e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6

Analysis

max time kernel
152s
max time network
69s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 15:24 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
Size

228KB
MD5

087ec45e852227afab2837ff56c98b09
SHA1

59162f8cbf9a08abfb3f08a58d734c711e6de4f9
SHA256

e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6
SHA512

6bd68b85f738b33dc6f71bb237366237056550c40afdc3a6571e5b5a6ef3ce33a5a0783aa2b4ca69a764bd1e63aa4811c06769a22a2ab08f822038ef84ae302d
SSDEEP

6144:wmo3PFKs7aFwKWwalhrEqxF6snji81RUinKZHg/7S5:wmSPhAmZIH+78

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tieakef.exe

Executes dropped EXE 1 IoCs

pid	Process
1420	tieakef.exe

Loads dropped DLL 2 IoCs

pid	Process
1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /x"	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /x"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /j"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /h"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /w"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /t"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /u"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /v"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /i"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /f"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /d"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /s"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /l"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /z"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /b"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /e"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /r"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /n"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /m"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /q"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /c"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /g"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /p"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /y"	tieakef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /o"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /k"	tieakef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tieakef = "C:\\Users\\Admin\\tieakef.exe /a"	tieakef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe
1420	tieakef.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
1420	tieakef.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1420	1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe	28
PID 1008 wrote to memory of 1420	1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe	28
PID 1008 wrote to memory of 1420	1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe	28
PID 1008 wrote to memory of 1420	1008	e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe	28

C:\Users\Admin\AppData\Local\Temp\e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe
"C:\Users\Admin\AppData\Local\Temp\e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\tieakef.exe
  "C:\Users\Admin\tieakef.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1420

Network

DNS

ns1.musiczipz.com

e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe

Remote address:

8.8.8.8:53

Request

ns1.musiczipz.com

IN A

Response

ns1.musiczipz.com

IN A

81.17.29.147

81.17.29.147:8000

ns1.musiczipz.com

e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe

152 B
3

8.8.8.8:53

ns1.musiczipz.com

dns

e393246e0ed7a430571bad730d71366bd0f90bcbd3defae6225e73ddffac81a6.exe

63 B
79 B
1
1

DNS Request

ns1.musiczipz.com

DNS Response

81.17.29.147

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\tieakef.exe

Filesize
228KB

MD5
ac583f50187fe57a085b6ad870f0b2d8

SHA1
8971d9ab6a9797fd0208aa3890156afab472640f

SHA256
1c33776818e374e48202940f9e42f86e78dddb09fe3bb9e33354fc1f7ceb4868

SHA512
913688560dbb121ffb86784e534b4537d504a92641e852398b925ac99a209421a27fd65388d84d13de84f48da3cc6fd2c05bb7aabf07cd8900e5053df3e91ef0

Download Submit
C:\Users\Admin\tieakef.exe

Filesize
228KB

MD5
ac583f50187fe57a085b6ad870f0b2d8

SHA1
8971d9ab6a9797fd0208aa3890156afab472640f

SHA256
1c33776818e374e48202940f9e42f86e78dddb09fe3bb9e33354fc1f7ceb4868

SHA512
913688560dbb121ffb86784e534b4537d504a92641e852398b925ac99a209421a27fd65388d84d13de84f48da3cc6fd2c05bb7aabf07cd8900e5053df3e91ef0

Download Submit
\Users\Admin\tieakef.exe

Filesize
228KB

MD5
ac583f50187fe57a085b6ad870f0b2d8

SHA1
8971d9ab6a9797fd0208aa3890156afab472640f

SHA256
1c33776818e374e48202940f9e42f86e78dddb09fe3bb9e33354fc1f7ceb4868

SHA512
913688560dbb121ffb86784e534b4537d504a92641e852398b925ac99a209421a27fd65388d84d13de84f48da3cc6fd2c05bb7aabf07cd8900e5053df3e91ef0

Download Submit
\Users\Admin\tieakef.exe

Filesize
228KB

MD5
ac583f50187fe57a085b6ad870f0b2d8

SHA1
8971d9ab6a9797fd0208aa3890156afab472640f

SHA256
1c33776818e374e48202940f9e42f86e78dddb09fe3bb9e33354fc1f7ceb4868

SHA512
913688560dbb121ffb86784e534b4537d504a92641e852398b925ac99a209421a27fd65388d84d13de84f48da3cc6fd2c05bb7aabf07cd8900e5053df3e91ef0

Download Submit
memory/1008-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.