Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 19:51
Behavioral task
behavioral1
Sample
HyperWare.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
HyperWare.exe
-
Size
229KB
-
MD5
3b01654587b7795ec22ea207e801275d
-
SHA1
12c131b862e92b0cbd2b8ede8896d8c28956eba1
-
SHA256
d38b4952b025303280ccb50c3f2e88d510322eb49ad30d0121efd92e53586b7e
-
SHA512
9cc00568b9c7de4874c44e28e071b5fb828e494bd3ef8b62600deeac0c6c5f113105fffa04b9b469363933a46ead5ef688ee7905612abf44c6e232751feaad91
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4MRnjw2xpaRPyAxVkEtb8e1mzi:noZtL+EP8MRnjw2xpaRPyAxVkAV
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1284-0-0x0000000001180000-0x00000000011C0000-memory.dmp family_umbral -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1284 HyperWare.exe Token: SeIncreaseQuotaPrivilege 2640 wmic.exe Token: SeSecurityPrivilege 2640 wmic.exe Token: SeTakeOwnershipPrivilege 2640 wmic.exe Token: SeLoadDriverPrivilege 2640 wmic.exe Token: SeSystemProfilePrivilege 2640 wmic.exe Token: SeSystemtimePrivilege 2640 wmic.exe Token: SeProfSingleProcessPrivilege 2640 wmic.exe Token: SeIncBasePriorityPrivilege 2640 wmic.exe Token: SeCreatePagefilePrivilege 2640 wmic.exe Token: SeBackupPrivilege 2640 wmic.exe Token: SeRestorePrivilege 2640 wmic.exe Token: SeShutdownPrivilege 2640 wmic.exe Token: SeDebugPrivilege 2640 wmic.exe Token: SeSystemEnvironmentPrivilege 2640 wmic.exe Token: SeRemoteShutdownPrivilege 2640 wmic.exe Token: SeUndockPrivilege 2640 wmic.exe Token: SeManageVolumePrivilege 2640 wmic.exe Token: 33 2640 wmic.exe Token: 34 2640 wmic.exe Token: 35 2640 wmic.exe Token: SeIncreaseQuotaPrivilege 2640 wmic.exe Token: SeSecurityPrivilege 2640 wmic.exe Token: SeTakeOwnershipPrivilege 2640 wmic.exe Token: SeLoadDriverPrivilege 2640 wmic.exe Token: SeSystemProfilePrivilege 2640 wmic.exe Token: SeSystemtimePrivilege 2640 wmic.exe Token: SeProfSingleProcessPrivilege 2640 wmic.exe Token: SeIncBasePriorityPrivilege 2640 wmic.exe Token: SeCreatePagefilePrivilege 2640 wmic.exe Token: SeBackupPrivilege 2640 wmic.exe Token: SeRestorePrivilege 2640 wmic.exe Token: SeShutdownPrivilege 2640 wmic.exe Token: SeDebugPrivilege 2640 wmic.exe Token: SeSystemEnvironmentPrivilege 2640 wmic.exe Token: SeRemoteShutdownPrivilege 2640 wmic.exe Token: SeUndockPrivilege 2640 wmic.exe Token: SeManageVolumePrivilege 2640 wmic.exe Token: 33 2640 wmic.exe Token: 34 2640 wmic.exe Token: 35 2640 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2640 1284 HyperWare.exe 28 PID 1284 wrote to memory of 2640 1284 HyperWare.exe 28 PID 1284 wrote to memory of 2640 1284 HyperWare.exe 28