Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    12/09/2024, 10:14

General

  • Target

    $PLUGINSDIR/g/PRFA-IEToolbar.exe

  • Size

    218KB

  • MD5

    ba294f93108cf238ecb91c394049f8b7

  • SHA1

    486d16aeddf402e1f3be54cb6590ee1005fd92db

  • SHA256

    1dd6831dbbacc4aa90af67637132e49948e810d0f0d7e2c108061474ef346cb2

  • SHA512

    79707ce0aa72c9e6a0774dd10129942336cd420c3cfd0b6299b56b5fdc8b1c4594acb55c2d9106780826c18edce4aff31a2f3028c2f490001eac6401599b8e61

  • SSDEEP

    6144:se34BlrCbgd//kfNahpVCbEh1RdP/ScsHy:glWslsizCAFbqy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PRFA-IEToolbar.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PRFA-IEToolbar.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\googletoolbarinstaller_stub_signed.exe
      googletoolbarinstaller_stub_signed.exe /o:0 /r:PRFA /e:asknot /d:set /h:asknot /q
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:2544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabD108.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Google Toolbar\gtmC477.tmp

    Filesize

    19KB

    MD5

    79942dac42e18c0003f796f017f5ed3b

    SHA1

    9240975094213e86feb006b518d666648eeaac59

    SHA256

    b01ad14194f6dca0fb204b68a1e8123584d8c1722cde390803e97cf5b11094e5

    SHA512

    fa96d06dbb5cf55a8e527df03ec7cd59417f4de8e64f4ea6ec762bbce1d94d54b9c4729a0b32ae057385613dcf9af301b8a93009e76a3245a60799ebe40b9cee

  • C:\Users\Admin\AppData\Local\Temp\TarD149.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\googletoolbarinstaller_stub_signed.exe

    Filesize

    196KB

    MD5

    bc67002cc524050eafdf18204c22c538

    SHA1

    9fdddaa5fbe1eeaec2b34938f0aff33766224453

    SHA256

    b31b4fffddc25735f8429a56d166c15187682a6010797e9a707534d09e4fc8fc

    SHA512

    c6d5fd4cc0d8ccff2288c721dfbc0ef35d946fa2790306fb189d0a40da0b38bda095e105c6ad95a7040780c367f300b0571a7e8072b9d83617416125f5ec8b27

  • memory/2500-4-0x00000000027C0000-0x0000000002840000-memory.dmp

    Filesize

    512KB

  • memory/2544-11-0x00000000000F0000-0x00000000000F2000-memory.dmp

    Filesize

    8KB

  • memory/2544-10-0x0000000000390000-0x0000000000410000-memory.dmp

    Filesize

    512KB

  • memory/2544-9-0x0000000000310000-0x0000000000390000-memory.dmp

    Filesize

    512KB

  • memory/2544-65-0x0000000000310000-0x0000000000390000-memory.dmp

    Filesize

    512KB