27d52d4881c4ef9f8f6dea631a6a635ac7e005a8f5170198dd84fca21d79abc9 | Triage

Analysis

max time kernel
66s
max time network
107s
platform
windows10_x64
resource
win10v200722
submitted
02-08-2020 04:29

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Siggen9.60237.32635.28326.exe
Size

824KB
MD5

061c34015e1bf2e8443e5d6d6678705a
SHA1

fafcdd793afab2ac017342cf5e587b45bc676e0b
SHA256

27d52d4881c4ef9f8f6dea631a6a635ac7e005a8f5170198dd84fca21d79abc9
SHA512

d74d3bd7e5db812fc44446e8a33c2b736e37cf2b0a61bdf712bf0fb4c7c2b6b3e33f83b938046ad215309c1fcbb41ceae9f6c14c86c5208b180164dcdeaf42d7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1000 728 WerFault.exe SecuriteInfo.com.Trojan.Siggen9.60237.32635.28326.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1000 WerFault.exe
Token: SeBackupPrivilege 1000 WerFault.exe
Token: SeDebugPrivilege 1000 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.60237.32635.28326.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.60237.32635.28326.exe"
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 1208
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-0-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1000-1-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1000-3-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download