70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043

Analysis

max time kernel
145s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe
Size

259KB
MD5

04481303b4b82c75931521559373b577
SHA1

39d1e6ccd4c3125d91f26c1b8c98543cd12a682e
SHA256

70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043
SHA512

eedc332fef05cf633ea55225b0aa11a25aed9372a106850d3b56e8527fa2716dfbd92c2afdb1dc7c56d3b885291e45466f2f0d1003d30e57c0f5e686097f44d7
SSDEEP

6144:Jadiw9yt8Q2bsfh6tkezrLVkwKL3fR+Vteqmr:EF9yt8QBhoLVmL3Yb8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1952	tazebama.dl_

Loads dropped DLL 7 IoCs

pid	Process
2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe
2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe
2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe
828	WerFault.exe
828	WerFault.exe
828	WerFault.exe
828	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	tazebama.dl_

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\F:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1952	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	tazebama.dl_

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1952	2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe	26
PID 2000 wrote to memory of 1952	2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe	26
PID 2000 wrote to memory of 1952	2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe	26
PID 2000 wrote to memory of 1952	2000	70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe	26
PID 1952 wrote to memory of 828	1952	tazebama.dl_	27
PID 1952 wrote to memory of 828	1952	tazebama.dl_	27
PID 1952 wrote to memory of 828	1952	tazebama.dl_	27
PID 1952 wrote to memory of 828	1952	tazebama.dl_	27

C:\Users\Admin\AppData\Local\Temp\70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe
"C:\Users\Admin\AppData\Local\Temp\70511d3cae47c93ee36382109ceefcc18baa0241e9ad316be6577118cb14d043.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 316
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
C:\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dl_

Filesize
149KB

MD5
038f26356da2ef82937b6c6734dfcf3b

SHA1
1c0d480dcd2f413e70fa52921fc9240f5858996e

SHA256
1521b49a030032b924f9b0e92eda4167c4be373c80ad467f710b80d94c2de3a6

SHA512
63a76905caec84d84adc9e09111574cde8531d24e06d9474a849995cf81075a9ab0b45c8a3ea32fea9b7d65cec5a9038f51d3adc2f082b9cd45db8fd11a4163c

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/1952-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1952-64-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1952-71-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2000-58-0x0000000000160000-0x0000000000176000-memory.dmp

Filesize
88KB

Download
memory/2000-62-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2000-56-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/2000-55-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download