Analysis
- max time kernel
150s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 04:48
General
- Target sigmabot.exe
- Size 2.2MB
- Sample260523-ffd4bac13l
- SHA256 16a4f8b310262069b2d25b460200ebb05f6f037ee9cb720f1d365844eb85e0ec
Malware Config
Signatures
- UAC bypass 3 TTPs 3 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Disables Task Manager via registry modification
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- System policy modification 1 TTPs 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmabot.exe"C:\Users\Admin\AppData\Local\Temp\sigmabot.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sigmabot\bin\sigmabot.exe"C:\Users\Admin\AppData\Roaming\sigmabot\bin\sigmabot.exe"2⤵
- UAC bypass
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Checkpoint-Computer -Description 'Windows Update' -RestorePointType 'MODIFY_SETTINGS'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\sigmabot\sigmabot.exeC:\Users\Admin\AppData\Roaming\sigmabot\sigmabot.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\sigmabot\sigmabot.exeC:\Users\Admin\AppData\Roaming\sigmabot\sigmabot.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ipd2frvc.hvk.ps1
sigmabot.exe
sigmabot_20260523_054838.log
memory/1948-24-0x00007FF6E7F80000-0x00007FF6EA6FE000-memory.dmp
memory/2228-30-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-33-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-7-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-43-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-42-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-26-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-41-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-31-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-32-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-40-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-35-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-36-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-37-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-38-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2228-39-0x00007FF6EF550000-0x00007FF6F1CCE000-memory.dmp
memory/2536-22-0x00007FF6E7F80000-0x00007FF6EA6FE000-memory.dmp
memory/2928-0-0x00007FF7194A0000-0x00007FF71BC1E000-memory.dmp
memory/2928-6-0x00007FF7194A0000-0x00007FF71BC1E000-memory.dmp
memory/4576-18-0x0000026AE5820000-0x0000026AE5842000-memory.dmp