Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 18:26
Behavioral task
behavioral1
Sample
UDware.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
UDware.exe
-
Size
230KB
-
MD5
a8239dd24c8bcc00d3ba4472126d0739
-
SHA1
453ee2f28b1c5cb171f02be902c694ffc3afaf78
-
SHA256
a56f91fc9c991c4a2c3f29d2aee8d7729ba0e3209f45f8d38e3854cbeb1905cf
-
SHA512
a6f0e2dbbdd1bbf6e8b024984653df910c12c9222a13ec2982da98f08a7002f222a0165c05a0ea9889a67c237516e4d6382650bfc37e7fbc2eb211fdfb8df4b7
-
SSDEEP
6144:1loZM+rIkd8g+EtXHkv/iD4fY1OsTPkNFQu//OFfbtxjY8e1mli:XoZtL+EP8fY1OsTPkNFQu//O1xx6z
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2364-0-0x0000000001190000-0x00000000011D0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2364 UDware.exe Token: SeIncreaseQuotaPrivilege 2548 wmic.exe Token: SeSecurityPrivilege 2548 wmic.exe Token: SeTakeOwnershipPrivilege 2548 wmic.exe Token: SeLoadDriverPrivilege 2548 wmic.exe Token: SeSystemProfilePrivilege 2548 wmic.exe Token: SeSystemtimePrivilege 2548 wmic.exe Token: SeProfSingleProcessPrivilege 2548 wmic.exe Token: SeIncBasePriorityPrivilege 2548 wmic.exe Token: SeCreatePagefilePrivilege 2548 wmic.exe Token: SeBackupPrivilege 2548 wmic.exe Token: SeRestorePrivilege 2548 wmic.exe Token: SeShutdownPrivilege 2548 wmic.exe Token: SeDebugPrivilege 2548 wmic.exe Token: SeSystemEnvironmentPrivilege 2548 wmic.exe Token: SeRemoteShutdownPrivilege 2548 wmic.exe Token: SeUndockPrivilege 2548 wmic.exe Token: SeManageVolumePrivilege 2548 wmic.exe Token: 33 2548 wmic.exe Token: 34 2548 wmic.exe Token: 35 2548 wmic.exe Token: SeIncreaseQuotaPrivilege 2548 wmic.exe Token: SeSecurityPrivilege 2548 wmic.exe Token: SeTakeOwnershipPrivilege 2548 wmic.exe Token: SeLoadDriverPrivilege 2548 wmic.exe Token: SeSystemProfilePrivilege 2548 wmic.exe Token: SeSystemtimePrivilege 2548 wmic.exe Token: SeProfSingleProcessPrivilege 2548 wmic.exe Token: SeIncBasePriorityPrivilege 2548 wmic.exe Token: SeCreatePagefilePrivilege 2548 wmic.exe Token: SeBackupPrivilege 2548 wmic.exe Token: SeRestorePrivilege 2548 wmic.exe Token: SeShutdownPrivilege 2548 wmic.exe Token: SeDebugPrivilege 2548 wmic.exe Token: SeSystemEnvironmentPrivilege 2548 wmic.exe Token: SeRemoteShutdownPrivilege 2548 wmic.exe Token: SeUndockPrivilege 2548 wmic.exe Token: SeManageVolumePrivilege 2548 wmic.exe Token: 33 2548 wmic.exe Token: 34 2548 wmic.exe Token: 35 2548 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2548 2364 UDware.exe 28 PID 2364 wrote to memory of 2548 2364 UDware.exe 28 PID 2364 wrote to memory of 2548 2364 UDware.exe 28