f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

Analysis

max time kernel
152s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Size

140KB
MD5

8105ddb3424410d0976541ce8ccc1180
SHA1

9f8218beda4df48045eee3dde10eeba91ee98b8f
SHA256

f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470
SHA512

85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092
SSDEEP

3072:uu57vfo1bhEHcml4TlcKZukAIX09ZfUsHOQBRSc:uGvfkVE8ml4GK8iUfvR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	siiyuu.exe

Executes dropped EXE 2 IoCs

pid	Process
804	siiyuu.exe
760	siiyuu.exe

Loads dropped DLL 2 IoCs

pid	Process
1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /l"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /s"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /y"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /k"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /b"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /t"	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /e"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /g"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /c"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /q"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /v"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /t"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /h"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /u"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /p"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /x"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /z"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /n"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /f"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /o"	siiyuu.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /m"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /r"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /i"	siiyuu.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /a"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /d"	siiyuu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\siiyuu = "C:\\Users\\Admin\\siiyuu.exe /w"	siiyuu.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	siiyuu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	siiyuu.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\c\autorun.inf	siiyuu.exe
File created	C:\Users\Admin\c\autorun.inf	siiyuu.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 804 set thread context of 760	804	siiyuu.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe
760	siiyuu.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
804	siiyuu.exe
760	siiyuu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1808 wrote to memory of 1996	1808	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	27
PID 1996 wrote to memory of 1780	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	28
PID 1996 wrote to memory of 1780	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	28
PID 1996 wrote to memory of 1780	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	28
PID 1996 wrote to memory of 1780	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	28
PID 1996 wrote to memory of 1296	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	30
PID 1996 wrote to memory of 1296	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	30
PID 1996 wrote to memory of 1296	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	30
PID 1996 wrote to memory of 1296	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	30
PID 1996 wrote to memory of 1284	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	32
PID 1996 wrote to memory of 1284	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	32
PID 1996 wrote to memory of 1284	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	32
PID 1996 wrote to memory of 1284	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	32
PID 1780 wrote to memory of 1392	1780	cmd.exe	33
PID 1780 wrote to memory of 1392	1780	cmd.exe	33
PID 1780 wrote to memory of 1392	1780	cmd.exe	33
PID 1780 wrote to memory of 1392	1780	cmd.exe	33
PID 1996 wrote to memory of 1980	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	34
PID 1996 wrote to memory of 1980	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	34
PID 1996 wrote to memory of 1980	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	34
PID 1996 wrote to memory of 1980	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	34
PID 1996 wrote to memory of 368	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	37
PID 1996 wrote to memory of 368	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	37
PID 1996 wrote to memory of 368	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	37
PID 1996 wrote to memory of 368	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	37
PID 1296 wrote to memory of 1944	1296	cmd.exe	38
PID 1296 wrote to memory of 1944	1296	cmd.exe	38
PID 1296 wrote to memory of 1944	1296	cmd.exe	38
PID 1296 wrote to memory of 1944	1296	cmd.exe	38
PID 1996 wrote to memory of 600	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	40
PID 1996 wrote to memory of 600	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	40
PID 1996 wrote to memory of 600	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	40
PID 1996 wrote to memory of 600	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	40
PID 1284 wrote to memory of 672	1284	cmd.exe	41
PID 1284 wrote to memory of 672	1284	cmd.exe	41
PID 1284 wrote to memory of 672	1284	cmd.exe	41
PID 1284 wrote to memory of 672	1284	cmd.exe	41
PID 1980 wrote to memory of 872	1980	cmd.exe	42
PID 1980 wrote to memory of 872	1980	cmd.exe	42
PID 1980 wrote to memory of 872	1980	cmd.exe	42
PID 1980 wrote to memory of 872	1980	cmd.exe	42
