961bf55f25103eeb23ae7f6d25ea26f57eb23ebd521ef5c7397f50aeac37ac8d

Analysis

max time kernel
136s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPImages/PazeraToolbar.exe
Size

2.8MB
MD5

f3f43974f4be7f4fa263d67510f32330
SHA1

603477844f23b2895cbc40fcc6abd3502d7d4b4b
SHA256

ef385c5290616a9e68ea873d049841cf0a74a65bfc265c1f1b103430bdc41aca
SHA512

1e99ed023da4038e884badc06ee95cdd6a46df8ad8a634f59f9243dba4c6f9d531ae95940a487f8b22efcaade1e925674eb1c8ce265b4d8c20c18e8e6b16afe2
SSDEEP

49152:DKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEb:+mUoU+LSGtYJVqraOb5yds0tf0EOevXN

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2540	PazeraToolbar.exe
2540	PazeraToolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	PazeraToolbar.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Internet Explorer\Main	PazeraToolbar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nss34AD.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss34AD.tmp\UserInfo.dll

Filesize
4KB

MD5
eaf5036ef8e7fbdfa76d42c18233764f

SHA1
acd9f46c0500b00648933c4a172ef258ec64a1f3

SHA256
74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d

SHA512
93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss34AD.tmp\ioSpecial.ini

Filesize
696B

MD5
300fa3569d94204febccb7ff459a4d97

SHA1
4ee18d112f741cfeb5f2c6305b04eaf111b761c2

SHA256
5a69b7386c9f7a8b0c243738172a51b285dc81eb9a4264efbcd360248e6f9d3f

SHA512
4cad7eb6767752e48df9dd85df315619d50fe253ec99b152988b6a92315f410c9053c7355aba637c202c64474453d47d4db197b20f175f7a75cfed74a9f1f169

Download Submit