Analysis
-
max time kernel
46s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 00:44
Behavioral task
behavioral1
Sample
mm2duper.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
General
-
Target
mm2duper.exe
-
Size
229KB
-
MD5
65536dc4bcafc3ee3c1dcf7ed64c12df
-
SHA1
e1ca248ae2ef47a6b89ad6fb155f4d5ec3674e9c
-
SHA256
98e7e144b7bc45bd52601d093b1e447cf486bf2e8cd2ba84e8325e2d7b269662
-
SHA512
25f5043750e42d312b879dcb1b37bc4621790f7402befa21578818c8de6020f1983a984bde79eeaca60b3cd12654fe2dae6e728826e0c4da3794be3519d3bcc2
-
SSDEEP
6144:OwloZM3fsXtioRkts/cnnK6cMlkCanywvrY8hkijD6yBeb8e1mvpi:PoZ1tlRk83MlkCanywvrY8hkijD6yQiw
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/232-0-0x0000021AD3B90000-0x0000021AD3BD0000-memory.dmp family_umbral -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3624 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts mm2duper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5112 wmic.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 632 PING.EXE -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 232 mm2duper.exe 3624 powershell.exe 3624 powershell.exe 1252 powershell.exe 1252 powershell.exe 1252 powershell.exe 3640 powershell.exe 3640 powershell.exe 3640 powershell.exe 1372 powershell.exe 1372 powershell.exe 1372 powershell.exe 4504 powershell.exe 4504 powershell.exe 4504 powershell.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 232 mm2duper.exe Token: SeIncreaseQuotaPrivilege 5112 wmic.exe Token: SeSecurityPrivilege 5112 wmic.exe Token: SeTakeOwnershipPrivilege 5112 wmic.exe Token: SeLoadDriverPrivilege 5112 wmic.exe Token: SeSystemProfilePrivilege 5112 wmic.exe Token: SeSystemtimePrivilege 5112 wmic.exe Token: SeProfSingleProcessPrivilege 5112 wmic.exe Token: SeIncBasePriorityPrivilege 5112 wmic.exe Token: SeCreatePagefilePrivilege 5112 wmic.exe Token: SeBackupPrivilege 5112 wmic.exe Token: SeRestorePrivilege 5112 wmic.exe Token: SeShutdownPrivilege 5112 wmic.exe Token: SeDebugPrivilege 5112 wmic.exe Token: SeSystemEnvironmentPrivilege 5112 wmic.exe Token: SeRemoteShutdownPrivilege 5112 wmic.exe Token: SeUndockPrivilege 5112 wmic.exe Token: SeManageVolumePrivilege 5112 wmic.exe Token: 33 5112 wmic.exe Token: 34 5112 wmic.exe Token: 35 5112 wmic.exe Token: 36 5112 wmic.exe Token: SeIncreaseQuotaPrivilege 5112 wmic.exe Token: SeSecurityPrivilege 5112 wmic.exe Token: SeTakeOwnershipPrivilege 5112 wmic.exe Token: SeLoadDriverPrivilege 5112 wmic.exe Token: SeSystemProfilePrivilege 5112 wmic.exe Token: SeSystemtimePrivilege 5112 wmic.exe Token: SeProfSingleProcessPrivilege 5112 wmic.exe Token: SeIncBasePriorityPrivilege 5112 wmic.exe Token: SeCreatePagefilePrivilege 5112 wmic.exe Token: SeBackupPrivilege 5112 wmic.exe Token: SeRestorePrivilege 5112 wmic.exe Token: SeShutdownPrivilege 5112 wmic.exe Token: SeDebugPrivilege 5112 wmic.exe Token: SeSystemEnvironmentPrivilege 5112 wmic.exe Token: SeRemoteShutdownPrivilege 5112 wmic.exe Token: SeUndockPrivilege 5112 wmic.exe Token: SeManageVolumePrivilege 5112 wmic.exe Token: 33 5112 wmic.exe Token: 34 5112 wmic.exe Token: 35 5112 wmic.exe Token: 36 5112 wmic.exe Token: SeDebugPrivilege 3624 powershell.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeDebugPrivilege 3640 powershell.exe Token: SeDebugPrivilege 1372 powershell.exe Token: SeIncreaseQuotaPrivilege 2784 wmic.exe Token: SeSecurityPrivilege 2784 wmic.exe Token: SeTakeOwnershipPrivilege 2784 wmic.exe Token: SeLoadDriverPrivilege 2784 wmic.exe Token: SeSystemProfilePrivilege 2784 wmic.exe Token: SeSystemtimePrivilege 2784 wmic.exe Token: SeProfSingleProcessPrivilege 2784 wmic.exe Token: SeIncBasePriorityPrivilege 2784 wmic.exe Token: SeCreatePagefilePrivilege 2784 wmic.exe Token: SeBackupPrivilege 2784 wmic.exe Token: SeRestorePrivilege 2784 wmic.exe Token: SeShutdownPrivilege 2784 wmic.exe Token: SeDebugPrivilege 2784 wmic.exe Token: SeSystemEnvironmentPrivilege 2784 wmic.exe Token: SeRemoteShutdownPrivilege 2784 wmic.exe Token: SeUndockPrivilege 2784 wmic.exe Token: SeManageVolumePrivilege 2784 wmic.