9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe
Size

88KB
MD5

5e7d6695d0f3deec01f6cdf2cabb2b2c
SHA1

0df0fd1f30040720c07184ac121a913ea17c9715
SHA256

9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d
SHA512

d14a384ac8e12c5c0b13b62bf4fb558bed1897235ba3c601cd11be44f6a632f118d5dee8234f14c20018b32b4103c0a11fd22976efb933bc7b87277386a596fa
SSDEEP

768:6lXIab+3uffZzCjsK2+/T/PmLRBNV3ZJfqHJvE/AZbyt:6JIVoR5K2KjPmLRBNJqHJNZmt

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	siout.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	siout.exe

Loads dropped DLL 2 IoCs

pid	Process
948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe
948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\siout = "C:\\Users\\Admin\\siout.exe"	siout.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	948	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	siout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe
2776	siout.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe
2776	siout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2776	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	29
PID 948 wrote to memory of 2776	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	29
PID 948 wrote to memory of 2776	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	29
PID 948 wrote to memory of 2776	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	29
PID 948 wrote to memory of 2916	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	30
PID 948 wrote to memory of 2916	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	30
PID 948 wrote to memory of 2916	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	30
PID 948 wrote to memory of 2916	948	9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 948	2776	siout.exe	28
PID 2776 wrote to memory of 2916	2776	siout.exe	30
PID 2776 wrote to memory of 2916	2776	siout.exe	30

C:\Users\Admin\AppData\Local\Temp\9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe
"C:\Users\Admin\AppData\Local\Temp\9d54c64ca5b058405d0a5b9fe8f651b9ed01f66e886e349c6c8be4f6060ef76d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\siout.exe
  "C:\Users\Admin\siout.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 800
  2⤵
  - Program crash
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\siout.exe

Filesize
88KB

MD5
87d3c2e66af602c9eeb6b2816d9ce16d

SHA1
e75fb4974defa25ea27177f5c98213eef0cad67c

SHA256
720bbd03d5fd661277ef65b29be2332b75cccfcf113033d59137a4688d11ef62

SHA512
8915168b18e770a1fea0660176ff495136afe5030126833ef2fbaf2684780382054860af61742cb2654403a51f3e2852f445b96b57d34dc3a101716266430f2c

Download Submit