Analysis
-
max time kernel
68s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:34
Static task
static1
Behavioral task
behavioral1
Sample
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe
Resource
win10v2004-20220812-en
General
-
Target
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe
-
Size
490KB
-
MD5
04fcc0dd7e3f251d2e914f1fe4c2cc10
-
SHA1
13e3970173c1f8ba8b27b47a628f653fcb3e85a7
-
SHA256
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14
-
SHA512
65c7ea4441238f8afd15bd8b836fea6498b3ee9aefa458194b9e28f71d076cbcf6df03fce87226944bd5e461612d6d5843aeb3627c7a31de2aafe40bf02382cf
-
SSDEEP
6144:AN6OxLfPcvgKV9Mo2b0XXuj09nl+D9HiuFA95FkW3lhwyjenNpb4d48NDao+nDpz:ARzKPMoFXuRncJO
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
tazebama.dl_description ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tazebama.dl_ -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tazebama.dl_description ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tazebama.dl_ -
Executes dropped EXE 1 IoCs
Processes:
tazebama.dl_pid process 572 tazebama.dl_ -
Loads dropped DLL 7 IoCs
Processes:
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exeWerFault.exepid process 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe 524 WerFault.exe 524 WerFault.exe 524 WerFault.exe 524 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tazebama.dl_description ioc process Key created \REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run tazebama.dl_ -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
tazebama.dl_description ioc process File opened (read-only) \??\V: tazebama.dl_ File opened (read-only) \??\U: tazebama.dl_ File opened (read-only) \??\S: tazebama.dl_ File opened (read-only) \??\L: tazebama.dl_ File opened (read-only) \??\I: tazebama.dl_ File opened (read-only) \??\H: tazebama.dl_ File opened (read-only) \??\W: tazebama.dl_ File opened (read-only) \??\X: tazebama.dl_ File opened (read-only) \??\O: tazebama.dl_ File opened (read-only) \??\Z: tazebama.dl_ File opened (read-only) \??\Q: tazebama.dl_ File opened (read-only) \??\P: tazebama.dl_ File opened (read-only) \??\N: tazebama.dl_ File opened (read-only) \??\M: tazebama.dl_ File opened (read-only) \??\K: tazebama.dl_ File opened (read-only) \??\G: tazebama.dl_ File opened (read-only) \??\F: tazebama.dl_ File opened (read-only) \??\Y: tazebama.dl_ File opened (read-only) \??\R: tazebama.dl_ File opened (read-only) \??\J: tazebama.dl_ File opened (read-only) \??\E: tazebama.dl_ File opened (read-only) \??\T: tazebama.dl_ -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
tazebama.dl_description ioc process File opened for modification C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf tazebama.dl_ File opened for modification C:\autorun.inf tazebama.dl_ -
Drops file in Program Files directory 8 IoCs
Processes:
tazebama.dl_description ioc process File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE tazebama.dl_ File opened for modification C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE tazebama.dl_ -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 524 572 WerFault.exe tazebama.dl_ -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
tazebama.dl_pid process 572 tazebama.dl_ -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exetazebama.dl_description pid process target process PID 1196 wrote to memory of 572 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe tazebama.dl_ PID 1196 wrote to memory of 572 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe tazebama.dl_ PID 1196 wrote to memory of 572 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe tazebama.dl_ PID 1196 wrote to memory of 572 1196 29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe tazebama.dl_ PID 572 wrote to memory of 524 572 tazebama.dl_ WerFault.exe PID 572 wrote to memory of 524 572 tazebama.dl_ WerFault.exe PID 572 wrote to memory of 524 572 tazebama.dl_ WerFault.exe PID 572 wrote to memory of 524 572 tazebama.dl_ WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe"C:\Users\Admin\AppData\Local\Temp\29c57fc54ee37bc7d88c15b49256425aad78deec0b4f2623663a598f56c47e14.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 3203⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Documents and Settings\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
C:\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dl_Filesize
151KB
MD5655ffda21cdbbe884aea27a344cd9349
SHA156900feedecbafe02d3ab1cda016e54b00384414
SHA256c0775bd0f8eeaa0aee704dccb63130719a463c6bdb7b8389b92a1e9ff3787ea5
SHA512e563358fec088b51736b66149505953eab64ac863c754b12895949b967fa30ae0a1c2fe98427bbc63d219ababd4188e454e9e61d4e835979be73382b9b4101f1
-
\Users\tazebama.dllFilesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
memory/524-67-0x0000000000000000-mapping.dmp
-
memory/572-59-0x0000000000000000-mapping.dmp
-
memory/572-66-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1196-65-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1196-64-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1196-63-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB
-
memory/1196-54-0x00000000754C1000-0x00000000754C3000-memory.dmpFilesize
8KB
-
memory/1196-55-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1196-72-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1196-73-0x0000000000230000-0x0000000000236000-memory.dmpFilesize
24KB