Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/03/2025, 19:49
Behavioral task
behavioral1
Sample
CCleaner.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
CCleaner.exe
-
Size
277KB
-
MD5
c8449abc5e4c11d6855ed0d2937a582f
-
SHA1
34ef4d185ddfc998aa252dd00face64c8e50c166
-
SHA256
709ea830585ff4f982a742e33092f0801acffae8a7703d1255caba6e91a2c78e
-
SHA512
d43c1c6e336c5b5235cce173c2e26e3716c06ecf2250b00a7008a88d284ab5ee07f0bfb0cbcc957b6945f304f0a05e7d963cfd2952180061df45b18fdb4b0e26
-
SSDEEP
6144:WloZM+rIkd8g+EtXHkv/iD4t8uoW0b3ceNImHHmBlb8e1mRxihE/nTo:goZtL+EP8t8uoW0b3ceNImHHmfUounTo
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2732-1-0x0000000000950000-0x000000000099C000-memory.dmp family_umbral -
Umbral family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2732 CCleaner.exe Token: SeIncreaseQuotaPrivilege 2568 wmic.exe Token: SeSecurityPrivilege 2568 wmic.exe Token: SeTakeOwnershipPrivilege 2568 wmic.exe Token: SeLoadDriverPrivilege 2568 wmic.exe Token: SeSystemProfilePrivilege 2568 wmic.exe Token: SeSystemtimePrivilege 2568 wmic.exe Token: SeProfSingleProcessPrivilege 2568 wmic.exe Token: SeIncBasePriorityPrivilege 2568 wmic.exe Token: SeCreatePagefilePrivilege 2568 wmic.exe Token: SeBackupPrivilege 2568 wmic.exe Token: SeRestorePrivilege 2568 wmic.exe Token: SeShutdownPrivilege 2568 wmic.exe Token: SeDebugPrivilege 2568 wmic.exe Token: SeSystemEnvironmentPrivilege 2568 wmic.exe Token: SeRemoteShutdownPrivilege 2568 wmic.exe Token: SeUndockPrivilege 2568 wmic.exe Token: SeManageVolumePrivilege 2568 wmic.exe Token: 33 2568 wmic.exe Token: 34 2568 wmic.exe Token: 35 2568 wmic.exe Token: SeIncreaseQuotaPrivilege 2568 wmic.exe Token: SeSecurityPrivilege 2568 wmic.exe Token: SeTakeOwnershipPrivilege 2568 wmic.exe Token: SeLoadDriverPrivilege 2568 wmic.exe Token: SeSystemProfilePrivilege 2568 wmic.exe Token: SeSystemtimePrivilege 2568 wmic.exe Token: SeProfSingleProcessPrivilege 2568 wmic.exe Token: SeIncBasePriorityPrivilege 2568 wmic.exe Token: SeCreatePagefilePrivilege 2568 wmic.exe Token: SeBackupPrivilege 2568 wmic.exe Token: SeRestorePrivilege 2568 wmic.exe Token: SeShutdownPrivilege 2568 wmic.exe Token: SeDebugPrivilege 2568 wmic.exe Token: SeSystemEnvironmentPrivilege 2568 wmic.exe Token: SeRemoteShutdownPrivilege 2568 wmic.exe Token: SeUndockPrivilege 2568 wmic.exe Token: SeManageVolumePrivilege 2568 wmic.exe Token: 33 2568 wmic.exe Token: 34 2568 wmic.exe Token: 35 2568 wmic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2568 2732 CCleaner.exe 31 PID 2732 wrote to memory of 2568 2732 CCleaner.exe 31 PID 2732 wrote to memory of 2568 2732 CCleaner.exe 31