10a7e65a3a7aa1a7bbf4c0f412425d840df9f6d211f3c1badc41240f4145d501

General

Target

tmp.exe
Size

48KB
MD5

768b7b0bc0eeb12c635b7964c718ec5f
SHA1

2478a9f51b8c14e3a6e4de42d799520e33387589
SHA256

10a7e65a3a7aa1a7bbf4c0f412425d840df9f6d211f3c1badc41240f4145d501
SHA512

067ce6ef6c7fd25d65f7e4f751581df3a365374230e80a9eb0890831530d3b6b596c1e22fff8f3524a9586c35f927666ae68e2407ecf1805a534fa2298a129c9
SSDEEP

768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67xHhPC:Ub1MsHz3JDwhyWr+N95OTga6O

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SICi\Parameters\ServiceDll = "C:\\Program Files (x86)\\259395997.dll"	tmp.exe

Deletes itself 1 IoCs

pid	Process
2936	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	SICi.exe

Loads dropped DLL 7 IoCs

pid	Process
1924	tmp.exe
2980	svchost.exe
2980	svchost.exe
2584	SICi.exe
2584	SICi.exe
2584	SICi.exe
2584	SICi.exe

Creates a Windows Service
persistence

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SICi.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\SICi.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\259395997.dll	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SICi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SICi.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SICi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	SICi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	SICi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	SICi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	SICi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	SICi.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1924	tmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2936	1924	tmp.exe	30
PID 1924 wrote to memory of 2936	1924	tmp.exe	30
PID 1924 wrote to memory of 2936	1924	tmp.exe	30
PID 1924 wrote to memory of 2936	1924	tmp.exe	30
PID 2936 wrote to memory of 2096	2936	cmd.exe	32
PID 2936 wrote to memory of 2096	2936	cmd.exe	32
PID 2936 wrote to memory of 2096	2936	cmd.exe	32
PID 2936 wrote to memory of 2096	2936	cmd.exe	32
PID 2980 wrote to memory of 2584	2980	svchost.exe	33
PID 2980 wrote to memory of 2584	2980	svchost.exe	33
PID 2980 wrote to memory of 2584	2980	svchost.exe	33
PID 2980 wrote to memory of 2584	2980	svchost.exe	33

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - Runs ping.exe
    PID:2096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "SICi"
1⤵
PID:2940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "SICi"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\SICi.exe
  C:\Windows\system32\SICi.exe "c:\program files (x86)\259395997.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\259395997.dll

Filesize
25KB

MD5
a32cc9fb4286b4912843dbebff5fc5b2

SHA1
c2f45a8ebc92a34e9d94160206fbe75fb3d500d6

SHA256
8875e15d206f1156f5581c0020c695f1751deaaed83816d1298719be27c57a4d

SHA512
47106d800232f6b58d040502b66afe0470810286f3638f85c0cbc6c6919c2fc2d8016d464a0adc5f3afeaeddc67f984fa19b20d1f978fda15269ee0dad1691c7

Download Submit
\Windows\SysWOW64\SICi.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads