e124c62a8b363a4caa224e3bf91366fe8d578672d58ab63803b57af2fc83073c | Triage

Analysis

max time kernel
134s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 11:00

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Siggen9.58278.1608.27264.exe
Size

156KB
MD5

581a4343d97bbf1d1b469eb319b073da
SHA1

a041f3b37ddf8942b51ff37a17cdf6321206804a
SHA256

e124c62a8b363a4caa224e3bf91366fe8d578672d58ab63803b57af2fc83073c
SHA512

7163f88d7856e0ccc038afa54af19297664259519505af09a54fc45ac9ffa21f1a6397b6448a157c2251b163df92af98dcec52e4af02ad6a37df6a778b7bb661

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 896 WerFault.exe SecuriteInfo.com.Trojan.Siggen9.58278.1608.27264.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2800 WerFault.exe
Token: SeBackupPrivilege 2800 WerFault.exe
Token: SeDebugPrivilege 2800 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.58278.1608.27264.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.58278.1608.27264.exe"
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-0-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/2800-1-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download