Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 20:04

General

  • Target

    $TEMPImages/PazeraToolbar.exe

  • Size

    2.8MB

  • MD5

    f3f43974f4be7f4fa263d67510f32330

  • SHA1

    603477844f23b2895cbc40fcc6abd3502d7d4b4b

  • SHA256

    ef385c5290616a9e68ea873d049841cf0a74a65bfc265c1f1b103430bdc41aca

  • SHA512

    1e99ed023da4038e884badc06ee95cdd6a46df8ad8a634f59f9243dba4c6f9d531ae95940a487f8b22efcaade1e925674eb1c8ce265b4d8c20c18e8e6b16afe2

  • SSDEEP

    49152:DKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEb:+mUoU+LSGtYJVqraOb5yds0tf0EOevXN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMPImages\PazeraToolbar.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy254D.tmp\ioSpecial.ini

    Filesize

    696B

    MD5

    11ed7a8f9b6dda1170103285caba33e0

    SHA1

    dfcade692aeacc1fe7bede69c4c15170991a1fa6

    SHA256

    67495422af184c40cfa26673ebf9d1b5c9ece0326fbbdec12182b73febc1caa6

    SHA512

    4ad5798d99d90decc5c58a99f805c5a7422835568b1e95acf63d3c5133afc4934bdf4a3c1e73f0345f59e6a2fac79999b3efb4fcbc8ee0bb38160ea68feec4ee

  • \Users\Admin\AppData\Local\Temp\nsy254D.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    1d5c649dde35003a618b9679d5d71b92

    SHA1

    0409bbab3ab34f8c01289cdd847b4d1a32d05b18

    SHA256

    0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

    SHA512

    b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

  • \Users\Admin\AppData\Local\Temp\nsy254D.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    eaf5036ef8e7fbdfa76d42c18233764f

    SHA1

    acd9f46c0500b00648933c4a172ef258ec64a1f3

    SHA256

    74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d

    SHA512

    93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef