Analysis

  • max time kernel
    134s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 10:14

General

  • Target

    $PLUGINSDIR/g/PRFA-IEToolbar.exe

  • Size

    218KB

  • MD5

    ba294f93108cf238ecb91c394049f8b7

  • SHA1

    486d16aeddf402e1f3be54cb6590ee1005fd92db

  • SHA256

    1dd6831dbbacc4aa90af67637132e49948e810d0f0d7e2c108061474ef346cb2

  • SHA512

    79707ce0aa72c9e6a0774dd10129942336cd420c3cfd0b6299b56b5fdc8b1c4594acb55c2d9106780826c18edce4aff31a2f3028c2f490001eac6401599b8e61

  • SSDEEP

    6144:se34BlrCbgd//kfNahpVCbEh1RdP/ScsHy:glWslsizCAFbqy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PRFA-IEToolbar.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\g\PRFA-IEToolbar.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\googletoolbarinstaller_stub_signed.exe
      googletoolbarinstaller_stub_signed.exe /o:0 /r:PRFA /e:asknot /d:set /h:asknot /q
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:4548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Google Toolbar\gtmD244.tmp

    Filesize

    19KB

    MD5

    79942dac42e18c0003f796f017f5ed3b

    SHA1

    9240975094213e86feb006b518d666648eeaac59

    SHA256

    b01ad14194f6dca0fb204b68a1e8123584d8c1722cde390803e97cf5b11094e5

    SHA512

    fa96d06dbb5cf55a8e527df03ec7cd59417f4de8e64f4ea6ec762bbce1d94d54b9c4729a0b32ae057385613dcf9af301b8a93009e76a3245a60799ebe40b9cee

  • C:\Users\Admin\AppData\Local\Temp\googletoolbarinstaller_stub_signed.exe

    Filesize

    196KB

    MD5

    bc67002cc524050eafdf18204c22c538

    SHA1

    9fdddaa5fbe1eeaec2b34938f0aff33766224453

    SHA256

    b31b4fffddc25735f8429a56d166c15187682a6010797e9a707534d09e4fc8fc

    SHA512

    c6d5fd4cc0d8ccff2288c721dfbc0ef35d946fa2790306fb189d0a40da0b38bda095e105c6ad95a7040780c367f300b0571a7e8072b9d83617416125f5ec8b27

  • memory/4548-3-0x00000000009C0000-0x0000000000A40000-memory.dmp

    Filesize

    512KB

  • memory/4548-5-0x0000000002F20000-0x0000000002F22000-memory.dmp

    Filesize

    8KB

  • memory/4548-25-0x00000000009C0000-0x0000000000A40000-memory.dmp

    Filesize

    512KB