Analysis
-
max time kernel
42s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2024 19:08
General
-
Target
Universal Hu6 and Aurium V4 [V11].exe
-
Size
333KB
-
MD5
210d0781bb57f3a554c96bb467d6cd57
-
SHA1
3be6edb49c63f7d9ee5f481c4d75f7f1d6ae2258
-
SHA256
1fbf34bae8537e2ef6f1bf09ae1c0f7b3a802cf76a3114c4e80a7be28d1e2039
-
SHA512
3c54403550f8885708d83bf5d23540946c33cd69ab6c990dd21f3b63803636fa202fbf2895cad830f6542ee90aa130ed3de07c117599c132295999882d955f72
-
SSDEEP
6144:2loZMLrIkd8g+EtXHkv/iD4SL72ywvrYahkijD6I8nb8e1mlHaigvRYIcLbFNf45:AoZ0L+EP8SL72ywvrYahkijD6IaCf
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/5020-1-0x0000027C305A0000-0x0000027C305F8000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 5020 Universal Hu6 and Aurium V4 [V11].exe Token: SeIncreaseQuotaPrivilege 2796 wmic.exe Token: SeSecurityPrivilege 2796 wmic.exe Token: SeTakeOwnershipPrivilege 2796 wmic.exe Token: SeLoadDriverPrivilege 2796 wmic.exe Token: SeSystemProfilePrivilege 2796 wmic.exe Token: SeSystemtimePrivilege 2796 wmic.exe Token: SeProfSingleProcessPrivilege 2796 wmic.exe Token: SeIncBasePriorityPrivilege 2796 wmic.exe Token: SeCreatePagefilePrivilege 2796 wmic.exe Token: SeBackupPrivilege 2796 wmic.exe Token: SeRestorePrivilege 2796 wmic.exe Token: SeShutdownPrivilege 2796 wmic.exe Token: SeDebugPrivilege 2796 wmic.exe Token: SeSystemEnvironmentPrivilege 2796 wmic.exe Token: SeRemoteShutdownPrivilege 2796 wmic.exe Token: SeUndockPrivilege 2796 wmic.exe Token: SeManageVolumePrivilege 2796 wmic.exe Token: 33 2796 wmic.exe Token: 34 2796 wmic.exe Token: 35 2796 wmic.exe Token: 36 2796 wmic.exe Token: SeIncreaseQuotaPrivilege 2796 wmic.exe Token: SeSecurityPrivilege 2796 wmic.exe Token: SeTakeOwnershipPrivilege 2796 wmic.exe Token: SeLoadDriverPrivilege 2796 wmic.exe Token: SeSystemProfilePrivilege 2796 wmic.exe Token: SeSystemtimePrivilege 2796 wmic.exe Token: SeProfSingleProcessPrivilege 2796 wmic.exe Token: SeIncBasePriorityPrivilege 2796 wmic.exe Token: SeCreatePagefilePrivilege 2796 wmic.exe Token: SeBackupPrivilege 2796 wmic.exe Token: SeRestorePrivilege 2796 wmic.exe Token: SeShutdownPrivilege 2796 wmic.exe Token: SeDebugPrivilege 2796 wmic.exe Token: SeSystemEnvironmentPrivilege 2796 wmic.exe Token: SeRemoteShutdownPrivilege 2796 wmic.exe Token: SeUndockPrivilege 2796 wmic.exe Token: SeManageVolumePrivilege 2796 wmic.exe Token: 33 2796 wmic.exe Token: 34 2796 wmic.exe Token: 35 2796 wmic.exe Token: 36 2796 wmic.exe Token: SeDebugPrivilege 4912 taskmgr.exe Token: SeSystemProfilePrivilege 4912 taskmgr.exe Token: SeCreateGlobalPrivilege 4912 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe 4912 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5020 wrote to memory of 2796 5020 Universal Hu6 and Aurium V4 [V11].exe 84 PID 5020 wrote to memory of 2796 5020 Universal Hu6 and Aurium V4 [V11].exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Universal Hu6 and Aurium V4 [V11].exe"C:\Users\Admin\AppData\Local\Temp\Universal Hu6 and Aurium V4 [V11].exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2828
-
C:\Windows\System32\hnaorh.exe"C:\Windows\System32\hnaorh.exe"1⤵PID:1636