961bf55f25103eeb23ae7f6d25ea26f57eb23ebd521ef5c7397f50aeac37ac8d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPImages/PazeraToolbar.exe
Size

2.8MB
MD5

f3f43974f4be7f4fa263d67510f32330
SHA1

603477844f23b2895cbc40fcc6abd3502d7d4b4b
SHA256

ef385c5290616a9e68ea873d049841cf0a74a65bfc265c1f1b103430bdc41aca
SHA512

1e99ed023da4038e884badc06ee95cdd6a46df8ad8a634f59f9243dba4c6f9d531ae95940a487f8b22efcaade1e925674eb1c8ce265b4d8c20c18e8e6b16afe2
SSDEEP

49152:DKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEb:+mUoU+LSGtYJVqraOb5yds0tf0EOevXN

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2752	PazeraToolbar.exe
2752	PazeraToolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	PazeraToolbar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	PazeraToolbar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	PazeraToolbar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy254D.tmp\ioSpecial.ini

Filesize
696B

MD5
11ed7a8f9b6dda1170103285caba33e0

SHA1
dfcade692aeacc1fe7bede69c4c15170991a1fa6

SHA256
67495422af184c40cfa26673ebf9d1b5c9ece0326fbbdec12182b73febc1caa6

SHA512
4ad5798d99d90decc5c58a99f805c5a7422835568b1e95acf63d3c5133afc4934bdf4a3c1e73f0345f59e6a2fac79999b3efb4fcbc8ee0bb38160ea68feec4ee

Download Submit
\Users\Admin\AppData\Local\Temp\nsy254D.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy254D.tmp\UserInfo.dll

Filesize
4KB

MD5
eaf5036ef8e7fbdfa76d42c18233764f

SHA1
acd9f46c0500b00648933c4a172ef258ec64a1f3

SHA256
74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d

SHA512
93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef

Download Submit