Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-01-2025 21:58
Behavioral task
behavioral1
Sample
Sigma.exe
Resource
win11-20241007-en
windows11-21h2-x64
11 signatures
150 seconds
General
-
Target
Sigma.exe
-
Size
93KB
-
MD5
3226340028efb7e4b25afb92071989a7
-
SHA1
3594f73dc428e035b5c7a2cbb47a7d98944f6ea5
-
SHA256
7c51a525e1e83ee71f025dbb1b88c5f5da9562871cd7bff35820b6f85c28639b
-
SHA512
cc13efaaba5b2a1a927f1585948b974e5232a71989db42b546c9e2a200a4c8f6b1f251e5cf6f6247aae60b45e3851521f83df2ececbeeea04adbf7dde49dde0c
-
SSDEEP
1536:TVwC+xhUa9urgOBPRNvM4jEwzGi1dDQDigS:TVmUa9urgObdGi1dmH
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2656 netsh.exe 4968 netsh.exe 5884 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 5488 server.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sigma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe 5488 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5488 server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe Token: 33 5488 server.exe Token: SeIncBasePriorityPrivilege 5488 server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5016 wrote to memory of 5488 5016 Sigma.exe 79 PID 5016 wrote to memory of 5488 5016 Sigma.exe 79 PID 5016 wrote to memory of 5488 5016 Sigma.exe 79 PID 5488 wrote to memory of 2656 5488 server.exe 80 PID 5488 wrote to memory of 2656 5488 server.exe 80 PID 5488 wrote to memory of 2656 5488 server.exe 80 PID 5488 wrote to memory of 4968 5488 server.exe 82 PID 5488 wrote to memory of 4968 5488 server.exe 82 PID 5488 wrote to memory of 4968 5488 server.exe 82 PID 5488 wrote to memory of 5884 5488 server.exe 83 PID 5488 wrote to memory of 5884 5488 server.exe 83 PID 5488 wrote to memory of 5884 5488 server.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sigma.exe"C:\Users\Admin\AppData\Local\Temp\Sigma.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2656
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4968
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5884
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:3176
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD53226340028efb7e4b25afb92071989a7
SHA13594f73dc428e035b5c7a2cbb47a7d98944f6ea5
SHA2567c51a525e1e83ee71f025dbb1b88c5f5da9562871cd7bff35820b6f85c28639b
SHA512cc13efaaba5b2a1a927f1585948b974e5232a71989db42b546c9e2a200a4c8f6b1f251e5cf6f6247aae60b45e3851521f83df2ececbeeea04adbf7dde49dde0c
-
Filesize
5B
MD58f11404a507cfb98455f89a534077f73
SHA10716c668f504450353527aff1a6457b8348cf435
SHA256f7c301f3fcce1c2444b540090e5024f0cea1806ab8ae1d81901ecc3b63334cbb
SHA51285403dd06da5851e8c4d727ca8d87cc0e7ff4974942ec22123366684ed0e51b543a29b6d2521e2e65784c69884fde8d711e5064f104b098293fcd18c44769492