dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08

Analysis

max time kernel
144s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
Size

224KB
MD5

97d9b62252924a65c4c0c3e956737b27
SHA1

033f602685338f18ae21d3d92450ba2c2251f274
SHA256

dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08
SHA512

3a5b0cda3a873e28b6959eab68c2b55e0a3d83ebcad3b24b45d4c60fbbdd73b31c4a4cbb91be0b8eec53e458161c7003ad271131d2f71f576c1c0af584243ff3
SSDEEP

3072:YtkEoAWF4ZCD4OnYQqD84uiZSDMKdoWAx0NFZCSgMd3u43mb9gBBTsi:YtkEoAM4iYQqA4uoWJ8SgMd3u43mZg9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1860	tazebama.dl_

Loads dropped DLL 7 IoCs

pid	Process
1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	tazebama.dl_

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\F:	tazebama.dl_
File opened (read-only)	\??\H:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\I:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\X:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\M:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\J:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\Y:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\K:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\F:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\L:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\R:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\W:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\V:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\U:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\Q:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\P:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\O:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\Z:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\N:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\G:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\T:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\E:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\S:	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2008	1976	WerFault.exe	25
1080	1860	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1860	tazebama.dl_
1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1860	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	26
PID 1976 wrote to memory of 1860	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	26
PID 1976 wrote to memory of 1860	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	26
PID 1976 wrote to memory of 1860	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	26
PID 1976 wrote to memory of 2008	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	27
PID 1976 wrote to memory of 2008	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	27
PID 1976 wrote to memory of 2008	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	27
PID 1976 wrote to memory of 2008	1976	dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe	27
PID 1860 wrote to memory of 1080	1860	tazebama.dl_	28
PID 1860 wrote to memory of 1080	1860	tazebama.dl_	28
PID 1860 wrote to memory of 1080	1860	tazebama.dl_	28
PID 1860 wrote to memory of 1080	1860	tazebama.dl_	28

C:\Users\Admin\AppData\Local\Temp\dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe
"C:\Users\Admin\AppData\Local\Temp\dfe31e64464595cefc7915a5dfbe700b434f3ecccf8033f913d0d87029efec08.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 320
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 332
  2⤵
  - Program crash
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.taz

Filesize
71B

MD5
fac3015375e39822ce95190690807bf9

SHA1
1f4e6b5e87471d00ff722598d71bf4bb5acfcab4

SHA256
1fd15e348d7de249428ab905a48488f320658f1de409797aa86b9b36f80117ef

SHA512
25b69a4ac17ccfa0eb734846ad776509a0a0198dd0c9267ab47c969a60fc306f7d1e28d09d66dec3349e25789fcb8b5e9a1d4d5fa65a3278f129bc447a4240e9

Download Submit
C:\Documents and Settings\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
C:\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
71KB

MD5
9abf6714509a04e20a66ad0943faa961

SHA1
0a01bddab950420657719b60279afccefe997926

SHA256
faf13839ed0000e3e79d0fd41318065bd371b3e5fe24cbc913eb995fdf803fbe

SHA512
5e7009ab6caf83c94903fe7a983a5c14621b8b882800b0b160467aa772af432fea12a35681d72eccfef2ccc9be4d987f86f239dcba1bb148150f22b7f96d8a54

Download Submit
C:\zPharaoh.exe

Filesize
71KB

MD5
e8e869097f9a2609a25ddf6344ce1aab

SHA1
3deeeb230a066937c5c87329fc8479e844195b98

SHA256
639f4f79c2555b5642b1ddc46d1dc875eded0dea890ae4c484391f143d7254b8

SHA512
fd5f018b5f5a47d6ae5df3cc4b06a3e90f510a36266a4abbc39e08c9f944b6788f2caa85e2c9a5c4d3346db4d1f9cbd5873f370b0f92a1ee52e9bc1fec04df5d

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
24792fbd97d58fff70274a94fa7cadec

SHA1
3253a5a2dd91e876ca7ecdb49992cba4d19cde8f

SHA256
62048ba5dd2c47edd8c5fb4b47631c13f7c6267e7c8efa86ef9dd1c575424ea4

SHA512
6aecad8045a829ace872a3469649518f642aeb1d1a1a60922607fdec112877c31c7e0721e8b095d4d7ecb6d918b0f289446203682c2c7dfbdde8939ec5b88c34

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/1860-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1860-80-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1860-65-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1976-60-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1976-61-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1976-77-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1976-78-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1976-79-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1976-62-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download