64700929a962499a22aa113a9d65c52118ac590ccbb2bac32def207f6d6d90de

General

Target

52134e3e35b9282f2eed10036d4ce956.exe
Size

521KB
MD5

52134e3e35b9282f2eed10036d4ce956
SHA1

4db1297cac639c00daf13b011f365b66044399e1
SHA256

64700929a962499a22aa113a9d65c52118ac590ccbb2bac32def207f6d6d90de
SHA512

d611b384f001bf78d12e8e38224b4270b7890d47874023c4e6d8d427ea541a0717efca86d8b2dd50ec5f7bfda344e238c55bc8a025b62e969aff756fbed4436e
SSDEEP

6144:Jrpg/tzZfgqrIRAZCqcWP12MZkL5E0T11gkizxbQFLyKDQ3rG3eRJkSh5lQR:Jrpyz2qrIPq3XZkLWigfYLypq3eRJJbk

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Executes dropped EXE 1 IoCs

pid	Process
1952	tazebama.dl_

Loads dropped DLL 1 IoCs

pid	Process
3796	52134e3e35b9282f2eed10036d4ce956.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3796-0-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-13-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-11-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-7-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-51-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-52-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-54-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-53-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-56-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-57-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-58-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-59-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-60-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-61-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-62-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-63-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-64-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-65-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral2/memory/3796-66-0x0000000000400000-0x000000000050D000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	F:\autorun.inf	tazebama.dl_

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	1952	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1952	tazebama.dl_
1952	tazebama.dl_
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe
3796	52134e3e35b9282f2eed10036d4ce956.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 1952	3796	52134e3e35b9282f2eed10036d4ce956.exe	18
PID 3796 wrote to memory of 1952	3796	52134e3e35b9282f2eed10036d4ce956.exe	18
PID 3796 wrote to memory of 1952	3796	52134e3e35b9282f2eed10036d4ce956.exe	18

C:\Users\Admin\AppData\Local\Temp\52134e3e35b9282f2eed10036d4ce956.exe
"C:\Users\Admin\AppData\Local\Temp\52134e3e35b9282f2eed10036d4ce956.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 764
    3⤵
    - Program crash
    PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1952 -ip 1952
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-12-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1952-45-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3796-56-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-57-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-11-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-7-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-14-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3796-51-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-52-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-54-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-53-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-58-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-13-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-55-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3796-59-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-60-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-61-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-62-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-63-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-64-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-65-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-66-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/3796-67-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads