02877c1523986e1fbb50da0a828df2da4aca704d7de19b11c9225e5befbb0572

General

Target

SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe
Size

591KB
MD5

e5383f9ff78e1af6c83f00f618d027c5
SHA1

e247e980e8fc129025a2e64ad72b4bc163284cca
SHA256

02877c1523986e1fbb50da0a828df2da4aca704d7de19b11c9225e5befbb0572
SHA512

5f2ef98f940f607c04903b3675b662341565a3b0e6805e28b54d5da49bd3a3aac56c7256ee7155523e8943ee45c3f40f4beade3b0306e61295e7fb0106900a47

Score

10^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	powershell.exe
1632	powershell.exe

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1440-2-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/1440-4-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/1440-5-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1124 wrote to memory of 1440	1124	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	24
PID 1440 wrote to memory of 1632	1440	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	25
PID 1440 wrote to memory of 1632	1440	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	25
PID 1440 wrote to memory of 1632	1440	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	25
PID 1440 wrote to memory of 1632	1440	SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe	25

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.59975.9415.12682.exe
  "{path}"
  2⤵
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1440-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1440-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing