Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 23:45
Behavioral task
behavioral1
Sample
Flameware Private.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Flameware Private.exe
-
Size
230KB
-
MD5
abc025caa58fe6ecb84365b64d4ed757
-
SHA1
b3113843f2267767c19386553405154ec7a71f85
-
SHA256
5df04b74201455ad96f742657340d53387fe4d3642321f8d1f9bd76805d77570
-
SHA512
2fe0131b442753d19ffe9443f20ece0bad4de6199a0b178f56eda4b97f71d635fdc493664c661dcfdb0fd29f30f834ae4e692411435ef5fd706fd4e915694492
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4WEWFn9GfUL1gevPeywb8e1mhi:ooZtL+EP8WEWFn9GfUL1gevPeXj
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/5112-0-0x000002BC50590000-0x000002BC505D0000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 4808 taskmgr.exe Token: SeSystemProfilePrivilege 4808 taskmgr.exe Token: SeCreateGlobalPrivilege 4808 taskmgr.exe Token: SeDebugPrivilege 5112 Flameware Private.exe Token: SeIncreaseQuotaPrivilege 964 wmic.exe Token: SeSecurityPrivilege 964 wmic.exe Token: SeTakeOwnershipPrivilege 964 wmic.exe Token: SeLoadDriverPrivilege 964 wmic.exe Token: SeSystemProfilePrivilege 964 wmic.exe Token: SeSystemtimePrivilege 964 wmic.exe Token: SeProfSingleProcessPrivilege 964 wmic.exe Token: SeIncBasePriorityPrivilege 964 wmic.exe Token: SeCreatePagefilePrivilege 964 wmic.exe Token: SeBackupPrivilege 964 wmic.exe Token: SeRestorePrivilege 964 wmic.exe Token: SeShutdownPrivilege 964 wmic.exe Token: SeDebugPrivilege 964 wmic.exe Token: SeSystemEnvironmentPrivilege 964 wmic.exe Token: SeRemoteShutdownPrivilege 964 wmic.exe Token: SeUndockPrivilege 964 wmic.exe Token: SeManageVolumePrivilege 964 wmic.exe Token: 33 964 wmic.exe Token: 34 964 wmic.exe Token: 35 964 wmic.exe Token: 36 964 wmic.exe Token: SeIncreaseQuotaPrivilege 964 wmic.exe Token: SeSecurityPrivilege 964 wmic.exe Token: SeTakeOwnershipPrivilege 964 wmic.exe Token: SeLoadDriverPrivilege 964 wmic.exe Token: SeSystemProfilePrivilege 964 wmic.exe Token: SeSystemtimePrivilege 964 wmic.exe Token: SeProfSingleProcessPrivilege 964 wmic.exe Token: SeIncBasePriorityPrivilege 964 wmic.exe Token: SeCreatePagefilePrivilege 964 wmic.exe Token: SeBackupPrivilege 964 wmic.exe Token: SeRestorePrivilege 964 wmic.exe Token: SeShutdownPrivilege 964 wmic.exe Token: SeDebugPrivilege 964 wmic.exe Token: SeSystemEnvironmentPrivilege 964 wmic.exe Token: SeRemoteShutdownPrivilege 964 wmic.exe Token: SeUndockPrivilege 964 wmic.exe Token: SeManageVolumePrivilege 964 wmic.exe Token: 33 964 wmic.exe Token: 34 964 wmic.exe Token: 35 964 wmic.exe Token: 36 964 wmic.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe 4808 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5112 wrote to memory of 964 5112 Flameware Private.exe 101 PID 5112 wrote to memory of 964 5112 Flameware Private.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Flameware Private.exe"C:\Users\Admin\AppData\Local\Temp\Flameware Private.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:964
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4808