Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 15:38
Behavioral task
behavioral1
Sample
siski.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
siski.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
siski.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
siski.exe
Resource
win11-20240426-en
General
-
Target
siski.exe
-
Size
88KB
-
MD5
a39a9dbad030467f590832a6ab2ff349
-
SHA1
23b9baed2339451a3dc0d710024e4f010fc89be8
-
SHA256
db17812e10401ae3cdc44e07272758c155e215ccc2d4859833d7a26e38706d92
-
SHA512
1ea795f981ecf0abb66c2fc2e1704e5292e319d8ff8d24a7e52b05b03125dc24d46f3b80a5f89acedd7361f0adfc7150a3707f9d41a2b4202e7cd014d359232c
-
SSDEEP
1536:f62bFTb1Y/aBjS2jklqQZyoJPbUu6Ejbg/YVk36H2VLOO/V2G/cR:t5TyCZjks0ymbttnrVkxLOO2McR
Malware Config
Extracted
xworm
character-estimate.gl.at.ply.gg:61192
-
Install_directory
%ProgramData%
-
install_file
Chrome.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/5000-0-0x0000000000980000-0x000000000099C000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2348 powershell.exe 2452 powershell.exe 4260 powershell.exe 3432 powershell.exe -
Drops startup file 2 IoCs
Processes:
siski.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk siski.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk siski.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
siski.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\ProgramData\\Chrome.exe" siski.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesiski.exepid process 3432 powershell.exe 3432 powershell.exe 2348 powershell.exe 2348 powershell.exe 2452 powershell.exe 2452 powershell.exe 4260 powershell.exe 4260 powershell.exe 5000 siski.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
siski.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5000 siski.exe Token: SeDebugPrivilege 3432 powershell.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeDebugPrivilege 5000 siski.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
siski.exepid process 5000 siski.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
siski.exedescription pid process target process PID 5000 wrote to memory of 3432 5000 siski.exe powershell.exe PID 5000 wrote to memory of 3432 5000 siski.exe powershell.exe PID 5000 wrote to memory of 2348 5000 siski.exe powershell.exe PID 5000 wrote to memory of 2348 5000 siski.exe powershell.exe PID 5000 wrote to memory of 2452 5000 siski.exe powershell.exe PID 5000 wrote to memory of 2452 5000 siski.exe powershell.exe PID 5000 wrote to memory of 4260 5000 siski.exe powershell.exe PID 5000 wrote to memory of 4260 5000 siski.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\siski.exe"C:\Users\Admin\AppData\Local\Temp\siski.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\siski.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'siski.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Chrome.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
944B
MD54093e5ab3812960039eba1a814c2ffb0
SHA1b5e4a98a80be72fccd3cc910e93113d2febef298
SHA256c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c
SHA512f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b
-
Filesize
944B
MD5aa6b748cd8f3e3c0e41549529b919e21
SHA15a4b9721f9fb5042f6ef7afd698d5ac5216a88bb
SHA256d7d665a42f940443efb28eb231dfe1c4062394e71fba145d6eea9ec075b0f0e8
SHA512361c523f49428a7e430279099e669a1a8af8764653f42e83105c0da3f8e8dd3be6c1719ea8c158d8f2e8425d74457147a4683190eb4a67019b9d02be44c13534
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82