General

  • Target

    Sigh.exe

  • Size

    3.2MB

  • Sample

    240505-rw846scg5t

  • MD5

    6844ce660d57eea4e7379c0422b2d3f3

  • SHA1

    8aa98db9162a7077330564536a4783760671e17e

  • SHA256

    efd47e98593e3e2a14140adccc4dcff634e5087c355da5afc3678807b808044b

  • SHA512

    f5bbb704a83a8058abd3bcd49a42e7ab3bd14b9ccff7f1a5ec01019bfc396f786d2e13987e911c24759336de48cca3ccd982e8c58449feb3344b6603c438eb6f

  • SSDEEP

    98304:2VPB7WztY1XFeI7mL/2P7yIHoSU0xK5VDQq:actYhQ3TIISUUK5VDQq

Malware Config

Targets

    • Target

      Sigh.exe

    • Size

      3.2MB

    • MD5

      6844ce660d57eea4e7379c0422b2d3f3

    • SHA1

      8aa98db9162a7077330564536a4783760671e17e

    • SHA256

      efd47e98593e3e2a14140adccc4dcff634e5087c355da5afc3678807b808044b

    • SHA512

      f5bbb704a83a8058abd3bcd49a42e7ab3bd14b9ccff7f1a5ec01019bfc396f786d2e13987e911c24759336de48cca3ccd982e8c58449feb3344b6603c438eb6f

    • SSDEEP

      98304:2VPB7WztY1XFeI7mL/2P7yIHoSU0xK5VDQq:actYhQ3TIISUUK5VDQq

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks