Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2025, 15:28
Behavioral task
behavioral1
Sample
Umbral.builder.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Umbral.builder.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Umbral.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
-
Target
Umbral.builder.exe
-
Size
114KB
-
MD5
d91fb6867df7e4303d98b5e90faae73c
-
SHA1
496f53ad8cd9381f1c1b577a73e978081002c1db
-
SHA256
bb19b002df31e1196b4e6530cf54c449e9cf1383d3adc5334a0442fa96b36344
-
SHA512
5dbcfe9bf567c6f1e18027950726af1835ab8b363ba8b040fd379b4cfe94b0894bc969b3c04fa4f1964b441a7b894bd4d37f3aabe3ea31396687a6ca093cfdc9
-
SSDEEP
3072:aumr2q8XTs/8wEQuKqAFCq8FBJGgMMlpVFPo6QoJ7j:aumr2q8XTs/8wEQJhCqbsVehy7
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/1532-2-0x0000026E06730000-0x0000026E06750000-memory.dmp agile_net behavioral2/memory/1532-3-0x0000026E06750000-0x0000026E06770000-memory.dmp agile_net behavioral2/memory/1532-4-0x0000026E20A60000-0x0000026E20ACE000-memory.dmp agile_net behavioral2/memory/1532-8-0x0000026E20720000-0x0000026E2073E000-memory.dmp agile_net behavioral2/memory/1532-7-0x0000026E06770000-0x0000026E06780000-memory.dmp agile_net behavioral2/memory/1532-6-0x0000026E20780000-0x0000026E207DA000-memory.dmp agile_net behavioral2/memory/1532-5-0x0000026E066D0000-0x0000026E066DE000-memory.dmp agile_net behavioral2/memory/1532-10-0x0000026E20C20000-0x0000026E20D6A000-memory.dmp agile_net -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe 1532 Umbral.builder.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4904 taskmgr.exe Token: SeSystemProfilePrivilege 4904 taskmgr.exe Token: SeCreateGlobalPrivilege 4904 taskmgr.exe Token: SeDebugPrivilege 1532 Umbral.builder.exe Token: 33 4904 taskmgr.exe Token: SeIncBasePriorityPrivilege 4904 taskmgr.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe 4904 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4904