Analysis
-
max time kernel
80s -
max time network
82s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25-07-2024 02:26
Behavioral task
behavioral1
Sample
DD Spotify Acc Gen.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
600 seconds
Behavioral task
behavioral2
Sample
DD Spotify Acc Gen.exe
Resource
win7-20240705-en
windows7-x64
16 signatures
600 seconds
Behavioral task
behavioral3
Sample
DD Spotify Acc Gen.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
15 signatures
600 seconds
General
-
Target
DD Spotify Acc Gen.exe
-
Size
296KB
-
MD5
c4cf132278a366635533a2734901aa95
-
SHA1
06ea6b94f8accb59c3115c67208a1116a12a7f1e
-
SHA256
382f9d13e5a5945980c767ec1d98732d971a4e07bdb9ed1950d6c455edbb203a
-
SHA512
d6f4343892a266db8b62892d0c8eef5e63492f49e237d704cf2c5237fe5249f948dbbc8471ae2db00a862af9d7658c6286a72a0f3134786dae82d5fad72eb120
-
SSDEEP
6144:dloZM+rIkd8g+EtXHkv/iD4PaIWVjgULYyD1Ac5eIb8e1mWiQ:/oZVL+EP8PaIWVjgULYyD1Ac5n0
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/3912-1-0x00000170F0080000-0x00000170F00D0000-memory.dmp family_umbral -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3912 DD Spotify Acc Gen.exe Token: SeIncreaseQuotaPrivilege 4392 wmic.exe Token: SeSecurityPrivilege 4392 wmic.exe Token: SeTakeOwnershipPrivilege 4392 wmic.exe Token: SeLoadDriverPrivilege 4392 wmic.exe Token: SeSystemProfilePrivilege 4392 wmic.exe Token: SeSystemtimePrivilege 4392 wmic.exe Token: SeProfSingleProcessPrivilege 4392 wmic.exe Token: SeIncBasePriorityPrivilege 4392 wmic.exe Token: SeCreatePagefilePrivilege 4392 wmic.exe Token: SeBackupPrivilege 4392 wmic.exe Token: SeRestorePrivilege 4392 wmic.exe Token: SeShutdownPrivilege 4392 wmic.exe Token: SeDebugPrivilege 4392 wmic.exe Token: SeSystemEnvironmentPrivilege 4392 wmic.exe Token: SeRemoteShutdownPrivilege 4392 wmic.exe Token: SeUndockPrivilege 4392 wmic.exe Token: SeManageVolumePrivilege 4392 wmic.exe Token: 33 4392 wmic.exe Token: 34 4392 wmic.exe Token: 35 4392 wmic.exe Token: 36 4392 wmic.exe Token: SeIncreaseQuotaPrivilege 4392 wmic.exe Token: SeSecurityPrivilege 4392 wmic.exe Token: SeTakeOwnershipPrivilege 4392 wmic.exe Token: SeLoadDriverPrivilege 4392 wmic.exe Token: SeSystemProfilePrivilege 4392 wmic.exe Token: SeSystemtimePrivilege 4392 wmic.exe Token: SeProfSingleProcessPrivilege 4392 wmic.exe Token: SeIncBasePriorityPrivilege 4392 wmic.exe Token: SeCreatePagefilePrivilege 4392 wmic.exe Token: SeBackupPrivilege 4392 wmic.exe Token: SeRestorePrivilege 4392 wmic.exe Token: SeShutdownPrivilege 4392 wmic.exe Token: SeDebugPrivilege 4392 wmic.exe Token: SeSystemEnvironmentPrivilege 4392 wmic.exe Token: SeRemoteShutdownPrivilege 4392 wmic.exe Token: SeUndockPrivilege 4392 wmic.exe Token: SeManageVolumePrivilege 4392 wmic.exe Token: 33 4392 wmic.exe Token: 34 4392 wmic.exe Token: 35 4392 wmic.exe Token: 36 4392 wmic.exe Token: SeDebugPrivilege 1584 taskmgr.exe Token: SeSystemProfilePrivilege 1584 taskmgr.exe Token: SeCreateGlobalPrivilege 1584 taskmgr.exe Token: 33 1584 taskmgr.exe Token: SeIncBasePriorityPrivilege 1584 taskmgr.exe Token: SeDebugPrivilege 4248 DD Spotify Acc Gen.exe Token: SeIncreaseQuotaPrivilege 3672 wmic.exe Token: SeSecurityPrivilege 3672 wmic.exe Token: SeTakeOwnershipPrivilege 3672 wmic.exe Token: SeLoadDriverPrivilege 3672 wmic.exe Token: SeSystemProfilePrivilege 3672 wmic.exe Token: SeSystemtimePrivilege 3672 wmic.exe Token: SeProfSingleProcessPrivilege 3672 wmic.exe Token: SeIncBasePriorityPrivilege 3672 wmic.exe Token: SeCreatePagefilePrivilege 3672 wmic.exe Token: SeBackupPrivilege 3672 wmic.exe Token: SeRestorePrivilege 3672 wmic.exe Token: SeShutdownPrivilege 3672 wmic.exe Token: SeDebugPrivilege 3672 wmic.exe Token: SeSystemEnvironmentPrivilege 3672 wmic.exe Token: SeRemoteShutdownPrivilege 3672 wmic.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe 1584 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3912 wrote to memory of 4392 3912 DD Spotify Acc Gen.exe 72 PID 3912 wrote to memory of 4392 3912 DD Spotify Acc Gen.exe 72 PID 4248 wrote to memory of 3672 4248 DD Spotify Acc Gen.exe 83 PID 4248 wrote to memory of 3672 4248 DD Spotify Acc Gen.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\DD Spotify Acc Gen.exe"C:\Users\Admin\AppData\Local\Temp\DD Spotify Acc Gen.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1584
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\DD Spotify Acc Gen.exe"C:\Users\Admin\AppData\Local\Temp\DD Spotify Acc Gen.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD553ea0a2251276ba7ae39b07e6116d841
SHA15f591af152d71b2f04dfc3353a1c96fd4153117d
SHA2563f7b0412c182cbdefb3eedafe30233d209d734b1087234ac15409636006b3302
SHA512cf63abfe61389f241755eef4b8ed0f41701568b79d1263e885f8989ce3eca6bf9f8d5805b4cc7304aaaa5c7e14122b0d15bd9948e47108107bbb7219fd498306