Analysis
-
max time kernel
150s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 23:18
Static task
static1
Behavioral task
behavioral1
Sample
a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe
-
Size
156KB
-
MD5
9581608c6ec27e94353cb3af05890a26
-
SHA1
3bb2df2ff3a9c1f85689077d0a82f60986d54be5
-
SHA256
a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85
-
SHA512
171f4f57f0f1e3c50bb17944edaa6c59ca4be0cb2ee5f460db845d02bd75dfb41bd62753b076c04fe989acd230110a5d027f701df1c6cb8e22e0f6fa896364e3
-
SSDEEP
3072:DpJaAZFgyqTRlU3NhCBvu9pjZEwDxdr8JrcO:9J+Rl+NhwWrjuwDQz
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tiaoh.exe -
Executes dropped EXE 1 IoCs
pid Process 112 tiaoh.exe -
Loads dropped DLL 2 IoCs
pid Process 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /L" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /U" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /i" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /k" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /u" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /N" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /Z" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /t" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /O" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /R" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /s" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /z" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /P" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /p" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /x" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /g" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /n" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /I" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /G" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /a" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /F" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /A" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /w" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /B" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /r" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /S" a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /J" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /D" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /Q" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /e" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /d" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /T" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /C" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /K" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /j" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /o" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /X" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /H" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /q" tiaoh.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /b" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /S" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /V" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /E" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /y" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /h" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /m" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /f" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /M" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /W" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /c" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /l" tiaoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiaoh = "C:\\Users\\Admin\\tiaoh.exe /Y" tiaoh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe 112 tiaoh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 112 tiaoh.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 112 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 27 PID 1308 wrote to memory of 112 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 27 PID 1308 wrote to memory of 112 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 27 PID 1308 wrote to memory of 112 1308 a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe"C:\Users\Admin\AppData\Local\Temp\a01da9ad793a9d2798b2b1062bab0c7cd7e0ce648cb7d9fc8dd0afa7fbf52c85.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\tiaoh.exe"C:\Users\Admin\tiaoh.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD554d71d28b973d1f9a0315237a391f820
SHA1eff33687434ac240edf97a85cc182b0514968064
SHA256d6404f56aeb21b039430e114a90be4385682b95c1bbb77bb10fbebcfdb1db003
SHA5122b8a44dc2a1203bf52e64615b3ef88132436dd97f0b5a210b61791975ed3c87774efd1732e69ec504a31bdd41f5ff8a9549b3efa81b85666cb83fead874de8ff
-
Filesize
156KB
MD554d71d28b973d1f9a0315237a391f820
SHA1eff33687434ac240edf97a85cc182b0514968064
SHA256d6404f56aeb21b039430e114a90be4385682b95c1bbb77bb10fbebcfdb1db003
SHA5122b8a44dc2a1203bf52e64615b3ef88132436dd97f0b5a210b61791975ed3c87774efd1732e69ec504a31bdd41f5ff8a9549b3efa81b85666cb83fead874de8ff
-
Filesize
156KB
MD554d71d28b973d1f9a0315237a391f820
SHA1eff33687434ac240edf97a85cc182b0514968064
SHA256d6404f56aeb21b039430e114a90be4385682b95c1bbb77bb10fbebcfdb1db003
SHA5122b8a44dc2a1203bf52e64615b3ef88132436dd97f0b5a210b61791975ed3c87774efd1732e69ec504a31bdd41f5ff8a9549b3efa81b85666cb83fead874de8ff
-
Filesize
156KB
MD554d71d28b973d1f9a0315237a391f820
SHA1eff33687434ac240edf97a85cc182b0514968064
SHA256d6404f56aeb21b039430e114a90be4385682b95c1bbb77bb10fbebcfdb1db003
SHA5122b8a44dc2a1203bf52e64615b3ef88132436dd97f0b5a210b61791975ed3c87774efd1732e69ec504a31bdd41f5ff8a9549b3efa81b85666cb83fead874de8ff