Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 00:23
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi
-
Size
44.0MB
-
MD5
6a4b83674db39468c27616888fc10cab
-
SHA1
c46c674465c3a0e68710b7932a63cdd87cb32e7d
-
SHA256
32c691936fd1d4e5829866f1a5e84ee1f91abdf0eeb09638ed9b8b44a5dc7980
-
SHA512
048ba6db20f7e541e799a2ae80280b37b7446b2e0ffce32ab2f22a8395480a4a852acecbf4277fd892d5ee70672f3f0ff8e657d411a5cd658b1d4441f05c4732
-
SSDEEP
786432:x5Y4ntUOJwPxk7Q8cMr5LHBNI2SFDLXhWs6yWN+vV4hJei6Y99wDnvkFJtrSI:vY4tUtxV8cM9BN1SF916xN+q56YwDvkM
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1272 msiexec.exe 5 1272 msiexec.exe 7 1272 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 1156 MsiExec.exe 1156 MsiExec.exe 1156 MsiExec.exe 1156 MsiExec.exe 1156 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1272 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1272 msiexec.exe Token: SeIncreaseQuotaPrivilege 1272 msiexec.exe Token: SeRestorePrivilege 764 msiexec.exe Token: SeTakeOwnershipPrivilege 764 msiexec.exe Token: SeSecurityPrivilege 764 msiexec.exe Token: SeCreateTokenPrivilege 1272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1272 msiexec.exe Token: SeLockMemoryPrivilege 1272 msiexec.exe Token: SeIncreaseQuotaPrivilege 1272 msiexec.exe Token: SeMachineAccountPrivilege 1272 msiexec.exe Token: SeTcbPrivilege 1272 msiexec.exe Token: SeSecurityPrivilege 1272 msiexec.exe Token: SeTakeOwnershipPrivilege 1272 msiexec.exe Token: SeLoadDriverPrivilege 1272 msiexec.exe Token: SeSystemProfilePrivilege 1272 msiexec.exe Token: SeSystemtimePrivilege 1272 msiexec.exe Token: SeProfSingleProcessPrivilege 1272 msiexec.exe Token: SeIncBasePriorityPrivilege 1272 msiexec.exe Token: SeCreatePagefilePrivilege 1272 msiexec.exe Token: SeCreatePermanentPrivilege 1272 msiexec.exe Token: SeBackupPrivilege 1272 msiexec.exe Token: SeRestorePrivilege 1272 msiexec.exe Token: SeShutdownPrivilege 1272 msiexec.exe Token: SeDebugPrivilege 1272 msiexec.exe Token: SeAuditPrivilege 1272 msiexec.exe Token: SeSystemEnvironmentPrivilege 1272 msiexec.exe Token: SeChangeNotifyPrivilege 1272 msiexec.exe Token: SeRemoteShutdownPrivilege 1272 msiexec.exe Token: SeUndockPrivilege 1272 msiexec.exe Token: SeSyncAgentPrivilege 1272 msiexec.exe Token: SeEnableDelegationPrivilege 1272 msiexec.exe Token: SeManageVolumePrivilege 1272 msiexec.exe Token: SeImpersonatePrivilege 1272 msiexec.exe Token: SeCreateGlobalPrivilege 1272 msiexec.exe Token: SeCreateTokenPrivilege 1272 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1272 msiexec.exe Token: SeLockMemoryPrivilege 1272 msiexec.exe Token: SeIncreaseQuotaPrivilege 1272 msiexec.exe Token: SeMachineAccountPrivilege 1272 msiexec.exe Token: SeTcbPrivilege 1272 msiexec.exe Token: SeSecurityPrivilege 1272 msiexec.exe Token: SeTakeOwnershipPrivilege 1272 msiexec.exe Token: SeLoadDriverPrivilege 1272 msiexec.exe Token: SeSystemProfilePrivilege 1272 msiexec.exe Token: SeSystemtimePrivilege 1272 msiexec.exe Token: SeProfSingleProcessPrivilege 1272 msiexec.exe Token: SeIncBasePriorityPrivilege 1272 msiexec.exe Token: SeCreatePagefilePrivilege 1272 msiexec.exe Token: SeCreatePermanentPrivilege 1272 msiexec.exe Token: SeBackupPrivilege 1272 msiexec.exe Token: SeRestorePrivilege 1272 msiexec.exe Token: SeShutdownPrivilege 1272 msiexec.exe Token: SeDebugPrivilege 1272 msiexec.exe Token: SeAuditPrivilege 1272 msiexec.exe Token: SeSystemEnvironmentPrivilege 1272 msiexec.exe Token: SeChangeNotifyPrivilege 1272 msiexec.exe Token: SeRemoteShutdownPrivilege 1272 msiexec.exe Token: SeUndockPrivilege 1272 msiexec.exe Token: SeSyncAgentPrivilege 1272 msiexec.exe Token: SeEnableDelegationPrivilege 1272 msiexec.exe Token: SeManageVolumePrivilege 1272 msiexec.exe Token: SeImpersonatePrivilege 1272 msiexec.exe Token: SeCreateGlobalPrivilege 1272 msiexec.exe Token: SeCreateTokenPrivilege 1272 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1272 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29 PID 764 wrote to memory of 1156 764 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1272
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD8E03032E18DCA173A8FC0F42534324 C2⤵
- Loads dropped DLL
PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
587KB
MD59e0aef52f6c03b2fea067342d9d4f22f
SHA1d4431a858c8a7a79315829ec7aa82e838c2714f4
SHA25642b8adafcb4e8496d9822a0c504f449e56456528a9251c153381d3f63d197e5b
SHA51242858a6695d7906b3df4dc97f3b1fac737633a51ffb52e8ec8eddeb21f8cdb53c199bb698e54c4a931155eafd879de6fff114b84f298c84436b776e286ebeeb1
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a