4a3c115c881954e12b5f5778c16b149f35396d59aa413a92c6b42c4e31c6568f

Analysis

max time kernel
101s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sillet.exe
Size 9.9MB
Sample261110-yec4qsae45
SHA256 4a3c115c881954e12b5f5778c16b149f35396d59aa413a92c6b42c4e31c6568f
MD5 322d416fc2fbe9d8234d078988275971
SHA1 b6354171d2bb811e3b1b33295d98fec1569d980b
SHA512 9bc235c188e5a315aed4d6aeb5dde47afc17836efda933ba4a80c82ccf100b02e14e4b1f0caf758be42d8584a1bb5d348bd15c08fd36fe6814fe77dd28d6bc50
SSDEEP 196608:wqhN6jJXn+/rt+FXG4+OwRKOYNiUyauSGQFrwl8IcKSgc:wqhsxX4BYNiUNuSGqcGV
TLSH
T1B9A6F14263B53A4AEEBA9BB8593A860506BF3D825934E2CD711C75CE48F17F44DB4323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sillet = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sillet.exe\" --background"	Sillet.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	Sillet.exe
File opened (read-only)	\??\D:	Sillet.exe
File opened (read-only)	\??\K:	Sillet.exe
File opened (read-only)	\??\L:	Sillet.exe
File opened (read-only)	\??\U:	Sillet.exe
File opened (read-only)	\??\V:	Sillet.exe
File opened (read-only)	\??\W:	Sillet.exe
File opened (read-only)	\??\A:	Sillet.exe
File opened (read-only)	\??\G:	Sillet.exe
File opened (read-only)	\??\I:	Sillet.exe
File opened (read-only)	\??\J:	Sillet.exe
File opened (read-only)	\??\O:	Sillet.exe
File opened (read-only)	\??\P:	Sillet.exe
File opened (read-only)	\??\Q:	Sillet.exe
File opened (read-only)	\??\R:	Sillet.exe
File opened (read-only)	\??\M:	Sillet.exe
File opened (read-only)	\??\N:	Sillet.exe
File opened (read-only)	\??\S:	Sillet.exe
File opened (read-only)	\??\T:	Sillet.exe
File opened (read-only)	\??\X:	Sillet.exe
File opened (read-only)	\??\Z:	Sillet.exe
File opened (read-only)	\??\H:	Sillet.exe
File opened (read-only)	\??\Y:	Sillet.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Sillet.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Sillet.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\shell\open	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sillet.exe\" \"%1\""	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\DefaultIcon	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\shell\open\command	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\ = "URL:Sillet"	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\URL Protocol	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\DefaultIcon	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\shell\open\command	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\shell	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sillet.exe\",0"	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\URL Protocol	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\shell	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\shell\open	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sillet.exe\" \"%1\""	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\sillet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Sillet.exe\",0"	Sillet.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc	Sillet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\wc\ = "URL:WalletConnect"	Sillet.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3292	Sillet.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	Sillet.exe
Token: SeShutdownPrivilege	3292	Sillet.exe
Token: SeCreatePagefilePrivilege	3292	Sillet.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3292	Sillet.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3292	Sillet.exe

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Sillet.exe

C:\Users\Admin\AppData\Local\Temp\Sillet.exe
"C:\Users\Admin\AppData\Local\Temp\Sillet.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:3292

C:\Users\Admin\AppData\Local\Temp\Sillet.exe
"C:\Users\Admin\AppData\Local\Temp\Sillet.exe" --background
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notifications.json

Path C:\Users\Admin\AppData\Local\Sillet\notifications.json
Size 407B
SHA256 3eff4bdbcf5229ddec1b112e111f35fbfe8e7ddf264c14aa0804bcce2dd486a7
MD5 ec9487030eaf78b484f91bacefbd9fe6
SHA1 8afbdd33f580f986e766c5ed9aeb86ea68901b4c
SHA512 8a325b104202e5a84ba48306540af8674e9ac388d48a88983b795233b40c0adc70614c1fbecc69c0c44aa72195e2cf4260f12f53b4da5a05bb41153b4b13cfe4
TLSH
T14DE0ABF7569BDE40B3635F58C6013D510CB4300B164FE20D36588F906096211B6DBCF2
MD5 SHA1 SHA512 TLSH

Submit Download

notifications.json.tmp

Path C:\Users\Admin\AppData\Local\Sillet\notifications.json.tmp
Size 471B
SHA256 940ae148f7faef20796dd44b1ba3f1ab71e673347cfa126b715b03b9ca644098
MD5 fd218c5c02c20e021420488a8c2bb81b
SHA1 89e41cb7e36d0e410a6047a0b68fe1bbe2ea5171
SHA512 a34e63a33cc6d1d23b5881c59f9d4005e0969bb1fa56fc256556f1f7443f85342b08ade40439e85263420cc24088dbc736809705ed614b9864e123106bb6cb19
TLSH
T13DF05C778AC2CC2A3B330EB1A5A07F248E009407E11CEA4833EB007024028E87C06A70
MD5 SHA1 SHA512 TLSH

Submit Download

unlocked.mp3

Path C:\Users\Admin\AppData\Local\Temp\Sillet-sounds\unlocked.mp3
Size 30KB
SHA256 24dcf9306feb59574d06cdb04a962077c0ddb3ed7d1e6f7962ac0ec1bda5e024
MD5 39fcd144b63c8ca0721c5dc1d11ca620
SHA1 debe6c13a122248c3546f0bfc5b13b70a5e83e79
SHA512 67fedee6f41f462dbd0c0a82ee0aa593cfb1261846ea60c6bb6eacee3500d638f8020791b370a6d0f25b51000f59039e4a43ee269592f28cc8327e4a8444477f
SSDEEP 768:r0kLPy7RgJbCqRNP0gn/84mlO6m3LHnkhn6n24ADkHwT8:RSeNCENP0gnPHt37nQS24ADkHwI
TLSH
T1CEE2F18ACB136D28F007BF3C53BD3931E678441EF9B061DDDDA5F6A92BA71865714204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-19-0x000001833F490000-0x000001833F498000-memory.dmp

Download

memory/3292-21-0x0000018341B10000-0x0000018341B4E000-memory.dmp

Download

memory/3292-6-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-7-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-13-0x000001833EAF0000-0x000001833EB12000-memory.dmp

Download

memory/3292-14-0x000001833EB20000-0x000001833F1B0000-memory.dmp

Download

memory/3292-15-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-16-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-17-0x000001833F4B0000-0x000001833F56A000-memory.dmp

Download

memory/3292-18-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-0-0x00007FFBF388F000-0x00007FFBF3890000-memory.dmp

Download

memory/3292-20-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-22-0x0000018341AE0000-0x0000018341AEE000-memory.dmp

Download

memory/3292-5-0x000001833EAA0000-0x000001833EAF0000-memory.dmp

Download

memory/3292-24-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-4-0x000001833E9D0000-0x000001833EA44000-memory.dmp

Download

memory/3292-32-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-33-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-34-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-3-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-1-0x0000018322FD0000-0x00000183239C4000-memory.dmp

Download

memory/3292-2-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-60-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-61-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-62-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

memory/3292-63-0x00007FFBF3700000-0x00007FFBF40A4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads