Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 11:05
Behavioral task
behavioral1
Sample
Umbral.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
c6d9062fe7fa14a33531fab3d8d53e04
-
SHA1
9324cc22d65cfaaa4b4b35c978db9e5039d36c2b
-
SHA256
4df5b468a1be632ec9814e7060ab85d055c75dd913b48c24a978d7357f377449
-
SHA512
ed30c2a44431900279dc0ecf6325971bcb22149b3143c0c1ca4b5b0ea3f3a5ce85617b8c317b93bdfdfff4afd349330242c68578d8755f31ef48663efe41849d
-
SSDEEP
6144:xloZM+rIkd8g+EtXHkv/iD4Ooph/1+mpesl3ySX4MvHb8e1mv4li:DoZtL+EP8Ooph/1+mpesl3ySXpJs
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3056-1-0x00000000002F0000-0x0000000000330000-memory.dmp family_umbral -
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2712 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3056 Umbral.exe Token: SeDebugPrivilege 2712 taskmgr.exe Token: SeShutdownPrivilege 2988 LogonUI.exe Token: SeShutdownPrivilege 2988 LogonUI.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe 2712 taskmgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2968 wrote to memory of 2988 2968 winlogon.exe 36 PID 2968 wrote to memory of 2988 2968 winlogon.exe 36 PID 2968 wrote to memory of 2988 2968 winlogon.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36 PID 2856 wrote to memory of 2988 2856 csrss.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2996
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2856
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-