Analysis
-
max time kernel
129s -
max time network
45s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 01:42
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe
-
Size
25KB
-
MD5
08f803140ee607a12b15dca97df5864f
-
SHA1
86eaf5f70c162d1b383c3e594fe351f9e255f2c5
-
SHA256
48dbe64eea55a0e579a2e8e12bfe3eb38416563c70a0c49e9ab2d72ac90254ce
-
SHA512
820dc6ba5e99c9cda6cbeefbfc31bb3af75c9cdbcf44f603ab2fd037e3200d7bece74df39500ba4bda92a0981bd62abb909b7c5b76674fcb39e45790b67a57c8
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exedescription pid process Token: SeIncBasePriorityPrivilege 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exepid process 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exedescription pid process target process PID 1500 wrote to memory of 1796 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe cmd.exe PID 1500 wrote to memory of 1796 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe cmd.exe PID 1500 wrote to memory of 1796 1500 SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56784.31962.32291.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-0-0x0000000000000000-mapping.dmp