Analysis
-
max time kernel
1704s -
max time network
1165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 01:18
Behavioral task
behavioral1
Sample
spoofer.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
1800 seconds
General
-
Target
spoofer.exe
-
Size
227KB
-
MD5
71fdaa3ec1242e7643807ade78ae0c8b
-
SHA1
307ddc6e4a768069e726fd4bb1c21d1a8a3dcc7e
-
SHA256
c19c1b9db038d843ea040fdd1e0ef430258479b88da3db295d82ad5ede7d54fd
-
SHA512
ab43150a6ba2caf3e81212a840e05a6b6b95762ed2ba8234411beeeaf564a5512cc46d25c3fedc154fbe259f3ad113539861cb98b91e1caaa2fd43863a34a877
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4SDD6hv0IHL2PxM4dCCb8e1m4i:IoZtL+EP8SDD6hv0IHL2PxM4d5G
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4840-0-0x000002041AB10000-0x000002041AB50000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4840 spoofer.exe Token: SeIncreaseQuotaPrivilege 4124 wmic.exe Token: SeSecurityPrivilege 4124 wmic.exe Token: SeTakeOwnershipPrivilege 4124 wmic.exe Token: SeLoadDriverPrivilege 4124 wmic.exe Token: SeSystemProfilePrivilege 4124 wmic.exe Token: SeSystemtimePrivilege 4124 wmic.exe Token: SeProfSingleProcessPrivilege 4124 wmic.exe Token: SeIncBasePriorityPrivilege 4124 wmic.exe Token: SeCreatePagefilePrivilege 4124 wmic.exe Token: SeBackupPrivilege 4124 wmic.exe Token: SeRestorePrivilege 4124 wmic.exe Token: SeShutdownPrivilege 4124 wmic.exe Token: SeDebugPrivilege 4124 wmic.exe Token: SeSystemEnvironmentPrivilege 4124 wmic.exe Token: SeRemoteShutdownPrivilege 4124 wmic.exe Token: SeUndockPrivilege 4124 wmic.exe Token: SeManageVolumePrivilege 4124 wmic.exe Token: 33 4124 wmic.exe Token: 34 4124 wmic.exe Token: 35 4124 wmic.exe Token: 36 4124 wmic.exe Token: SeIncreaseQuotaPrivilege 4124 wmic.exe Token: SeSecurityPrivilege 4124 wmic.exe Token: SeTakeOwnershipPrivilege 4124 wmic.exe Token: SeLoadDriverPrivilege 4124 wmic.exe Token: SeSystemProfilePrivilege 4124 wmic.exe Token: SeSystemtimePrivilege 4124 wmic.exe Token: SeProfSingleProcessPrivilege 4124 wmic.exe Token: SeIncBasePriorityPrivilege 4124 wmic.exe Token: SeCreatePagefilePrivilege 4124 wmic.exe Token: SeBackupPrivilege 4124 wmic.exe Token: SeRestorePrivilege 4124 wmic.exe Token: SeShutdownPrivilege 4124 wmic.exe Token: SeDebugPrivilege 4124 wmic.exe Token: SeSystemEnvironmentPrivilege 4124 wmic.exe Token: SeRemoteShutdownPrivilege 4124 wmic.exe Token: SeUndockPrivilege 4124 wmic.exe Token: SeManageVolumePrivilege 4124 wmic.exe Token: 33 4124 wmic.exe Token: 34 4124 wmic.exe Token: 35 4124 wmic.exe Token: 36 4124 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4124 4840 spoofer.exe 86 PID 4840 wrote to memory of 4124 4840 spoofer.exe 86