25a3d3859e33ba20bf5ce977c29c6a1aa33320de88b1e41e2e6235f3c764bb6f

General

Target

4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe
Size

285KB
MD5

4b0b2e5e25aefcf2a018bb58ce6f4a4e
SHA1

d30d427278cbef519f124f5869855e049ad998cc
SHA256

25a3d3859e33ba20bf5ce977c29c6a1aa33320de88b1e41e2e6235f3c764bb6f
SHA512

521b87246f39df6d05aa272c8c6d552fa0612730545eae66185b38daae668078d6f5ec28d563ba19f3e427d3dec39fb0797f47c9955000cab9d575e95514164a
SSDEEP

6144:KcnKjO4Cq9i3CmC0x5ASpwf7BFRf3axVbkHVj:dKjyqU3W0DCf7BFR/Pl

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
4840	tazebama.dl_

Loads dropped DLL 1 IoCs

pid	Process
2984	4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	F:\autorun.inf	tazebama.dl_

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	4840	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	tazebama.dl_
4840	tazebama.dl_

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4840	2984	4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe	25
PID 2984 wrote to memory of 4840	2984	4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe	25
PID 2984 wrote to memory of 4840	2984	4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe	25

C:\Users\Admin\AppData\Local\Temp\4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe
"C:\Users\Admin\AppData\Local\Temp\4b0b2e5e25aefcf2a018bb58ce6f4a4e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 752
    3⤵
    - Program crash
    PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 4840
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\tazebama.dl_

Filesize
48KB

MD5
c8113f35b906e0434b5fcd76d4626e69

SHA1
eb5fd5a2a20e052920b5ba8669e4b2669c0a23f7

SHA256
8d191a7b4ea0ba6fc10c0c5bebc12f71b1ebf1e576cd2123413c797242144d1f

SHA512
c255e591a54570bf499cc02baf977a10619aac419b9a4771e29c3ff329126f424fd25148b8da0359e2c588b07c79f842b15759ae7a78db5e3bf3bfa5739fde02

Download Submit
C:\Users\tazebama.dl_

Filesize
32KB

MD5
4a86700e58852a2c8ac124ff77083939

SHA1
fe70fb75252bf5b3b2f8938a3d5a3bc0b49f924a

SHA256
fa64550972742a85debac07a20e28a7b1d455995b183a1d319bb91e43f789e61

SHA512
3705eb7ad83d1b018cbf7b941ad65d009906f7533ef7deb1f5c8eb774df855789137fcbe653be92400b6fdfa6f3930a0048aba50fbe97b0dc4358b52e94f249d

Download Submit
C:\Users\tazebama.dll

Filesize
5KB

MD5
f38611cd6b8664ecaf487d9ae7d8d3b5

SHA1
8343479a725c9504745a48b1bba814511b9e9032

SHA256
069246dfde31029d3754eb3e2bcf8b4f8661e1add72e58e6c69a8c844efdc0a9

SHA512
d834be78f7822e8b7ba81020a4ada79d67935804974e7ca42ce4e825bed45845c415bfb9ef000615be9f6f50b2bceb2fd106a2f66823bed8c5361f5056b22d3f

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
memory/2984-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2984-10-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2984-39-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4840-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4840-38-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads