Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
085b8e9398cb3025341cd92de727557e.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
085b8e9398cb3025341cd92de727557e.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
085b8e9398cb3025341cd92de727557e.exe
-
Size
380KB
-
MD5
085b8e9398cb3025341cd92de727557e
-
SHA1
d302dfe43ae3e9da4b810ada55d64a42c1c09b3e
-
SHA256
44d2beb8f1baf8eaa45bb11329e1ce31a42ce8d34ef674f9ef0448ad719af0c9
-
SHA512
14eae39743377a41423b7c17dacc569fd5b11edc8c5920025ca459008090d4d5fb7f47effcb456314015f2adca8916ce6740879fa03d5dc87f5fbb5d40087dd3
-
SSDEEP
6144:oht36K1Zc/jWhvd0yTNxjT0M1zWyjYd/dG:6tKKQeV0C30IzWf8
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tiifem.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 085b8e9398cb3025341cd92de727557e.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 085b8e9398cb3025341cd92de727557e.exe -
Executes dropped EXE 1 IoCs
pid Process 1728 tiifem.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /a" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /u" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /x" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /n" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /e" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /y" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /o" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /h" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /c" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /p" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /w" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /b" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /s" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /r" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /j" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /i" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /m" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /q" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /f" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /l" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /g" 085b8e9398cb3025341cd92de727557e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /g" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /d" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /z" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /v" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /k" tiifem.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiifem = "C:\\Users\\Admin\\tiifem.exe /t" tiifem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 085b8e9398cb3025341cd92de727557e.exe 1208 085b8e9398cb3025341cd92de727557e.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe 1728 tiifem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1208 085b8e9398cb3025341cd92de727557e.exe 1728 tiifem.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1728 1208 085b8e9398cb3025341cd92de727557e.exe 93 PID 1208 wrote to memory of 1728 1208 085b8e9398cb3025341cd92de727557e.exe 93 PID 1208 wrote to memory of 1728 1208 085b8e9398cb3025341cd92de727557e.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\085b8e9398cb3025341cd92de727557e.exe"C:\Users\Admin\AppData\Local\Temp\085b8e9398cb3025341cd92de727557e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\tiifem.exe"C:\Users\Admin\tiifem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5449f4837f4570b64bf72a3fda3265b18
SHA1fee8aefaaeb815b7c257d6910aa0b549f2f4fd3b
SHA2560b2eaa16db8d752aff0089f3cfae1a9b335c26acebf4429161f3741a8883a3b6
SHA5127456a5a8c47df72ca50f3d2581b33c224179a1cdac8d0c6ca038e58660d85b46e4a40f7cb4ebd825219573727ad814c047fde5fe712923fa9d7e1f9f0fdf7229
-
Filesize
341KB
MD5c0ef1563c96cf9985590cf05472590e9
SHA1e507057b0331b25e9ace5b1ac17078edf13cd545
SHA2568d547c3f52192c5a9373fa6ac2eb70f538c22c328607a7e3ad28366983e5dad8
SHA5122eb2c93edcef3469ab995dca4f44e15a87c7fbb810111f84f92f184bf819533e0f698f40c5db81da2d864a4ba93f3fefab570f9c581c6dcbfa247d7ffb699381