Analysis

  • max time kernel
    133s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 00:23

General

  • Target

    SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi

  • Size

    44.0MB

  • MD5

    6a4b83674db39468c27616888fc10cab

  • SHA1

    c46c674465c3a0e68710b7932a63cdd87cb32e7d

  • SHA256

    32c691936fd1d4e5829866f1a5e84ee1f91abdf0eeb09638ed9b8b44a5dc7980

  • SHA512

    048ba6db20f7e541e799a2ae80280b37b7446b2e0ffce32ab2f22a8395480a4a852acecbf4277fd892d5ee70672f3f0ff8e657d411a5cd658b1d4441f05c4732

  • SSDEEP

    786432:x5Y4ntUOJwPxk7Q8cMr5LHBNI2SFDLXhWs6yWN+vV4hJei6Y99wDnvkFJtrSI:vY4tUtxV8cM9BN1SF916xN+q56YwDvkM

Score
6/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen21.1874.13361.18609.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4108
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 30DC6C042BA2914ACA238F39B2B2477B C
      2⤵
      • Loads dropped DLL
      PID:624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI1345.tmp

    Filesize

    587KB

    MD5

    9e0aef52f6c03b2fea067342d9d4f22f

    SHA1

    d4431a858c8a7a79315829ec7aa82e838c2714f4

    SHA256

    42b8adafcb4e8496d9822a0c504f449e56456528a9251c153381d3f63d197e5b

    SHA512

    42858a6695d7906b3df4dc97f3b1fac737633a51ffb52e8ec8eddeb21f8cdb53c199bb698e54c4a931155eafd879de6fff114b84f298c84436b776e286ebeeb1