Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 14:24
Behavioral task
behavioral1
Sample
HyperUD.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
HyperUD.exe
-
Size
234KB
-
MD5
909391eed1553a3fa6f4dc055adbe3aa
-
SHA1
5af04da4c504b66a25a165c5a8dcd516d566ed24
-
SHA256
6fad9668c32f1b4906274dc81e836e5c22fd572371956c7723722b078247e636
-
SHA512
28b6837ed50d2e2cf68a627a19ad0518df4f79b194ebfa0d6f0e8d52b80694dafcb1b45e31f501837492d68eed9c49c29530d4b4f1c28a1f518d6352a1da3945
-
SSDEEP
6144:jloZM+rIkd8g+EtXHkv/iD4O+K4NbYMTPqL9Y0h/jgb8e1mxi:BoZtL+EP8O+K4NbYMTPqL9Y0h/0T
Malware Config
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/memory/2980-0-0x0000000000990000-0x00000000009D0000-memory.dmp family_umbral behavioral1/memory/2980-2-0x000000001B270000-0x000000001B2F0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2980 HyperUD.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe Token: SeIncreaseQuotaPrivilege 2720 wmic.exe Token: SeSecurityPrivilege 2720 wmic.exe Token: SeTakeOwnershipPrivilege 2720 wmic.exe Token: SeLoadDriverPrivilege 2720 wmic.exe Token: SeSystemProfilePrivilege 2720 wmic.exe Token: SeSystemtimePrivilege 2720 wmic.exe Token: SeProfSingleProcessPrivilege 2720 wmic.exe Token: SeIncBasePriorityPrivilege 2720 wmic.exe Token: SeCreatePagefilePrivilege 2720 wmic.exe Token: SeBackupPrivilege 2720 wmic.exe Token: SeRestorePrivilege 2720 wmic.exe Token: SeShutdownPrivilege 2720 wmic.exe Token: SeDebugPrivilege 2720 wmic.exe Token: SeSystemEnvironmentPrivilege 2720 wmic.exe Token: SeRemoteShutdownPrivilege 2720 wmic.exe Token: SeUndockPrivilege 2720 wmic.exe Token: SeManageVolumePrivilege 2720 wmic.exe Token: 33 2720 wmic.exe Token: 34 2720 wmic.exe Token: 35 2720 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2720 2980 HyperUD.exe 28 PID 2980 wrote to memory of 2720 2980 HyperUD.exe 28 PID 2980 wrote to memory of 2720 2980 HyperUD.exe 28