Analysis
-
max time kernel
110s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
sigmahacks0.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sigmahacks0.2.exe
Resource
win10v2004-20240426-en
General
-
Target
sigmahacks0.2.exe
-
Size
6.9MB
-
MD5
10bbd38c21ebf84fea97c3812d57d9c6
-
SHA1
293cec0d7f44151ffbf88dfe408265825f8bca9b
-
SHA256
83c4e5947870b7b9f06044624b420ddc9fbae6898a5c9b4420c3dbeaca508bb9
-
SHA512
a00ec8ed84b806c4aca8564354a6687da64b999d255df7fea4c38e6026c8a4cee665414e96d5e28904d051f4c1a6956193a96c12e52286d6d7f58f39bae8ac31
-
SSDEEP
196608:ESw7sghUuE1R1R9iVTdRUo/Rf7KG0ZLK+4eCA6Pt7R:PwDh10RsFzUURTclC5t7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2840 test.exe -
Loads dropped DLL 2 IoCs
pid Process 2100 sigmahacks0.2.exe 2840 test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2332 chrome.exe 2332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe Token: SeShutdownPrivilege 2332 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe 2332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2840 2100 sigmahacks0.2.exe 29 PID 2100 wrote to memory of 2840 2100 sigmahacks0.2.exe 29 PID 2100 wrote to memory of 2840 2100 sigmahacks0.2.exe 29 PID 2332 wrote to memory of 2544 2332 chrome.exe 31 PID 2332 wrote to memory of 2544 2332 chrome.exe 31 PID 2332 wrote to memory of 2544 2332 chrome.exe 31 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2748 2332 chrome.exe 33 PID 2332 wrote to memory of 2780 2332 chrome.exe 34 PID 2332 wrote to memory of 2780 2332 chrome.exe 34 PID 2332 wrote to memory of 2780 2332 chrome.exe 34 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35 PID 2332 wrote to memory of 2260 2332 chrome.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\onefile_2100_133606256234370000\test.exe"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7809758,0x7fef7809768,0x7fef78097782⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:22⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:82⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1136 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:82⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:12⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:12⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1556 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:22⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:12⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3432 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:82⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:82⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 --field-trial-handle=1020,i,3898912371935648150,15716686244905977767,131072 /prefetch:82⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5795b2f191ac3f51a491104571021e8db
SHA18362013e4aba02d60fb62f986a0ed77992a40a04
SHA256ff75059b88a65c242cefa00f1f3cfb3eee947650405a7e5819aa7a42e51da66d
SHA512a184197dea1301022b6fbb99a5cc8a8d06135ad290cd0e07effb4f7cf6d9fd704b1ae849538e28b644b09bf25029d5f7876a620823bd0a4690df5734e5ce1857
-
Filesize
5KB
MD5dad0d551a046b240b1ac46c4cc6b2985
SHA11c216261aac9aa8cdd3f880abd9a35b0709d3488
SHA256e7c0086ee82152198da459063c7b22bd0b960915a22eeddfa897a058ec11ca91
SHA5125030e6f4b6e7a79ae5b12d5b547068f2a3645c2b1083067ece1051633b393d38e4b63eebce0fc5ec100bb47c1bb41daed2818c94736776ff56ab352647b6fafa
-
Filesize
5KB
MD563684aa21ff31cd67cd6aa2e4b29a3f8
SHA118c0442caaffeff699ec20cd4849482297140e3b
SHA256f8826dbf8f42b7db5a1bca389005d61ca49535018e3b648076d3356ff933f63a
SHA512e29db1458f69c7944d2da4c37a7d40e3ac853bc4d0c5ad6f878cc7cad0b2bc6a4d0a9effa0b3699099470673e6a14eecf84d66e146abbc51510a953af6772973
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b
-
Filesize
9.6MB
MD55244aa93f4209963f6c63e1ef9dde0b9
SHA1642219eec726127fe7fbe9ceb5e223dcf46fbe46
SHA256aeca166d5d3da9e76957686ca8753e95b930d8508f825f3cc6b4bac28da6e142
SHA512e510165f98b070ad3c202734833230779fd95585d28b0a9873afbb5022f488c85e935b7f366a92b89449b42106f4ed76997cac16994386560bd45021d368e28c