PID 1996 wrote to memory of 804	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	43
PID 1996 wrote to memory of 804	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	43
PID 1996 wrote to memory of 804	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	43
PID 1996 wrote to memory of 804	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	43
PID 1996 wrote to memory of 1836	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	46
PID 1996 wrote to memory of 1836	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	46
PID 1996 wrote to memory of 1836	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	46
PID 1996 wrote to memory of 1836	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	46
PID 1996 wrote to memory of 1480	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	48
PID 1996 wrote to memory of 1480	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	48
PID 1996 wrote to memory of 1480	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	48
PID 1996 wrote to memory of 1480	1996	f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe	48
PID 368 wrote to memory of 1724	368	cmd.exe	49
PID 368 wrote to memory of 1724	368	cmd.exe	49
PID 368 wrote to memory of 1724	368	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
"C:\Users\Admin\AppData\Local\Temp\f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe
  "C:\Users\Admin\AppData\Local\Temp\f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470.exe"78
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 65.52.0.0/14 0.0.0.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 65.52.0.0/14 0.0.0.0
      4⤵
      PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 157.56.0.0/14 0.0.0.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 157.56.0.0/14 0.0.0.0
      4⤵
      PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 157.60.0.0/16 0.0.0.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 157.60.0.0/16 0.0.0.0
      4⤵
      PID:672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 157.54.0.0/15 0.0.0.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 157.54.0.0/15 0.0.0.0
      4⤵
      PID:872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 216.239.32.0/19 0.0.0.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 216.239.32.0/19 0.0.0.0
      4⤵
      PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 74.125.0.0/16 0.0.0.0
    3⤵
    PID:600
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 74.125.0.0/16 0.0.0.0
      4⤵
      PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 91.228.164.0/24 0.0.0.0
    3⤵
    PID:804
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 91.228.164.0/24 0.0.0.0
      4⤵
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 91.228.165.0/24 0.0.0.0
    3⤵
    PID:1836
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 91.228.165.0/24 0.0.0.0
      4⤵
      PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 91.228.166.0/24 0.0.0.0
    3⤵
    PID:1480
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 91.228.166.0/24 0.0.0.0
      4⤵
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 91.228.167.0/24 0.0.0.0
    3⤵
    PID:1992
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 91.228.167.0/24 0.0.0.0
      4⤵
      PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 72.32.0.0/16 0.0.0.0
    3⤵
    PID:1384
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 72.32.0.0/16 0.0.0.0
      4⤵
      PID:924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 46.4.0.0/16 0.0.0.0
    3⤵
    PID:840
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 46.4.0.0/16 0.0.0.0
      4⤵
      PID:948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 67.15.0.0/16 0.0.0.0
    3⤵
    PID:360
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 67.15.0.0/16 0.0.0.0
      4⤵
      PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 77.234.40.0/24 0.0.0.0
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 77.234.40.0/24 0.0.0.0
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 95.211.0.0/16 0.0.0.0
    3⤵
    PID:2004
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 95.211.0.0/16 0.0.0.0
      4⤵
      PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 195.122.128.0/18 0.0.0.0
    3⤵
    PID:1344
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 195.122.128.0/18 0.0.0.0
      4⤵
      PID:764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 85.12.0.0/18 0.0.0.0
    3⤵
    PID:1408
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 85.12.0.0/18 0.0.0.0
      4⤵
      PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 195.27.0.0/16 0.0.0.0
    3⤵
    PID:1296
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 195.27.0.0/16 0.0.0.0
      4⤵
      PID:432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 62.128.100.0/23 0.0.0.0
    3⤵
    PID:916
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 62.128.100.0/23 0.0.0.0
      4⤵
      PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 161.69.0.0/16 0.0.0.0
    3⤵
    PID:624
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 161.69.0.0/16 0.0.0.0
      4⤵
      PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c route add 58.27.64.0/18 0.0.0.0
    3⤵
    PID:1168
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route add 58.27.64.0/18 0.0.0.0
      4⤵
      PID:744
- - C:\Users\Admin\siiyuu.exe
    "C:\Users\Admin\siiyuu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\siiyuu.exe
      "C:\Users\Admin\siiyuu.exe" 78
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Maps connected drives based on registry
      Drops autorun.inf file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 65.52.0.0/14 0.0.0.0
        5⤵
        
