Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe
-
Size
216KB
-
MD5
427ae9919bc22f07e9b106eb288c3478
-
SHA1
a742980d11f095f3982965107cd121f2b59f6e98
-
SHA256
3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017
-
SHA512
09cae5442955f1dbed10563f366f24ccda638b2fce1f19df0cd639f12b925fd812ff71e33f76bc1fdeedbab519f9523d17cecc96a65df4e5955fb25c952b4c1c
-
SSDEEP
6144:H2ZIfrt3+TetonBi3QxRy4g09ICSnqf9uSUgkxtpsaPjK/bEoK828fwAoEn+MR:H2art3+TetonBi3QxRwfnqf9uSUgkxt0
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" siidai.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 siidai.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /R" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /b" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /Q" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /Y" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /e" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /o" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /i" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /v" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /I" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /B" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /d" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /J" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /q" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /P" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /k" 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /X" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /g" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /h" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /n" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /f" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /H" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /r" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /A" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /E" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /C" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /N" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /j" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /U" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /y" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /S" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /p" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /x" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /t" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /G" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /l" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /D" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /V" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /F" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /c" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /L" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /m" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /K" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /z" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /W" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /a" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /u" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /s" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /Z" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /k" siidai.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\siidai = "C:\\Users\\Admin\\siidai.exe /M" siidai.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe 2716 siidai.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 2716 siidai.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2716 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 90 PID 2148 wrote to memory of 2716 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 90 PID 2148 wrote to memory of 2716 2148 3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe"C:\Users\Admin\AppData\Local\Temp\3bb3fc6612d6cb99358274e708e70475b1ce4b6ccc7cdd469804dcd5331c9017.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\siidai.exe"C:\Users\Admin\siidai.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:4140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5fa9f1ed1b6cf2a1a32300937e9a6e44f
SHA1fb86b1779f5e6144d166b6fe0b74ff5020bc518e
SHA256f0e0b567e5eefa5569f100cdd220b19ad0d4b656be897fd79ae710c509b62518
SHA5124e6f709804859cc9a69ce662b603dbfde3692d334faa6f1952e84de300f2a91d2be332f724a9ddf86540cb8414cfa3396231eb73f8157a52d16c08b0a79141c5