Analysis

  • max time kernel
    139s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 08:25

General

  • Target

    $TEMP/Toolbar_Toggle.exe

  • Size

    818KB

  • MD5

    bd234ce960895e7df492ceefeb67863a

  • SHA1

    3f20dc68a6aac23c4702d16c8a5388dcfe591aea

  • SHA256

    ee814d798c6071977a9e51568fb83c0232d44106a96c5b85492e339b0ba50f18

  • SHA512

    ba3de1bbea6c7eac232f0991ca6e238f62544fb2c52b2e5b591f98ba17cff75fff2df5f7a56f3363dd0e3e1fa1d4a653e4ca095f6a36752f6d7111de3f75ff2a

  • SSDEEP

    24576:cCF80piqnZp9Qu1Y0nmen61qLL0pbacdj4knmE2:cCFpp/nd1YGmennLL6OcdjHx2

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar_Toggle.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar_Toggle.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\Setup.exe" /s Files\Common Files
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\Babylon.dat

    Filesize

    10KB

    MD5

    0ea4b325aeded4466c4cf6f8dae88ecf

    SHA1

    b3778ea32251e0f6dd4b94ed493244563f73c8db

    SHA256

    813f2727907a5aa4fe0b04de140184226b87bdf9fc1a6a86e1c9932ac85097d1

    SHA512

    f786ab86a5cf8bc9f49de0bf00cdff8da16ec53f5dc888bb68ca3d5250590349f4f426ccb3ac3ca1d74324df30fa4c1fa4af80416975e269546b67b4cc440746

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\common.js

    Filesize

    3KB

    MD5

    61326fe65b7ab277221d5fd3c3d8154f

    SHA1

    292d39c304209e0c87cbab00f8c5c37fcd0b1887

    SHA256

    055cc4086e5c6f5991aab46999cb147c155a1b4bd4675b1fe673ccc8527dbd07

    SHA512

    1f77de3af5266342429baf3e26ac71b5d476026213cb2a06f74b37251e4ba442f468b49c5691c4a0563373dfe4274bd606cf8bbb5033bacc2cd665a31022b93c

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\eula.html

    Filesize

    62KB

    MD5

    43f3c7282a5cf225a4c8ab580309f27d

    SHA1

    7b2f6df42893c42b404cdf2bf0b020e83ac58075

    SHA256

    1750ba16aea8d20b9449a696b0fb20f6c9c5403daed15a6c118ffdcc71b77b47

    SHA512

    7c24fb911d56bf6a2481a2d1800bb0e3c7445178eb39cec15181a325f07b462b8b936495f989918adc52d6e550665afdacf69ae2b2e3711a9b1abadc0ae34d10

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\pBar.gif

    Filesize

    3KB

    MD5

    26621cb27bbc94f6bab3561791ac013b

    SHA1

    4010a489350cf59fd8f36f8e59b53e724c49cc5b

    SHA256

    e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3

    SHA512

    9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\page2.css

    Filesize

    2KB

    MD5

    613f21fd9be71493f7f0f7f289faba46

    SHA1

    3085884627bb5cbe1af9c29e9acaf353299b192f

    SHA256

    dc7e17ccfdf805ea69c553abdea2b6a86fd27ec68d58f759b9a85e5a4be98e17

    SHA512

    3be478d24f712d2b4ca3d9142fc446986426290678ddc89518155e7c46a6bae5659b9a748b30eb26ba20323c9d9a2c67e7dfe770d0689ab1548a9a48568df8ab

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\page2.html

    Filesize

    3KB

    MD5

    652dc84986ad79e823d07a0503f39fa2

    SHA1

    bb209be48b2bc746ee0f600fb18027fc9dd96b57

    SHA256

    18e1f4d19a0caed84851fbc3d7b1ad84da141b0b9553cfb7ab43671ad5bbba75

    SHA512

    abb9768bbbfbb88be990b7875c1bf93552567a736857cd97382a9c9c5837dad532acb9376071348b6f7a4021519d0a2b612c5120fb20efb257cf382d15226353

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\page2.js

    Filesize

    3KB

    MD5

    574d29f591a6c8e41526740aef35aef5

    SHA1

    16fd09104a40386b55d7a241c34841e1f881b346

    SHA256

    b1a88b9f78cb51b78b0abc00706269540cbddd4d22d06ef597c30aeda3f1806b

    SHA512

    86a1907fe6f9729eb6fc8b91a9581f071a608e2b808a49419efcd5930ea9408f45af2faeba92aa174c7fa680d014eebac001637622e0157065d4b898670c82fb

