Analysis
-
max time kernel
63s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 22:17
General
-
Target
Umbral.payload.exe
-
Size
251KB
-
MD5
ef87753af737c85eeabce72fde0da5aa
-
SHA1
f0cb6e32cc64a387327be0ac866b982533d5379e
-
SHA256
e7a1844712215b50f6c0f6dcf08c0170a32ed31c6973f133cbb24e3daaaae909
-
SHA512
c3451ade161351ec4199f741003c309697fd70210324c49dae5070cc286677c7805ceb81dae486f05ea49ca5b5dd8fee75626250d49b467c2b7218048609c580
-
SSDEEP
6144:gaGu0riMfnHBTD7nEW4uDMgPHLZtIq4aP+Z8e9iLD:gaGuOpfnHBTDL4UN6Moi
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1780-1-0x00000223F10E0000-0x00000223F1124000-memory.dmp family_umbral -
Umbral family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2362875047-775336530-2205312478-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4792 taskmgr.exe Token: SeSystemProfilePrivilege 4792 taskmgr.exe Token: SeCreateGlobalPrivilege 4792 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe 4792 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.payload.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.payload.exe"1⤵PID:1780
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4792
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2156