        PID:1968
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 65.52.0.0/14 0.0.0.0
        6⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 157.56.0.0/14 0.0.0.0
        5⤵
        
        PID:1556
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 157.56.0.0/14 0.0.0.0
        6⤵
        
        PID:1780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 157.60.0.0/16 0.0.0.0
        5⤵
        
        PID:1520
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 157.60.0.0/16 0.0.0.0
        6⤵
        
        PID:1944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 157.54.0.0/15 0.0.0.0
        5⤵
        
        PID:1292
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 157.54.0.0/15 0.0.0.0
        6⤵
        
        PID:1324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 216.239.32.0/19 0.0.0.0
        5⤵
        
        PID:1936
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 216.239.32.0/19 0.0.0.0
        6⤵
        
        PID:1284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 74.125.0.0/16 0.0.0.0
        5⤵
        
        PID:1392
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 74.125.0.0/16 0.0.0.0
        6⤵
        
        PID:568
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 91.228.164.0/24 0.0.0.0
        5⤵
        
        PID:836
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 91.228.164.0/24 0.0.0.0
        6⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 91.228.166.0/24 0.0.0.0
        5⤵
        
        PID:1408
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 91.228.166.0/24 0.0.0.0
        6⤵
        
        PID:1476
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 91.228.165.0/24 0.0.0.0
        5⤵
        
        PID:872
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 91.228.165.0/24 0.0.0.0
        6⤵
        
        PID:1268
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 72.32.0.0/16 0.0.0.0
        5⤵
        
        PID:432
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 72.32.0.0/16 0.0.0.0
        6⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 91.228.167.0/24 0.0.0.0
        5⤵
        
        PID:600
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 91.228.167.0/24 0.0.0.0
        6⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 67.15.0.0/16 0.0.0.0
        5⤵
        
        PID:2044
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 67.15.0.0/16 0.0.0.0
        6⤵
        
        PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 77.234.40.0/24 0.0.0.0
        5⤵
        
        PID:1712
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 77.234.40.0/24 0.0.0.0
        6⤵
        
        PID:1284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 46.4.0.0/16 0.0.0.0
        5⤵
        
        PID:1976
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 46.4.0.0/16 0.0.0.0
        6⤵
        
        PID:1496
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 95.211.0.0/16 0.0.0.0
        5⤵
        
        PID:852
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 95.211.0.0/16 0.0.0.0
        6⤵
        
        PID:1844
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 195.122.128.0/18 0.0.0.0
        5⤵
        
        PID:1984
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 195.122.128.0/18 0.0.0.0
        6⤵
        
        PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 85.12.0.0/18 0.0.0.0
        5⤵
        
        PID:1512
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 85.12.0.0/18 0.0.0.0
        6⤵
        
        PID:672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 195.27.0.0/16 0.0.0.0
        5⤵
        
        PID:1752
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 195.27.0.0/16 0.0.0.0
        6⤵
        
        PID:1328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 62.128.100.0/23 0.0.0.0
        5⤵
        
        PID:1720
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 62.128.100.0/23 0.0.0.0
        6⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 161.69.0.0/16 0.0.0.0
        5⤵
        
        PID:840
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 161.69.0.0/16 0.0.0.0
        6⤵
        
        PID:316
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c route add 58.27.64.0/18 0.0.0.0
        5⤵
        
        PID:1356
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        route add 58.27.64.0/18 0.0.0.0
        6⤵
        
        PID:472
- - C:\Windows\SysWOW64\PhotoScreensaver.scr
    "C:\Windows\System32\PhotoScreensaver.scr" /S
    3⤵
    PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\siiyuu.exe

Filesize
140KB

MD5
8105ddb3424410d0976541ce8ccc1180

SHA1
9f8218beda4df48045eee3dde10eeba91ee98b8f

SHA256
f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

SHA512
85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092

Download Submit
C:\Users\Admin\siiyuu.exe

Filesize
140KB

MD5
8105ddb3424410d0976541ce8ccc1180

SHA1
9f8218beda4df48045eee3dde10eeba91ee98b8f

SHA256
f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

SHA512
85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092

Download Submit
C:\Users\Admin\siiyuu.exe

Filesize
140KB

MD5
8105ddb3424410d0976541ce8ccc1180

SHA1
9f8218beda4df48045eee3dde10eeba91ee98b8f

SHA256
f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

SHA512
85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092

Download Submit
\Users\Admin\siiyuu.exe

Filesize
140KB

MD5
8105ddb3424410d0976541ce8ccc1180

SHA1
9f8218beda4df48045eee3dde10eeba91ee98b8f

SHA256
f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

SHA512
85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092

Download Submit
\Users\Admin\siiyuu.exe

Filesize
140KB

MD5
8105ddb3424410d0976541ce8ccc1180

SHA1
9f8218beda4df48045eee3dde10eeba91ee98b8f

SHA256
f93c68970d08981ed0bde3893da64482a88bce8d1587c085c0ed806e2a9d2470

SHA512
85326db45adc72e144fa8b3a678bbdc9386fd3cabfd8973963652c5718a0c92f982bd8fb002b41f91bf519cc917e0eb2f2bf65de23289d74abcbb921e739a092

Download Submit
memory/760-139-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/760-141-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1996-71-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1996-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1996-61-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1996-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download