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\page2Lrg.css

    Filesize

    1KB

    MD5

    3acbc4a0b720fd5daff11530ae9e0295

    SHA1

    23031d0a31bc05de190843a9b0d8b3745c796385

    SHA256

    59b5de1efe45a796fab6130ee94db0dc13be896ab798e126cb2c5889aead32b7

    SHA512

    abc4815f7df7f65c57c61facd568616c9b844cdfea8d12ae819987dcec256d82c7ef040c1df24be2ddef0b42601f1a8e22755b7320d1fcbcee0dd94055092b62

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\page9.html

    Filesize

    668B

    MD5

    69d63df890d8445501ac73835d7966d3

    SHA1

    f385c25afc2b5180e7f0c34b2de8089c68f654f7

    SHA256

    041569cede5fc91021a788647e4dc1b4a1c3f925f2bbb8857dce0930bd3838ef

    SHA512

    879735c74bc6b2467ce2f5c88ff755191d781207fbdda9f65f4b0f032ca638c96413f049607bbe65672d51254456f159bc9f95a3fe9d67234087c046fd9de128

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\title2.png

    Filesize

    44KB

    MD5

    a9e1f1f2b2628c6ee61c1e11c7288baf

    SHA1

    48b2f87ad6bc5d7cdc22500df46a967acb077cfa

    SHA256

    c336644e20a898fc28b216d91908c9ed4b716f572c0b06d5b3a5a68e43c6aeb9

    SHA512

    3027aead5dc0a2de2dfe7bbdaefeac1dfc1829db1edcd60493f51bbe3d3f75363b938f60a2cc6c46dd9992d9c33df5f8ab7a62e4235ca0858358cb73ad2dc514

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\HtmlScreens\toolBar.jpg

    Filesize

    19KB

    MD5

    56dc3cb42b46309e642c15167003685d

    SHA1

    045749de2c1492e5dfc4c44f9eb6c0feefe06b3d

    SHA256

    bc488502223b3369dd657e8bac70abc42ffde2223a0661fb507c8ec87778bca1

    SHA512

    5f3dc868d6e128407e071d6d7d7b9d0bbe7e45a32ff76985dfa53fe9dad0f5fb372ce64d35170c3719a06dd6762e4bb33089bfaedf93e6064c06c74a21b65a60

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\Setup.exe

    Filesize

    1.7MB

    MD5

    2cea6f4da60058bad2924385202c25cf

    SHA1

    5f437ecc88a691b6161b1d168b3f4a93624f5832

    SHA256

    a1a97e5c13a8e39ec8b5a9ffd7c5cff11749b1b203ce6f7095fec28d01b4798e

    SHA512

    07485068c9862ab09144312cb652fdc97fde34bd7de573d587ad25454aa8f611fcc5853ab2f1261d8e50cf39772e14fa6d518580d6ce5386a01dafd0ba3f59a5

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\SetupStrings.dat

    Filesize

    57KB

    MD5

    19f47f9cab41a5e07d49a4171748b598

    SHA1

    d30b022c9d85be7384f26f335e01e56d2ef1a9e6

    SHA256

    07638d54048adfb3229fbc6a56a8b7ff6f3a8370bf942306ecb5352de64c3e86

    SHA512

    b83181ffa46ac732e6c4aabcc26b77ee594c1381311ddde3151b7e740e80c07ef84c5910e535696b4ccf8ddb11b1c5b8b3d387ba08ec346bc375c0d2f490dfb0

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\Welcome.html

    Filesize

    181B

    MD5

    aa3fbe8f44d9b3490305ab75f11c021c

    SHA1

    8a2058f86b8fab61a29ea605116d2f2ae9188f74

    SHA256

    3947e4a58dfd3235c3344d6d8f5f186358f31cd8a373a183bbe9a3aa862a52a5

    SHA512

    62e4a32cf15f0e6812b421813ba76778ffc487ce24c4d675a9c1d3efa1e471c4ce29bbc8724059ca27dfd61244372eb16e4e9716744bff6d9e86edf439ced992

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\bab033.tbinst.dat

    Filesize

    236B

    MD5

    1ee8c638e49ee7137607722768afc5a2

    SHA1

    8719d7a498a49b042cd6fc411cac6c44f3c0f43a

    SHA256

    1368324e8df1654fb9c3bcae320e982ff9f40e76e0cc118d5f507649e1ec2f2e

    SHA512

    2acb5547bb9b62505a5332e3b2752c5004fee9579bc45c46271e53d42fff5f412f3a18863ed382052d961d33d0e0449d9c111950060663660d7dbb21e9bff575

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\bab091.norecovericon.dat

    Filesize

    174B

    MD5

    4f6e1fdbef102cdbd379fdac550b9f48

    SHA1

    5da6ee5b88a4040c80e5269e0cd2b0880b20659c

    SHA256

    e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c

    SHA512

    54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe

  • C:\Users\Admin\AppData\Local\Temp\C60E3D18-BAB0-7891-93BB-B8394A7857BF\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • memory/2776-66-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2776-75-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB