da0a70873c42c2b04f126c3a225adcf740c5878667be96cbfb8480aabca437e1

Analysis

max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 06:27

Target

Umba.rar
Size

3.2MB
MD5

7f5e2de492e9e2e3e7b3f687b91256e1
SHA1

62cad67a3f55f2ad72a36b3a091856d9f43057d2
SHA256

da0a70873c42c2b04f126c3a225adcf740c5878667be96cbfb8480aabca437e1
SHA512

2c6f1c9bb8abb640f04081b21e525efbe3a7eb7c429cfb0e28dfd054c5db1144cf449098e12a0faad7daae3e534956ef2fe7cee8e89f4a6719ee60e7b9d56bc6
SSDEEP

49152:iSUnmThzebNJZUbhKG5iAcv6qAGBpqVgjB6udL/cOgU0G9z5FS5vCYeR2NnTs0Sg:xGm9eTkOv61Gj8ML/cOgULFSRBTx3RN

Score

7^/10

Executes dropped EXE 5 IoCs

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2480	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of FindShellTrayWindow 6 IoCs

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2020	2480	7zFM.exe	98
PID 2480 wrote to memory of 2020	2480	7zFM.exe	98
PID 2480 wrote to memory of 3188	2480	7zFM.exe	105
PID 2480 wrote to memory of 3188	2480	7zFM.exe	105
PID 2480 wrote to memory of 1704	2480	7zFM.exe	108
PID 2480 wrote to memory of 1704	2480	7zFM.exe	108
PID 2480 wrote to memory of 2872	2480	7zFM.exe	111
PID 2480 wrote to memory of 2872	2480	7zFM.exe	111
PID 2480 wrote to memory of 1832	2480	7zFM.exe	114
PID 2480 wrote to memory of 1832	2480	7zFM.exe	114

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Umba.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\7zO0B925548\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0B925548\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\7zO0B9D1E48\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0B9D1E48\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\7zO0B98B658\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0B98B658\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\7zO0B905068\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0B905068\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\7zO0B976468\Umbral.builder.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0B976468\Umbral.builder.exe"
  2⤵
  - Executes dropped EXE
  PID:1832

C:\Users\Admin\AppData\Local\Temp\7zO0B925548\Umbral.builder.exe

Filesize
114KB

MD5
d91fb6867df7e4303d98b5e90faae73c

SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db

SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344

SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9

Download Submit
memory/2020-12-0x00007FFAAB223000-0x00007FFAAB225000-memory.dmp

Filesize
8KB

Download
memory/2020-13-0x0000024F733E0000-0x0000024F73402000-memory.dmp

Filesize
136KB

Download
memory/2020-14-0x00007FFAAB220000-0x00007FFAABCE1000-memory.dmp

Filesize
10.8MB

Download
memory/2020-15-0x00007FFAAB220000-0x00007FFAABCE1000-memory.dmp

Filesize
10.8MB

Download