d4dd2ca7e0621b00869cfc5f3d8baafa83a450304133a572b0d531a677adfc31

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPImg/PazeraToolbar.exe
Size

2.8MB
MD5

4d14c69f86a74fc25ad116c38f8f05f9
SHA1

bf8399d5f22aec7e4db7b4c385591ed5d42e71d0
SHA256

db3119182761d71fe962e662aaff8aba64121130f3f1d39ac548020f26deec77
SHA512

2f4acf84eb9e588ebe7a1c4731a472c0664f280982f90ec104c04021fbf6e9fc1c4708ce639fb1433ea014954ed24cd79fa94a5d3617e13b8b2e2058cac7a4dc
SSDEEP

49152:qKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEd:JmUoU+LSGtYJVqraOb5yds0tf0EOevXT

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4784	PazeraToolbar.exe
4784	PazeraToolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PazeraToolbar.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Internet Explorer\Main	PazeraToolbar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	PazeraToolbar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\InstallOptions.dll

Filesize
12KB

MD5
1d5c649dde35003a618b9679d5d71b92

SHA1
0409bbab3ab34f8c01289cdd847b4d1a32d05b18

SHA256
0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f

SHA512
b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\UserInfo.dll

Filesize
4KB

MD5
eaf5036ef8e7fbdfa76d42c18233764f

SHA1
acd9f46c0500b00648933c4a172ef258ec64a1f3

SHA256
74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d

SHA512
93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso8241.tmp\ioSpecial.ini

Filesize
696B

MD5
17b093e3e557c8d2913ebc2337f3a613

SHA1
b8b228b359ca75b27dee5f5ecf41fb8576ec832d

SHA256
3f5724ae722545e7d36805cf31bb576f5b41f44c483f517d229f19540997dff4

SHA512
0da24092f047ffac8c1482332e697dc45b94a038350631b7b2f38059c99435a1f92893a711ee6cdc817b33bbeaf0a9e9077aacd7d3738d32723b77e58f1dc4b7

Download Submit