f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840

General

Target

f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
Size

112KB
MD5

92bfaaa8f8b52ca5615d137b8732fc00
SHA1

bf0b730e68156e7fb9ef003c05521e92b63cada0
SHA256

f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840
SHA512

f8a14bffa5009234d76d8b94d8bf0ac208c4cb8c69bba28c8071cf4d3979a5893f549ae9a9b2cee80f67eb056a4e98e72a5499e30ee3a5d88566efd8425cbc6b
SSDEEP

3072:/sj11+dY6+6oXxsMrk1zxDCqAROVls8nC:+iO6pMY1zxgce

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	sieva.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sieva = "C:\\Users\\Admin\\sieva.exe /n"	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
4396	sieva.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 1336 wrote to memory of 4940	1336	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	90
PID 4940 wrote to memory of 4396	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	93
PID 4940 wrote to memory of 4396	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	93
PID 4940 wrote to memory of 4396	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	93
PID 4940 wrote to memory of 1844	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	94
PID 4940 wrote to memory of 1844	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	94
PID 4940 wrote to memory of 1844	4940	f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe	94
PID 4396 wrote to memory of 3476	4396	sieva.exe	95
PID 4396 wrote to memory of 3476	4396	sieva.exe	95
PID 4396 wrote to memory of 3476	4396	sieva.exe	95

C:\Users\Admin\AppData\Local\Temp\f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
"C:\Users\Admin\AppData\Local\Temp\f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840.exe
  71
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\sieva.exe
    "C:\Users\Admin\sieva.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Users\Admin\sieva.exe
      71
      4⤵
      PID:3476
- - C:\Windows\SysWOW64\PhotoScreensaver.scr
    "C:\Windows\System32\PhotoScreensaver.scr" /S
    3⤵
    PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sieva.exe

Filesize
112KB

MD5
92bfaaa8f8b52ca5615d137b8732fc00

SHA1
bf0b730e68156e7fb9ef003c05521e92b63cada0

SHA256
f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840

SHA512
f8a14bffa5009234d76d8b94d8bf0ac208c4cb8c69bba28c8071cf4d3979a5893f549ae9a9b2cee80f67eb056a4e98e72a5499e30ee3a5d88566efd8425cbc6b

Download Submit
C:\Users\Admin\sieva.exe

Filesize
112KB

MD5
92bfaaa8f8b52ca5615d137b8732fc00

SHA1
bf0b730e68156e7fb9ef003c05521e92b63cada0

SHA256
f0350ff62c007fa6007b3b0fd75f1755356d292b62ca0b5eede052f010232840

SHA512
f8a14bffa5009234d76d8b94d8bf0ac208c4cb8c69bba28c8071cf4d3979a5893f549ae9a9b2cee80f67eb056a4e98e72a5499e30ee3a5d88566efd8425cbc6b

Download Submit
memory/4940-135-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4940-137-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4940-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4940-147-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads