Analysis
-
max time kernel
194s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe
-
Size
284KB
-
MD5
975d47f13d8d853ba7306000ecc5a2d6
-
SHA1
1729c1f3899c8a2ec1982e474823af9434801b57
-
SHA256
adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68
-
SHA512
e70605bba5552640f20f1c579c5a8f8119f3e03ef67dbc2ba7eea6f4d1d7d32399a3e5aedc83070c464c605e24828f2c616839d53fd406fbb2a3cf6bd9fea034
-
SSDEEP
3072:/n+ynE0lSmpR1TmoNkMl4ymdu+sSi5KKGTKozEDGaKUa6xUgyX6lgq1Kx5RK1fY0:9E0UmVmoNkMl4ymdu+sSi5KKGsjO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siwil.exe -
Executes dropped EXE 1 IoCs
pid Process 3980 siwil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /x" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /D" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /M" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /j" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /q" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /p" siwil.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /m" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /F" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /h" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /k" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /H" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /K" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /I" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /P" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /O" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /Z" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /R" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /l" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /t" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /L" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /f" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /V" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /E" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /C" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /U" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /Q" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /G" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /T" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /W" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /J" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /w" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /i" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /N" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /y" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /S" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /A" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /b" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /c" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /g" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /e" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /s" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /z" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /Y" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /n" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /u" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /o" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /v" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /a" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /d" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /r" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /B" siwil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siwil = "C:\\Users\\Admin\\siwil.exe /X" siwil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe 3980 siwil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5092 adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe 3980 siwil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 3980 5092 adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe 84 PID 5092 wrote to memory of 3980 5092 adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe 84 PID 5092 wrote to memory of 3980 5092 adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe 84 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83 PID 3980 wrote to memory of 5092 3980 siwil.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe"C:\Users\Admin\AppData\Local\Temp\adde0b932ab9830e1bf6094d81d55124970dfc0ffaaad8424e46e34584a5aa68.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\siwil.exe"C:\Users\Admin\siwil.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD54d38869bf830fc7e349cc46ba618109a
SHA10d9cb6e6a2dcdf35ffd35a57b4c03cd7192e7568
SHA256421d0ee4a842a4030c06831a714870d467604e0435af34504340bddaf1c3150e
SHA512e51e7b050f0410c00bf75324ce9c057adc0c75add52d3ffe57efd28eb661e03ac4042464ffa39cb82daed8ca190abed317a3ebb2fe8d4e428cad85a1e6b19a37
-
Filesize
284KB
MD54d38869bf830fc7e349cc46ba618109a
SHA10d9cb6e6a2dcdf35ffd35a57b4c03cd7192e7568
SHA256421d0ee4a842a4030c06831a714870d467604e0435af34504340bddaf1c3150e
SHA512e51e7b050f0410c00bf75324ce9c057adc0c75add52d3ffe57efd28eb661e03ac4042464ffa39cb82daed8ca190abed317a3ebb2fe8d4e428cad85a1e6b19a37