ecfa3eeb879cd21cda53ddda6875154ed1ba392ca63ed2e58e3979db249a395c4762179ff1f90d9b3196110c
-
Filesize
255B
MD537e70b9e5f18351a27a5e99d8bd9d68e
SHA1be828514bcd1398586ee2025297c32caa672519b
SHA25685b40365c2ad1c5d4e34b2ecc1794ad462c5db6adff2aa8c83027c37e195e41d
SHA512b8b02df8cd6cf7506208fb7b90777801bb12d8be57da2f44dc02d43834e52403d7a3032bfa65279a5573a91aa1ff678ae90f562170296814f3e452f9d3360b30
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.5MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB