Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Umbral.builder.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.builder.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Umbral.builder.exe
-
Size
114KB
-
MD5
d91fb6867df7e4303d98b5e90faae73c
-
SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db
-
SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344
-
SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9
-
SSDEEP
3072:aumr2q8XTs/8wEQuKqAFCq8FBJGgMMlpVFPo6QoJ7j:aumr2q8XTs/8wEQJhCqbsVehy7
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4012 taskmgr.exe Token: SeSystemProfilePrivilege 4012 taskmgr.exe Token: SeCreateGlobalPrivilege 4012 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"1⤵PID:760
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4012