Analysis
-
max time kernel
315s -
max time network
1607s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
24-02-2024 01:16
General
-
Target
spoofer.exe
-
Size
227KB
-
MD5
71fdaa3ec1242e7643807ade78ae0c8b
-
SHA1
307ddc6e4a768069e726fd4bb1c21d1a8a3dcc7e
-
SHA256
c19c1b9db038d843ea040fdd1e0ef430258479b88da3db295d82ad5ede7d54fd
-
SHA512
ab43150a6ba2caf3e81212a840e05a6b6b95762ed2ba8234411beeeaf564a5512cc46d25c3fedc154fbe259f3ad113539861cb98b91e1caaa2fd43863a34a877
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4SDD6hv0IHL2PxM4dCCb8e1m4i:IoZtL+EP8SDD6hv0IHL2PxM4d5G
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/5116-0-0x000001D1FCC30000-0x000001D1FCC70000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 5116 spoofer.exe Token: SeIncreaseQuotaPrivilege 1156 wmic.exe Token: SeSecurityPrivilege 1156 wmic.exe Token: SeTakeOwnershipPrivilege 1156 wmic.exe Token: SeLoadDriverPrivilege 1156 wmic.exe Token: SeSystemProfilePrivilege 1156 wmic.exe Token: SeSystemtimePrivilege 1156 wmic.exe Token: SeProfSingleProcessPrivilege 1156 wmic.exe Token: SeIncBasePriorityPrivilege 1156 wmic.exe Token: SeCreatePagefilePrivilege 1156 wmic.exe Token: SeBackupPrivilege 1156 wmic.exe Token: SeRestorePrivilege 1156 wmic.exe Token: SeShutdownPrivilege 1156 wmic.exe Token: SeDebugPrivilege 1156 wmic.exe Token: SeSystemEnvironmentPrivilege 1156 wmic.exe Token: SeRemoteShutdownPrivilege 1156 wmic.exe Token: SeUndockPrivilege 1156 wmic.exe Token: SeManageVolumePrivilege 1156 wmic.exe Token: 33 1156 wmic.exe Token: 34 1156 wmic.exe Token: 35 1156 wmic.exe Token: 36 1156 wmic.exe Token: SeIncreaseQuotaPrivilege 1156 wmic.exe Token: SeSecurityPrivilege 1156 wmic.exe Token: SeTakeOwnershipPrivilege 1156 wmic.exe Token: SeLoadDriverPrivilege 1156 wmic.exe Token: SeSystemProfilePrivilege 1156 wmic.exe Token: SeSystemtimePrivilege 1156 wmic.exe Token: SeProfSingleProcessPrivilege 1156 wmic.exe Token: SeIncBasePriorityPrivilege 1156 wmic.exe Token: SeCreatePagefilePrivilege 1156 wmic.exe Token: SeBackupPrivilege 1156 wmic.exe Token: SeRestorePrivilege 1156 wmic.exe Token: SeShutdownPrivilege 1156 wmic.exe Token: SeDebugPrivilege 1156 wmic.exe Token: SeSystemEnvironmentPrivilege 1156 wmic.exe Token: SeRemoteShutdownPrivilege 1156 wmic.exe Token: SeUndockPrivilege 1156 wmic.exe Token: SeManageVolumePrivilege 1156 wmic.exe Token: 33 1156 wmic.exe Token: 34 1156 wmic.exe Token: 35 1156 wmic.exe Token: 36 1156 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1156 5116 spoofer.exe 72 PID 5116 wrote to memory of 1156 5116 spoofer.exe 72