Analysis
-
max time kernel
23s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 01:40
Behavioral task
behavioral1
Sample
NiggaDrv.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
NiggaDrv.exe
-
Size
229KB
-
MD5
b3b96ea3275dd1f16fea840f735656d9
-
SHA1
2a18b0fb20a8d3361b3744242b7c4939816985b8
-
SHA256
0179d68051bc377127ffe0e983a1498646b746b5ef7ad5a83f6f062a4b9d1f61
-
SHA512
0b016997326d3a324c3733900cbbd69111c2d6d1dcc8e7f349495dda38b8e8481d94a2bdfdc01830429c8eaf169c80525338ef20b133f441fdbd0c8d9c125e5e
-
SSDEEP
6144:lloZMFrIkd8g+EtXHkv/iD4POT1Cg/7I3R0STTKbKb8e1m1j+Yi:noZOL+EP8POT1Cg/7I3R0STTKiUY
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/320-0-0x000001D4966F0000-0x000001D496730000-memory.dmp family_umbral -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 320 NiggaDrv.exe Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe Token: SeSystemProfilePrivilege 2628 wmic.exe Token: SeSystemtimePrivilege 2628 wmic.exe Token: SeProfSingleProcessPrivilege 2628 wmic.exe Token: SeIncBasePriorityPrivilege 2628 wmic.exe Token: SeCreatePagefilePrivilege 2628 wmic.exe Token: SeBackupPrivilege 2628 wmic.exe Token: SeRestorePrivilege 2628 wmic.exe Token: SeShutdownPrivilege 2628 wmic.exe Token: SeDebugPrivilege 2628 wmic.exe Token: SeSystemEnvironmentPrivilege 2628 wmic.exe Token: SeRemoteShutdownPrivilege 2628 wmic.exe Token: SeUndockPrivilege 2628 wmic.exe Token: SeManageVolumePrivilege 2628 wmic.exe Token: 33 2628 wmic.exe Token: 34 2628 wmic.exe Token: 35 2628 wmic.exe Token: 36 2628 wmic.exe Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe Token: SeSystemProfilePrivilege 2628 wmic.exe Token: SeSystemtimePrivilege 2628 wmic.exe Token: SeProfSingleProcessPrivilege 2628 wmic.exe Token: SeIncBasePriorityPrivilege 2628 wmic.exe Token: SeCreatePagefilePrivilege 2628 wmic.exe Token: SeBackupPrivilege 2628 wmic.exe Token: SeRestorePrivilege 2628 wmic.exe Token: SeShutdownPrivilege 2628 wmic.exe Token: SeDebugPrivilege 2628 wmic.exe Token: SeSystemEnvironmentPrivilege 2628 wmic.exe Token: SeRemoteShutdownPrivilege 2628 wmic.exe Token: SeUndockPrivilege 2628 wmic.exe Token: SeManageVolumePrivilege 2628 wmic.exe Token: 33 2628 wmic.exe Token: 34 2628 wmic.exe Token: 35 2628 wmic.exe Token: 36 2628 wmic.exe Token: SeDebugPrivilege 2912 taskmgr.exe Token: SeSystemProfilePrivilege 2912 taskmgr.exe Token: SeCreateGlobalPrivilege 2912 taskmgr.exe Token: 33 2912 taskmgr.exe Token: SeIncBasePriorityPrivilege 2912 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe -
Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe 2912 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 320 wrote to memory of 2628 320 NiggaDrv.exe 91 PID 320 wrote to memory of 2628 320 NiggaDrv.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\NiggaDrv.exe"C:\Users\Admin\AppData\Local\Temp\NiggaDrv.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2912