Analysis
-
max time kernel
505s -
max time network
462s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-02-2024 22:54
Static task
static1
General
-
Target
Havoc-Executor.rar
-
Size
16.8MB
-
MD5
f92596f16b2227ca7b19b8fcfc146763
-
SHA1
673eb42df68aec2de4558120785d4b45a7fcbe0f
-
SHA256
16ab548b51418dc856d375ca306d50fe04ba25df2fb01fdf31057f6fd72f5348
-
SHA512
668b9ddbdddccf6876ceb6e4294e0b360534ec5bee12881020e9842ee6e19d1f5554c4ca72a0a2335a71c9ab403891c5076c3f9a8ca5140d699eef5a530bee8e
-
SSDEEP
393216:msqRW0KzrmKC0eNSo38nS1AcYcr2B5u0hKjAXyjbBsK33w4SXjMj:msqLKOKC0eN5sS1Ac1iojAXZFjMj
Malware Config
Extracted
Family
umbral
C2
https://discord.com/api/webhooks/1202713966892154880/hKt1959RM0bV5-3CpJAwh821Kr6T7h9g1Q2lLB0g86ovim2izdHbNw9y6LtQFK8C5Zhm
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x000100000002a7e3-24.dat family_umbral behavioral1/memory/2036-26-0x0000020AEF860000-0x0000020AEF8C8000-memory.dmp family_umbral -
Executes dropped EXE 2 IoCs
pid Process 2036 HavocV2.exe 2884 HavocV2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2044 7zFM.exe 1176 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2044 7zFM.exe Token: 35 2044 7zFM.exe Token: SeSecurityPrivilege 2044 7zFM.exe Token: SeDebugPrivilege 2036 HavocV2.exe Token: SeIncreaseQuotaPrivilege 2304 wmic.exe Token: SeSecurityPrivilege 2304 wmic.exe Token: SeTakeOwnershipPrivilege 2304 wmic.exe Token: SeLoadDriverPrivilege 2304 wmic.exe Token: SeSystemProfilePrivilege 2304 wmic.exe Token: SeSystemtimePrivilege 2304 wmic.exe Token: SeProfSingleProcessPrivilege 2304 wmic.exe Token: SeIncBasePriorityPrivilege 2304 wmic.exe Token: SeCreatePagefilePrivilege 2304 wmic.exe Token: SeBackupPrivilege 2304 wmic.exe Token: SeRestorePrivilege 2304 wmic.exe Token: SeShutdownPrivilege 2304 wmic.exe Token: SeDebugPrivilege 2304 wmic.exe Token: SeSystemEnvironmentPrivilege 2304 wmic.exe Token: SeRemoteShutdownPrivilege 2304 wmic.exe Token: SeUndockPrivilege 2304 wmic.exe Token: SeManageVolumePrivilege 2304 wmic.exe Token: 33 2304 wmic.exe Token: 34 2304 wmic.exe Token: 35 2304 wmic.exe Token: 36 2304 wmic.exe Token: SeIncreaseQuotaPrivilege 2304 wmic.exe Token: SeSecurityPrivilege 2304 wmic.exe Token: SeTakeOwnershipPrivilege 2304 wmic.exe Token: SeLoadDriverPrivilege 2304 wmic.exe Token: SeSystemProfilePrivilege 2304 wmic.exe Token: SeSystemtimePrivilege 2304 wmic.exe Token: SeProfSingleProcessPrivilege 2304 wmic.exe Token: SeIncBasePriorityPrivilege 2304 wmic.exe Token: SeCreatePagefilePrivilege 2304 wmic.exe Token: SeBackupPrivilege 2304 wmic.exe Token: SeRestorePrivilege 2304 wmic.exe Token: SeShutdownPrivilege 2304 wmic.exe Token: SeDebugPrivilege 2304 wmic.exe Token: SeSystemEnvironmentPrivilege 2304 wmic.exe Token: SeRemoteShutdownPrivilege 2304 wmic.exe Token: SeUndockPrivilege 2304 wmic.exe Token: SeManageVolumePrivilege 2304 wmic.exe Token: 33 2304 wmic.exe Token: 34 2304 wmic.exe Token: 35 2304 wmic.exe Token: 36 2304 wmic.exe Token: SeDebugPrivilege 2884 HavocV2.exe Token: SeIncreaseQuotaPrivilege 4588 wmic.exe Token: SeSecurityPrivilege 4588 wmic.exe Token: SeTakeOwnershipPrivilege 4588 wmic.exe Token: SeLoadDriverPrivilege 4588 wmic.exe Token: SeSystemProfilePrivilege 4588 wmic.exe Token: SeSystemtimePrivilege 4588 wmic.exe Token: SeProfSingleProcessPrivilege 4588 wmic.exe Token: SeIncBasePriorityPrivilege 4588 wmic.exe Token: SeCreatePagefilePrivilege 4588 wmic.exe Token: SeBackupPrivilege 4588 wmic.exe Token: SeRestorePrivilege 4588 wmic.exe Token: SeShutdownPrivilege 4588 wmic.exe Token: SeDebugPrivilege 4588 wmic.exe Token: SeSystemEnvironmentPrivilege 4588 wmic.exe Token: SeRemoteShutdownPrivilege 4588 wmic.exe Token: SeUndockPrivilege 4588 wmic.exe Token: SeManageVolumePrivilege 4588 wmic.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2044 7zFM.exe 2044 7zFM.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2044 2568 cmd.exe 80 PID 2568 wrote to memory of 2044 2568 cmd.exe 80 PID 2036 wrote to memory of 2304 2036 HavocV2.exe 94 PID 2036 wrote to memory of 2304 2036 HavocV2.exe 94 PID 2884 wrote to memory of 4588 2884 HavocV2.exe 104 PID 2884 wrote to memory of 4588 2884 HavocV2.exe 104
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Havoc-Executor.rar1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Havoc-Executor.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1484
-
C:\Users\Admin\Desktop\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"C:\Users\Admin\Desktop\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3492
-
C:\Users\Admin\Desktop\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"C:\Users\Admin\Desktop\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502df789e3c730b309fc4d9abce5d729b
SHA14f9da0f0d4cadacfd0f68fb1f7ee73a66dcf1b4e
SHA2564afabcd1723096359d90c8f32df7a6a44cd866e89d5b37c89280bfeab61d7321
SHA5127ac0dd7e3a3e483d07409da793dd2b0915d4369fe41fe743acd82de9aa77b9fa7ea5cd60498034f3fa0674d93d184c9128375d8f7f0796fddecff3845fca8587
-
C:\Users\Admin\Desktop\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe
Filesize395KB
MD5bbd057262f45309b69aac1969de8905d
SHA1be351afb488c78f984213d8b8fceb0792c00414a
SHA256d223ace00adcf9996234b0e5f85b14ca273ead2c01672f7abc8469cfeacf1408
SHA512caf0791490f568c2ac5b2242a638a8ff557916d390470b5e04acd6c3bd49a3a69be3ae015a2eb4f10624f8cbd54b99c539011da820ef949ad17b1db88e46b12d