Analysis
- max time kernel
47s - max time network
46s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/03/2024, 22:34
Behavioral task
behavioral1
Sample
spoofer.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
- Target spoofer.exe
- Size 229KB
- Sample240303-2hba4aab4v
- SHA256 e61c940bca2685a97f063c2a12031e9a7db76bdcbe1e87257f60ca3117ab8a91
- MD5 67a5fee3d0f74d7105431c44bebc3e0e
- SHA1 bc1e2157ee1b8f701869caa5f36d6540d5c98f45
- SHA512 210073a102e0994e193c2691e48f56b012b15f753bb784b13c691e11648b86d0b541e835ce5ec276242558fbd55ef8b4679de7a7a8fda18d61fa1b16c1cec8f6
- SSDEEP 6144:dloZM+rIkd8g+EtXHkv/iD4AtmXjsv8e1mpCui:/oZtL+EP8AtdiCD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/1716-0-0x0000019A15280000-0x0000019A152C0000-memory.dmp family_umbral - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3864 taskmgr.exe Token: SeSystemProfilePrivilege 3864 taskmgr.exe Token: SeCreateGlobalPrivilege 3864 taskmgr.exe Token: SeDebugPrivilege 1716 spoofer.exe Token: SeIncreaseQuotaPrivilege 3392 wmic.exe Token: SeSecurityPrivilege 3392 wmic.exe Token: SeTakeOwnershipPrivilege 3392 wmic.exe Token: SeLoadDriverPrivilege 3392 wmic.exe Token: SeSystemProfilePrivilege 3392 wmic.exe Token: SeSystemtimePrivilege 3392 wmic.exe Token: SeProfSingleProcessPrivilege 3392 wmic.exe Token: SeIncBasePriorityPrivilege 3392 wmic.exe Token: SeCreatePagefilePrivilege 3392 wmic.exe Token: SeBackupPrivilege 3392 wmic.exe Token: SeRestorePrivilege 3392 wmic.exe Token: SeShutdownPrivilege 3392 wmic.exe Token: SeDebugPrivilege 3392 wmic.exe Token: SeSystemEnvironmentPrivilege 3392 wmic.exe Token: SeRemoteShutdownPrivilege 3392 wmic.exe Token: SeUndockPrivilege 3392 wmic.exe Token: SeManageVolumePrivilege 3392 wmic.exe Token: 33 3392 wmic.exe Token: 34 3392 wmic.exe Token: 35 3392 wmic.exe Token: 36 3392 wmic.exe Token: SeIncreaseQuotaPrivilege 3392 wmic.exe Token: SeSecurityPrivilege 3392 wmic.exe Token: SeTakeOwnershipPrivilege 3392 wmic.exe Token: SeLoadDriverPrivilege 3392 wmic.exe Token: SeSystemProfilePrivilege 3392 wmic.exe Token: SeSystemtimePrivilege 3392 wmic.exe Token: SeProfSingleProcessPrivilege 3392 wmic.exe Token: SeIncBasePriorityPrivilege 3392 wmic.exe Token: SeCreatePagefilePrivilege 3392 wmic.exe Token: SeBackupPrivilege 3392 wmic.exe Token: SeRestorePrivilege 3392 wmic.exe Token: SeShutdownPrivilege 3392 wmic.exe Token: SeDebugPrivilege 3392 wmic.exe Token: SeSystemEnvironmentPrivilege 3392 wmic.exe Token: SeRemoteShutdownPrivilege 3392 wmic.exe Token: SeUndockPrivilege 3392 wmic.exe Token: SeManageVolumePrivilege 3392 wmic.exe Token: 33 3392 wmic.exe Token: 34 3392 wmic.exe Token: 35 3392 wmic.exe Token: 36 3392 wmic.exe Token: 33 3864 taskmgr.exe Token: SeIncBasePriorityPrivilege 3864 taskmgr.exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe 3864 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1716 wrote to memory of 3392 1716 spoofer.exe 99 PID 1716 wrote to memory of 3392 1716 spoofer.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\spoofer.exe"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3864
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵PID:1996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:852