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe 380 taskmgr.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 232 wrote to memory of 5112 232 mm2duper.exe 91 PID 232 wrote to memory of 5112 232 mm2duper.exe 91 PID 232 wrote to memory of 2688 232 mm2duper.exe 94 PID 232 wrote to memory of 2688 232 mm2duper.exe 94 PID 232 wrote to memory of 3624 232 mm2duper.exe 97 PID 232 wrote to memory of 3624 232 mm2duper.exe 97 PID 232 wrote to memory of 1252 232 mm2duper.exe 100 PID 232 wrote to memory of 1252 232 mm2duper.exe 100 PID 232 wrote to memory of 3640 232 mm2duper.exe 103 PID 232 wrote to memory of 3640 232 mm2duper.exe 103 PID 232 wrote to memory of 1372 232 mm2duper.exe 105 PID 232 wrote to memory of 1372 232 mm2duper.exe 105 PID 232 wrote to memory of 2784 232 mm2duper.exe 109 PID 232 wrote to memory of 2784 232 mm2duper.exe 109 PID 232 wrote to memory of 4832 232 mm2duper.exe 112 PID 232 wrote to memory of 4832 232 mm2duper.exe 112 PID 232 wrote to memory of 3712 232 mm2duper.exe 114 PID 232 wrote to memory of 3712 232 mm2duper.exe 114 PID 232 wrote to memory of 4504 232 mm2duper.exe 116 PID 232 wrote to memory of 4504 232 mm2duper.exe 116 PID 232 wrote to memory of 5112 232 mm2duper.exe 118 PID 232 wrote to memory of 5112 232 mm2duper.exe 118 PID 232 wrote to memory of 1736 232 mm2duper.exe 121 PID 232 wrote to memory of 1736 232 mm2duper.exe 121 PID 1736 wrote to memory of 632 1736 cmd.exe 123 PID 1736 wrote to memory of 632 1736 cmd.exe 123 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2688 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mm2duper.exe"C:\Users\Admin\AppData\Local\Temp\mm2duper.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\mm2duper.exe"2⤵
- Views/modifies file attributes
PID:2688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mm2duper.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:4832
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:5112
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\mm2duper.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\PING.EXEping localhost3⤵
- Runs ping.exe
PID:632
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4316,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:81⤵PID:836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:380
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:440
-
C:\Windows\System32\wbem\unsecapp.exe"C:\Windows\System32\wbem\unsecapp.exe"1⤵PID:4444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
948B
MD5dcd83f3a9bd52a6c0821eb961e87f0b9
SHA1553ced8b5bdca9bf3379571948efe530628e78ea
SHA256da3851259b355076f41331c3864fdcd7688b05ca312f6fcdb420f710ed7cfeaa
SHA512fd76f13f1c8f1e73be04a615c9b010dde5cbf889642d187d410db32d4fdda9d0e994654fa468643ed8fe7563c07a8d1df30b2f5b26856946ed9b2d18d10a4fa5
-
Filesize
1KB
MD5548dd08570d121a65e82abb7171cae1c
SHA11a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA51237b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b
-
Filesize
1KB
MD5ec1ba4a995d866b282087b26a0539bbc
SHA1c4aeae2bc3fa9a898680648b20102f01e8a811cf
SHA256469da678c3c0364b1b511962cffd44cbfc10aab5c1c528c0c09fd952f08d8a2c
SHA51207bf757ec9d0d368d3ef1bfc2b562895e2708757f8fefa04fa50beaa6fb38af1018ea0cfccf5666c5c8baa4c894deead9652c53e0608aa6a83ef5b396dba43e9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82