Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03-03-2024 22:34
Behavioral task
behavioral1
Sample
spoofer.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
spoofer.exe
-
Size
229KB
-
MD5
67a5fee3d0f74d7105431c44bebc3e0e
-
SHA1
bc1e2157ee1b8f701869caa5f36d6540d5c98f45
-
SHA256
e61c940bca2685a97f063c2a12031e9a7db76bdcbe1e87257f60ca3117ab8a91
-
SHA512
210073a102e0994e193c2691e48f56b012b15f753bb784b13c691e11648b86d0b541e835ce5ec276242558fbd55ef8b4679de7a7a8fda18d61fa1b16c1cec8f6
-
SSDEEP
6144:dloZM+rIkd8g+EtXHkv/iD4AtmXjsv8e1mpCui:/oZtL+EP8AtdiCD
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/840-0-0x0000000000D00000-0x0000000000D40000-memory.dmp family_umbral behavioral1/memory/840-2-0x000000001B2E0000-0x000000001B360000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 840 spoofer.exe Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 840 wrote to memory of 2660 840 spoofer.exe 28 PID 840 wrote to memory of 2660 840 spoofer.exe 28 PID 840 wrote to memory of 2660 840 spoofer.exe 28