Analysis
-
max time kernel
187s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 03:34
Static task
static1
Behavioral task
behavioral1
Sample
769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe
-
Size
48KB
-
MD5
fff8d991fe97984fb1710ba5bcfb2b16
-
SHA1
396adbb7e6228b266daa118cea9bd337f5230e44
-
SHA256
769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70
-
SHA512
5f44e82ab6a66d4eb60ea2e525f7285ffd6ae1e6e66ea7668f9237e65b12d7ba1c45c192aafb3d11afb9f467849635eb73cdb036523b604b107059981df49ee4
-
SSDEEP
768:ZeNEhmSglfzBv+6wH9H7MfygXaDMFQXD7e:Zeamjfx6NNDsQXD7
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siuon.exe -
Executes dropped EXE 1 IoCs
pid Process 1816 siuon.exe -
Loads dropped DLL 2 IoCs
pid Process 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\siuon = "C:\\Users\\Admin\\siuon.exe" siuon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ siuon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe 1816 siuon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 1816 siuon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 1816 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 28 PID 972 wrote to memory of 1816 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 28 PID 972 wrote to memory of 1816 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 28 PID 972 wrote to memory of 1816 972 769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe 28 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27 PID 1816 wrote to memory of 972 1816 siuon.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe"C:\Users\Admin\AppData\Local\Temp\769450e7d371b2de969a03992d341df06eb113c3e8827c40fbe085451f4cfd70.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\siuon.exe"C:\Users\Admin\siuon.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5dbe76266b3cdee600b7f2d444be5f6bf
SHA180772ec34b3bd430d3a03b1daa8a233029a8ffdf
SHA2567713a7015d4d3d47f02fce86b76e380496f39613cfbd359d50b6dcc1ba046373
SHA5126f8adaed7044005e6ae72951442a876e9841791aa0fd9767d0cedf9306f7ef90eabed138d3f5119cafe9928a593f84c1fe425a7a2a9513d08fdd22f8f4a03f51
-
Filesize
48KB
MD5dbe76266b3cdee600b7f2d444be5f6bf
SHA180772ec34b3bd430d3a03b1daa8a233029a8ffdf
SHA2567713a7015d4d3d47f02fce86b76e380496f39613cfbd359d50b6dcc1ba046373
SHA5126f8adaed7044005e6ae72951442a876e9841791aa0fd9767d0cedf9306f7ef90eabed138d3f5119cafe9928a593f84c1fe425a7a2a9513d08fdd22f8f4a03f51
-
Filesize
48KB
MD5dbe76266b3cdee600b7f2d444be5f6bf
SHA180772ec34b3bd430d3a03b1daa8a233029a8ffdf
SHA2567713a7015d4d3d47f02fce86b76e380496f39613cfbd359d50b6dcc1ba046373
SHA5126f8adaed7044005e6ae72951442a876e9841791aa0fd9767d0cedf9306f7ef90eabed138d3f5119cafe9928a593f84c1fe425a7a2a9513d08fdd22f8f4a03f51
-
Filesize
48KB
MD5dbe76266b3cdee600b7f2d444be5f6bf
SHA180772ec34b3bd430d3a03b1daa8a233029a8ffdf
SHA2567713a7015d4d3d47f02fce86b76e380496f39613cfbd359d50b6dcc1ba046373
SHA5126f8adaed7044005e6ae72951442a876e9841791aa0fd9767d0cedf9306f7ef90eabed138d3f5119cafe9928a593f84c1fe425a7a2a9513d08fdd22f8f4a03f51