Analysis
-
max time kernel
179s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38a383e4b61a9a8e373d7504dbbe9e26.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
38a383e4b61a9a8e373d7504dbbe9e26.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
38a383e4b61a9a8e373d7504dbbe9e26.exe
-
Size
52KB
-
MD5
38a383e4b61a9a8e373d7504dbbe9e26
-
SHA1
b0ad72a57d8d40e6cf17998d9d39d45dc7293480
-
SHA256
ef6f0f6d252a91f22e251069e6fa02b65c5beba1f1738d81ddd5352039e8f53b
-
SHA512
45bf8f176ac17dd86eb7abd6266829e4231e1ae150fccd306c4f64b433f98ddca147eb21a2eed2d73846bd43f11a3013440e238d959fc15b2cb92848e1feb840
-
SSDEEP
768:uPWn6wcIvMfFej/znY1jskr/v/m89S3rkC6R+wibw52Tzp/u:uxqMfIvYNskr3mbkC6R+Xp/u
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siede.exe -
Executes dropped EXE 1 IoCs
pid Process 2976 siede.exe -
Loads dropped DLL 2 IoCs
pid Process 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\siede = "C:\\Users\\Admin\\siede.exe" siede.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe 2976 siede.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 2976 siede.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2976 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 29 PID 2532 wrote to memory of 2976 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 29 PID 2532 wrote to memory of 2976 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 29 PID 2532 wrote to memory of 2976 2532 38a383e4b61a9a8e373d7504dbbe9e26.exe 29 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14 PID 2976 wrote to memory of 2532 2976 siede.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\38a383e4b61a9a8e373d7504dbbe9e26.exe"C:\Users\Admin\AppData\Local\Temp\38a383e4b61a9a8e373d7504dbbe9e26.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\siede.exe"C:\Users\Admin\siede.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5e78917b2ff906744e1215ff97c976d0c
SHA11c7005adc5515d714b251b49e205faf4ee42b4d0
SHA256b3f8ac42db1b53dc13e0e03cfb0b93434d8a01fd6a337c8a5a512558c5f68330
SHA512a1eab017a1880d2514f26b499560c6ea106eb4c5f9ec00f91d1a2313bbdb2dbfa6b799ea0ad4160bb2a045ebe9c00e23785b1482c6999fd47b7f5f8db826d1cf