Analysis
-
max time kernel
196s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2022 10:30
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe
-
Size
970KB
-
MD5
13b2b2026b8f099fbb366c29288c3f22
-
SHA1
d88b2101375f249288bd8060460f0c5874c8bc5c
-
SHA256
60f594736fc96f0657680d022bd9b9117a4a7d08c1e80812b29d64fa69f814a3
-
SHA512
e815486a563050a5deecb658e97be44166faf77620ac712182b5a27e96ecc54565fccbdc234cf929685348198db9aa3cdf284951bbbd5d9790e13ee06dcdf792
-
SSDEEP
12288:GffyzF/GvWexBwO6pt0CKQ2BYj7yKBAhRLvO5pfslGyKMSMaGqsj0V1nedmVpFL:GffQexBSOCKxqjWC7kk8GGZj0V5NpF
Malware Config
Extracted
formbook
4.1
f9r5
teknotimur.com
zuliboo.com
remmingtoncampbell.com
vehicletitleloansphoenix.com
sen-computer.com
98731.biz
shelikesblu.com
canis-totem.com
metaversemedianetwork.com
adsdu.com
vanishmediasystems.com
astewaykebede.com
wszhongxue.com
gacha-animator-free.com
papatyadekorasyon.com
mqc168.top
simplebrilliantsolutions.com
jubileehawkesprairie.com
ridflab.com
conboysfilm.com
iseemerit.world
airhbb.com
haveyourshare.com
qcstcsz.com
attorneykarinaramirez.com
patriziabartelle.com
dcc.coop
hdzz.top
treesandstarsoracle.com
rebarunikont.com
achivego.site
baipiao100.com
menslibwrty.com
insulationtraining.online
horseflix.club
suxyqyu.xyz
sqoki.com
ffbsjhvbsjhbvsajv.xyz
beapest.cfd
4892166.com
dvdmediastar.com
hotwomensearching4u.site
cupompetlover.com
terrapretasales.com
joinsequene.com
powerkitap.com
jonjene.com
wqcwgl.com
utahexotics.com
ballerboutique.com
cftronline.com
gettidaladvance.site
anagladstonedesign.com
bunsi-figura.store
ttvip-13.net
cmjysx-uqps.website
ifealafia.com
carlospainter.com
elitetrio.xyz
inggridangelia.com
leporebaq.com
youpinhang.com
palm3d.net
wo567567.com
shinecleaningasheville.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/480-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exedescription pid process target process PID 4768 set thread context of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeSecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exepid process 3968 powershell.exe 480 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe 480 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe 3968 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3968 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exedescription pid process target process PID 4768 wrote to memory of 3968 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe powershell.exe PID 4768 wrote to memory of 3968 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe powershell.exe PID 4768 wrote to memory of 3968 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe powershell.exe PID 4768 wrote to memory of 316 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe schtasks.exe PID 4768 wrote to memory of 316 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe schtasks.exe PID 4768 wrote to memory of 316 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe schtasks.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe PID 4768 wrote to memory of 480 4768 SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tWStOCQnYqUiv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tWStOCQnYqUiv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp42FF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen3.24938.19146.12821.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp42FF.tmpFilesize
1KB
MD549ca5a5f53fa84923f526611f6ac6676
SHA1d2d8ed16d4e52731af785c75262522d20c5545d9
SHA256d93a7d4152f1ed6b84e30e0934dc841c8bd6ca0cb917530578607bb0d0dd66e5
SHA512be44aeddcf000822ef5861739080ae8d5a96305ca7d77c98ca7ad39f10c502fc66e6e2db690667fe03b8ea83d8feb6a6ba3dccc7b0c7adcca27799f729924cfd
-
memory/316-138-0x0000000000000000-mapping.dmp
-
memory/480-147-0x00000000010E0000-0x000000000142A000-memory.dmpFilesize
3.3MB
-
memory/480-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/480-142-0x0000000000000000-mapping.dmp
-
memory/3968-144-0x0000000004D60000-0x0000000004D82000-memory.dmpFilesize
136KB
-
memory/3968-153-0x0000000006F30000-0x0000000006F4A000-memory.dmpFilesize
104KB
-
memory/3968-139-0x0000000004650000-0x0000000004686000-memory.dmpFilesize
216KB
-
memory/3968-158-0x0000000007260000-0x0000000007268000-memory.dmpFilesize
32KB
-
memory/3968-141-0x0000000004E00000-0x0000000005428000-memory.dmpFilesize
6.2MB
-
memory/3968-157-0x0000000007270000-0x000000000728A000-memory.dmpFilesize
104KB
-
memory/3968-156-0x0000000007170000-0x000000000717E000-memory.dmpFilesize
56KB
-
memory/3968-155-0x00000000071B0000-0x0000000007246000-memory.dmpFilesize
600KB
-
memory/3968-145-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/3968-146-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/3968-154-0x0000000006FA0000-0x0000000006FAA000-memory.dmpFilesize
40KB
-
memory/3968-148-0x0000000005C40000-0x0000000005C5E000-memory.dmpFilesize
120KB
-
memory/3968-149-0x0000000006DE0000-0x0000000006E12000-memory.dmpFilesize
200KB
-
memory/3968-150-0x0000000071530000-0x000000007157C000-memory.dmpFilesize
304KB
-
memory/3968-151-0x00000000061E0000-0x00000000061FE000-memory.dmpFilesize
120KB
-
memory/3968-152-0x0000000007580000-0x0000000007BFA000-memory.dmpFilesize
6.5MB
-
memory/3968-137-0x0000000000000000-mapping.dmp
-
memory/4768-133-0x0000000005780000-0x0000000005D24000-memory.dmpFilesize
5.6MB
-
memory/4768-132-0x00000000005E0000-0x00000000006D8000-memory.dmpFilesize
992KB
-
memory/4768-134-0x00000000050C0000-0x0000000005152000-memory.dmpFilesize
584KB
-
memory/4768-135-0x0000000002D20000-0x0000000002D2A000-memory.dmpFilesize
40KB
-
memory/4768-136-0x000000000B140000-0x000000000B1DC000-memory.dmpFilesize
624KB