e791985263b2df4b00652a69f4d6ac925dd2e7a069b9cc30ccb6fc5c813ec44b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/ALOT_Toolbar_joydesk_partner_Installer.exe
Size

680KB
MD5

b16f8f34c0f96f8bd50a6317b8002810
SHA1

f52165e204101e9e873acd1bbf4aa81059cebf27
SHA256

664214bdd40b52d7a63f91bd94801ad7b38fca85d0c216b0e00b405b921faff6
SHA512

be326b87df5e0c040cc988b4529aee4f6cf98cf33ee4f449b5a90ce551f5ca9a258778ed8e0e1134b2eb8f043d3e157c810f6e483184ad943d355cf26e3ebd65
SSDEEP

12288:pmJuhrTwiB0p+CUAVMOGDGfvsBCD3vKFaoP969p/idCIBCMjTgRShmZLzedxGN1O:pmJ8w0ZSMOGDG3sQLyFJPMtiMlMeduc2

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2860	ALOT_Toolbar_joydesk_partner_Installer.exe
2860	ALOT_Toolbar_joydesk_partner_Installer.exe
2860	ALOT_Toolbar_joydesk_partner_Installer.exe
2860	ALOT_Toolbar_joydesk_partner_Installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	ALOT_Toolbar_joydesk_partner_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ALOT_Toolbar_joydesk_partner_Installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ALOT_Toolbar_joydesk_partner_Installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	ALOT_Toolbar_joydesk_partner_Installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	ALOT_Toolbar_joydesk_partner_Installer.exe
2860	ALOT_Toolbar_joydesk_partner_Installer.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ALOT_Toolbar_joydesk_partner_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ALOT_Toolbar_joydesk_partner_Installer.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso14EA.tmp\eula.ini

Filesize
2KB

MD5
dd0fc86762bab66c4b4e723226d45da4

SHA1
24b56153ce3aaafe6afc6055e754e5009d5b86bf

SHA256
166e1013e67d4d7c140dea0192dcf1a83d391c5ebef1c9fc73a91ed687f527ce

SHA512
b431e1fd33bae3860cef9fba995075d5f205f6ced75be329a739180d47dc8dce33746a64826ef48b2e2c20faf1b87fb4c2c436e55c903d6f1ea8c1fa07e7cca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso14EA.tmp\eula.ini

Filesize
1KB

MD5
6a82b6a0fe6138096e549bef053ca02b

SHA1
af3bba863d0e78d85a3fc9da7ea3da1f1ff5c2c3

SHA256
974ff69ea21ffc3f5cb32db5536eed7d685120726eb6413c2040116a5016b26c

SHA512
c425cf0a340b44819ffe65a3da58f790223956d0da13a1176e6fa9f3a4a61da057b1cf2515b3cf7be8105c4f9279bec81d7589ee41373dc2d3d142289397294f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso14EA.tmp\eula_en.html

Filesize
11KB

MD5
f8aee788c2a09699cd4d607e1db670c8

SHA1
6457b766f043d901a6dd204d00626c4bea02d503

SHA256
503477569d8a48c47c4febbfd4ae6d3cb036856432c8212dcb0226580e7034c9

SHA512
424ef5a4f2653b27b3ca921c35e5e36f28c41ddfe9bcd6b5aba7968d87129826770777fbbfcdc78fce8512c1dce819be0e355282d4a729580591ff296a751162

Download Submit
\Users\Admin\AppData\Local\Temp\nso14EA.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
\Users\Admin\AppData\Local\Temp\nso14EA.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
\Users\Admin\AppData\Local\Temp\nso14EA.tmp\installhelper.dll

Filesize
127KB

MD5
91b0372096274dbd47395aa8b28ffedb

SHA1
05d79ba090439c2898d8ad480355c08091acee55

SHA256
0411ab18ecb0d3d6292eabb89b4c8e41112b3e0be272b087555c2cb8cb0bfc28

SHA512
c40b9eace25b6c871eee9b4186181268de7463c4fe1c4c19372413989489fa891ebd528175d15df031dc768613a81c619acce0981a4c29d475e795d18b1aff08

Download Submit
memory/2860-15-0x0000000000640000-0x0000000000663000-memory.dmp

Filesize
140KB

Download
memory/2860-158-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2860-186-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download