Analysis
-
max time kernel
282s -
max time network
279s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
29/05/2023, 18:45
General
-
Target
google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.exe
-
Size
1.7MB
-
MD5
b01445231a203d761f6806350c6b4da7
-
SHA1
590d3af0e35d10659473c878e80894330ed23c45
-
SHA256
10f81c435c9a627bd1d8bc04fded50a723cd3afb59ddfd1441288c637fb0e7cc
-
SHA512
208c70364fbb5b958396149629f5d85bb02cf1bb47d5c047afb9569eac2bf3cac75e8a50b01636a069a213dde5b1843e6b8b846a73e4a9432a17c4fa35fd1779
-
SSDEEP
24576:A7FUDowAyrTVE3U5FmEj6CIFeuTxV/A/Tcr/OzuwibgRb+V8Wb:ABuZrEUR6C6euTxV/ALcr0uxzS
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.exe"C:\Users\Admin\AppData\Local\Temp\google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JBUJR.tmp\google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.tmp"C:\Users\Admin\AppData\Local\Temp\is-JBUJR.tmp\google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.tmp" /SL5="$D0028,879088,832512,C:\Users\Admin\AppData\Local\Temp\google_toolbar_ie-7.5.8321.2252-installer_Yt-i8k1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\google_toolbar_ie-7.5.8321.2252-installer.exe"C:\Users\Admin\Downloads\google_toolbar_ie-7.5.8321.2252-installer.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GUM15F9.tmp\GoogleUpdate.exe"C:\Program Files (x86)\GUM15F9.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&iid={11112222-3333-4444-5555-666677778888}&lang=int&browser=2&usagestats=0&appname=Google%20Toolbar&needsadmin=true&installdataindex=home_asknot_search_asknot&appguid={2CCBABCB-6427-4A55-B091-49864623C43F}&appname=Google%20Toolbar&needsadmin=true&installdataindex=home_asknot_search_asknot"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe" -Embedding1⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\eb27003445264cacb316425465050575 /t 4108 /p 48281⤵
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe" -Embedding1⤵
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe" -Embedding1⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\9925eb44ea034e6e9fe58581b8b82c2c /t 4108 /p 48281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5506708142bc63daba64f2d3ad1dcd5bf
SHA1d30e8c7543adbc801d675068530b57d75cabb13f
SHA2569c36a08d9e7932ff4da7b5f24e6b42c92f28685b8abe964c870e8d7670fd531a
SHA512a6e16f0de64b1500fbb2c7974a5efd40e8768b6c133f8ef367725a5c82b3b38c300dd65fa159b4a5f15413b0843a1e37416550ec89749ec1cf5cfae73dcc01ab
-
Filesize
113KB
MD5506708142bc63daba64f2d3ad1dcd5bf
SHA1d30e8c7543adbc801d675068530b57d75cabb13f
SHA2569c36a08d9e7932ff4da7b5f24e6b42c92f28685b8abe964c870e8d7670fd531a
SHA512a6e16f0de64b1500fbb2c7974a5efd40e8768b6c133f8ef367725a5c82b3b38c300dd65fa159b4a5f15413b0843a1e37416550ec89749ec1cf5cfae73dcc01ab
-
Filesize
848KB
MD56d6b5d52bb81f82f5d0103e6175d1f4f
SHA11d9c498dc15a8133fb92fba177d34d2c99e0c86a
SHA25614de1e4c28fc5f8cffa7d925561dc1f237d55dd663836e20aa4d7485b01c261d
SHA512e96dd2fc027803d05f317f4633da248bb0f1aecf88eefff302966a0507c9edceded393c4e9248f065b04abd89d307c7ca7c00618b7b093610e3378c361707f7a
-
Filesize
848KB
MD56d6b5d52bb81f82f5d0103e6175d1f4f
SHA11d9c498dc15a8133fb92fba177d34d2c99e0c86a
SHA25614de1e4c28fc5f8cffa7d925561dc1f237d55dd663836e20aa4d7485b01c261d
SHA512e96dd2fc027803d05f317f4633da248bb0f1aecf88eefff302966a0507c9edceded393c4e9248f065b04abd89d307c7ca7c00618b7b093610e3378c361707f7a
-
Filesize
840KB
MD52fee18a796a25970bc339b7e5aa9c683
SHA16fd804cd3249e437933cc3206c76495acf3b97cd
SHA256106c6f57b08d411bf58b1494fae3d811c68d646f34ca30e2077ad8097710a159
SHA51283a97eb1d8a045a08dfc101fa3f8529636f95449a15f6c261f09fcb82615f09eda9b02dae9dd9ce7bab30ec30b8df5708615e03c18a88324478211dbea015c18
-
Filesize
3.1MB
MD5c4630882db671a55924f100c5c1f0056
SHA124c08e7061301d9a3ef6b2fbbbbad484e5f4bc37
SHA25649cbceb57abe33bad7c5f8c56a8bc5ddd06507d185859554f1de31f3761741e3
SHA5126d044efc68d07317b298fa10ed6d68a6b36df6a31c57f32fc0e358ad2c039307dcec9a1755e3b2dac48efa6a9f31845aa0ae52d2b67e7daeb6ea503ec45257d6
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
1KB
MD5396e1bebc6012f5d8b919b772bdc8674
SHA1ff5219c25bc6118791d1c5ddaf3fb1942150875b
SHA256206d0b3e3f1a664f5ff7f179fafa20479049e259df03e3c8b4e780a0519ad272
SHA512cd2bc711c21a65ff78b735734e0bdf286167b34c80fcc92d10600f0c3474a9e4adcd37e78113363f91e942c0781bbb0db7a48ac393c06af5562b28427c01815c
-
Filesize
1KB
MD5a0f78df30ebc15bda8858e4c490a5eb1
SHA107140fdad7c7415fbb23461e243d7b576eb08749
SHA2560c679e463254ec4652917110ca1387fb3663d464e4bd792d97c2d853e156d900
SHA512f5539152f7faf5fa3505a2ebd1ccbe3145ee46564b814549a96b63f385a73b7e69176ca853d07adef386ea0cc7c0cea4989c74bd4334997b389d85a2f8db1508
-
Filesize
800KB
MD578dc25e90540703e0bbc56656c95a6bf
SHA1cb3ea8827d47b5040b42409aab24d90403e4cc63
SHA2564976622d8aaefc6673215f5bf64812dd792755eba7cefc301c53bafc401aa081
SHA51243d40fa53f6e38bd85589fbb5bc3214b8d5bef5aa1d174feb42c8cde74916084c2aee3def75b386f2bf9e9375cd8d0976038f2170501c1d085ae3db4783c231b
-
Filesize
800KB
MD578dc25e90540703e0bbc56656c95a6bf
SHA1cb3ea8827d47b5040b42409aab24d90403e4cc63
SHA2564976622d8aaefc6673215f5bf64812dd792755eba7cefc301c53bafc401aa081
SHA51243d40fa53f6e38bd85589fbb5bc3214b8d5bef5aa1d174feb42c8cde74916084c2aee3def75b386f2bf9e9375cd8d0976038f2170501c1d085ae3db4783c231b
-
Filesize
800KB
MD578dc25e90540703e0bbc56656c95a6bf
SHA1cb3ea8827d47b5040b42409aab24d90403e4cc63
SHA2564976622d8aaefc6673215f5bf64812dd792755eba7cefc301c53bafc401aa081
SHA51243d40fa53f6e38bd85589fbb5bc3214b8d5bef5aa1d174feb42c8cde74916084c2aee3def75b386f2bf9e9375cd8d0976038f2170501c1d085ae3db4783c231b
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
4KB
