Analysis
-
max time kernel
184s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 04:39
Static task
static1
General
-
Target
Havoc-Executor.rar
-
Size
16.8MB
-
MD5
f92596f16b2227ca7b19b8fcfc146763
-
SHA1
673eb42df68aec2de4558120785d4b45a7fcbe0f
-
SHA256
16ab548b51418dc856d375ca306d50fe04ba25df2fb01fdf31057f6fd72f5348
-
SHA512
668b9ddbdddccf6876ceb6e4294e0b360534ec5bee12881020e9842ee6e19d1f5554c4ca72a0a2335a71c9ab403891c5076c3f9a8ca5140d699eef5a530bee8e
-
SSDEEP
393216:msqRW0KzrmKC0eNSo38nS1AcYcr2B5u0hKjAXyjbBsK33w4SXjMj:msqLKOKC0eN5sS1Ac1iojAXZFjMj
Malware Config
Extracted
Family
umbral
C2
https://discord.com/api/webhooks/1202713966892154880/hKt1959RM0bV5-3CpJAwh821Kr6T7h9g1Q2lLB0g86ovim2izdHbNw9y6LtQFK8C5Zhm
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x0003000000000749-25.dat family_umbral behavioral1/memory/468-27-0x000002827EE70000-0x000002827EED8000-memory.dmp family_umbral -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 468 HavocV2.exe 700 HavocV2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3448 7zFM.exe Token: 35 3448 7zFM.exe Token: SeRestorePrivilege 2184 7zG.exe Token: 35 2184 7zG.exe Token: SeSecurityPrivilege 2184 7zG.exe Token: SeSecurityPrivilege 2184 7zG.exe Token: SeDebugPrivilege 468 HavocV2.exe Token: SeIncreaseQuotaPrivilege 808 wmic.exe Token: SeSecurityPrivilege 808 wmic.exe Token: SeTakeOwnershipPrivilege 808 wmic.exe Token: SeLoadDriverPrivilege 808 wmic.exe Token: SeSystemProfilePrivilege 808 wmic.exe Token: SeSystemtimePrivilege 808 wmic.exe Token: SeProfSingleProcessPrivilege 808 wmic.exe Token: SeIncBasePriorityPrivilege 808 wmic.exe Token: SeCreatePagefilePrivilege 808 wmic.exe Token: SeBackupPrivilege 808 wmic.exe Token: SeRestorePrivilege 808 wmic.exe Token: SeShutdownPrivilege 808 wmic.exe Token: SeDebugPrivilege 808 wmic.exe Token: SeSystemEnvironmentPrivilege 808 wmic.exe Token: SeRemoteShutdownPrivilege 808 wmic.exe Token: SeUndockPrivilege 808 wmic.exe Token: SeManageVolumePrivilege 808 wmic.exe Token: 33 808 wmic.exe Token: 34 808 wmic.exe Token: 35 808 wmic.exe Token: 36 808 wmic.exe Token: SeIncreaseQuotaPrivilege 808 wmic.exe Token: SeSecurityPrivilege 808 wmic.exe Token: SeTakeOwnershipPrivilege 808 wmic.exe Token: SeLoadDriverPrivilege 808 wmic.exe Token: SeSystemProfilePrivilege 808 wmic.exe Token: SeSystemtimePrivilege 808 wmic.exe Token: SeProfSingleProcessPrivilege 808 wmic.exe Token: SeIncBasePriorityPrivilege 808 wmic.exe Token: SeCreatePagefilePrivilege 808 wmic.exe Token: SeBackupPrivilege 808 wmic.exe Token: SeRestorePrivilege 808 wmic.exe Token: SeShutdownPrivilege 808 wmic.exe Token: SeDebugPrivilege 808 wmic.exe Token: SeSystemEnvironmentPrivilege 808 wmic.exe Token: SeRemoteShutdownPrivilege 808 wmic.exe Token: SeUndockPrivilege 808 wmic.exe Token: SeManageVolumePrivilege 808 wmic.exe Token: 33 808 wmic.exe Token: 34 808 wmic.exe Token: 35 808 wmic.exe Token: 36 808 wmic.exe Token: SeDebugPrivilege 888 taskmgr.exe Token: SeSystemProfilePrivilege 888 taskmgr.exe Token: SeCreateGlobalPrivilege 888 taskmgr.exe Token: 33 888 taskmgr.exe Token: SeIncBasePriorityPrivilege 888 taskmgr.exe Token: SeDebugPrivilege 700 HavocV2.exe Token: SeIncreaseQuotaPrivilege 2372 wmic.exe Token: SeSecurityPrivilege 2372 wmic.exe Token: SeTakeOwnershipPrivilege 2372 wmic.exe Token: SeLoadDriverPrivilege 2372 wmic.exe Token: SeSystemProfilePrivilege 2372 wmic.exe Token: SeSystemtimePrivilege 2372 wmic.exe Token: SeProfSingleProcessPrivilege 2372 wmic.exe Token: SeIncBasePriorityPrivilege 2372 wmic.exe Token: SeCreatePagefilePrivilege 2372 wmic.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3448 7zFM.exe 3448 7zFM.exe 2184 7zG.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe 888 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1428 wrote to memory of 3448 1428 cmd.exe 84 PID 1428 wrote to memory of 3448 1428 cmd.exe 84 PID 468 wrote to memory of 808 468 HavocV2.exe 104 PID 468 wrote to memory of 808 468 HavocV2.exe 104 PID 700 wrote to memory of 2372 700 HavocV2.exe 109 PID 700 wrote to memory of 2372 700 HavocV2.exe 109
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Havoc-Executor.rar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Havoc-Executor.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3448
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1732
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\" -spe -an -ai#7zMap1804:108:7zEvent211971⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2184
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Read Before Use.txt1⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:888
-
C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58094b248fe3231e48995c2be32aeb08c
SHA12fe06e000ebec919bf982d033c5d1219c1f916b6
SHA256136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc
SHA512bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f
-
C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Havoc-Executor\HavocV2.exe
Filesize395KB
MD5bbd057262f45309b69aac1969de8905d
SHA1be351afb488c78f984213d8b8fceb0792c00414a
SHA256d223ace00adcf9996234b0e5f85b14ca273ead2c01672f7abc8469cfeacf1408
SHA512caf0791490f568c2ac5b2242a638a8ff557916d390470b5e04acd6c3bd49a3a69be3ae015a2eb4f10624f8cbd54b99c539011da820ef949ad17b1db88e46b12d
-
C:\Users\Admin\AppData\Local\Temp\Havoc-Executor\Havoc-Executor-V2\Havoc-Executor\Havoc-Executor\Havoc-Executor\Read Before Use.txt
Filesize143B
MD5debdb28ccd7c400149c7d35c03f31a92
SHA1cb2cbc7c1e1c7d9884d53c61b4704b14d185a237
SHA2562b07fc5bdef73b169d8038a11f39912e74e78cfa81b6f69716a0f492b8925ab8
SHA512b9b553672f6490b0cc1ffe39092d60810d21044686769ddf70ca9bbd6c52e4f4539acf22d9b85218284e0588ed2ac5baac82a5b93cf4f84296c1ff3b1f68591e