Analysis
-
max time kernel
140s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 12:03
Behavioral task
behavioral1
Sample
Sash_crack.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
1200 seconds
General
-
Target
Sash_crack.exe
-
Size
229KB
-
MD5
b4194015c260caf700eb8fa8b68bd715
-
SHA1
fbba3ddf29726fdc112771d7d31e39ada64dbd47
-
SHA256
3e6c300b61fc97ddc3577f37aba155b7ca1023dc5206a2f763216d4bcc613973
-
SHA512
7a561d4282b9460cbc5947512c5d1ae0fdc886fa8f6752d3daa6a9f3d829e2984373cdfb66853bd424b161bde05b6f6ba704c52a422f9afb21b9b32c9d5497e5
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4/c2DmHdmOhPU9va6v/Rb8e1m4/i:voZtL+EP8/c2DmHdmOhPU9va6vBrq
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/3160-1-0x000001B0E07C0000-0x000001B0E0800000-memory.dmp family_umbral -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 3160 Sash_crack.exe Token: SeIncreaseQuotaPrivilege 2188 wmic.exe Token: SeSecurityPrivilege 2188 wmic.exe Token: SeTakeOwnershipPrivilege 2188 wmic.exe Token: SeLoadDriverPrivilege 2188 wmic.exe Token: SeSystemProfilePrivilege 2188 wmic.exe Token: SeSystemtimePrivilege 2188 wmic.exe Token: SeProfSingleProcessPrivilege 2188 wmic.exe Token: SeIncBasePriorityPrivilege 2188 wmic.exe Token: SeCreatePagefilePrivilege 2188 wmic.exe Token: SeBackupPrivilege 2188 wmic.exe Token: SeRestorePrivilege 2188 wmic.exe Token: SeShutdownPrivilege 2188 wmic.exe Token: SeDebugPrivilege 2188 wmic.exe Token: SeSystemEnvironmentPrivilege 2188 wmic.exe Token: SeRemoteShutdownPrivilege 2188 wmic.exe Token: SeUndockPrivilege 2188 wmic.exe Token: SeManageVolumePrivilege 2188 wmic.exe Token: 33 2188 wmic.exe Token: 34 2188 wmic.exe Token: 35 2188 wmic.exe Token: 36 2188 wmic.exe Token: SeIncreaseQuotaPrivilege 2188 wmic.exe Token: SeSecurityPrivilege 2188 wmic.exe Token: SeTakeOwnershipPrivilege 2188 wmic.exe Token: SeLoadDriverPrivilege 2188 wmic.exe Token: SeSystemProfilePrivilege 2188 wmic.exe Token: SeSystemtimePrivilege 2188 wmic.exe Token: SeProfSingleProcessPrivilege 2188 wmic.exe Token: SeIncBasePriorityPrivilege 2188 wmic.exe Token: SeCreatePagefilePrivilege 2188 wmic.exe Token: SeBackupPrivilege 2188 wmic.exe Token: SeRestorePrivilege 2188 wmic.exe Token: SeShutdownPrivilege 2188 wmic.exe Token: SeDebugPrivilege 2188 wmic.exe Token: SeSystemEnvironmentPrivilege 2188 wmic.exe Token: SeRemoteShutdownPrivilege 2188 wmic.exe Token: SeUndockPrivilege 2188 wmic.exe Token: SeManageVolumePrivilege 2188 wmic.exe Token: 33 2188 wmic.exe Token: 34 2188 wmic.exe Token: 35 2188 wmic.exe Token: 36 2188 wmic.exe Token: SeDebugPrivilege 2360 taskmgr.exe Token: SeSystemProfilePrivilege 2360 taskmgr.exe Token: SeCreateGlobalPrivilege 2360 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe 2360 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2188 3160 Sash_crack.exe 84 PID 3160 wrote to memory of 2188 3160 Sash_crack.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sash_crack.exe"C:\Users\Admin\AppData\Local\Temp\Sash_crack.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2360