9f78fec897a3efa48c3f08a346ce241dbb29d40ddcb1926a401ea89bb9908132

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Toolbar-SetDefaultSearch.exe
Size

187KB
MD5

59fab1b92573118a4f24bd097863e338
SHA1

60634ff68a50d4935da2a869a5a85fa060aa6c94
SHA256

f46ffe8b4fc2d5f4a79c7d19d9cf95c1e58beedcc4f73ceb286ab7603172e267
SHA512

7497972d7e964345e08906754fec4d094e150236195533587c3cb9197323b907a1ff3ef92bcfb70770dfb675f9d64cf5a820b639797fe4d4025b63fae49fe653
SSDEEP

3072:wY0AZ2H8mOeA21dN5ANbm4Nz9LrXRPJ4V72ejNi5OIqLb+LzW8d8mo:wY9Q82P1ANbmIZLNPywepCqLezWpm

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toolbar-SetDefaultSearch.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}\DisplayName = "Yahoo! Search"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}\OSDFileURL = "file:///C:/Users/Admin/AppData/Local/Temp/yahoo_ie.xml"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}.ico"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}\FaviconURL = "http://www.yahoo.com/favicon.ico"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}\URL = "https://search.yahoo.com/search?ei=utf-8&fr=chr-greentree_ie&ilc=12&us_privacy=1---&p={searchTerms}"	Toolbar-SetDefaultSearch.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}	Toolbar-SetDefaultSearch.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{EE45F194-EA04-4FCC-94A8-DBAFC9BB0FD3}.ico

Filesize
2KB

MD5
3a07174943f82046370997254100d870

SHA1
ecb1e2e89af0ec6f45f875c22df0fbd45821ba80

SHA256
c6f7ee2cadae2e121342a8c4245141175bfe887776206deb17149d46cf3aa827

SHA512
0a589e20251f62f02c4b96b916fbd9359677a26379d46eeef4e455464643de0c9aeef921ad563d970e7436805dd18ae974de6942dfdf0c65089512d8a3b2fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\yahoo_ie.xml

Filesize
473B

MD5
278ef9a393cb6a4d8b2489bfa8ce377d

SHA1
2f68128ad1996370f172c1922810a809b2ded98c

SHA256
456cadb82b438007ca000e292ebd31b3e8b71a88866404296fff3ef4a567f35f

SHA512
6fbeb909c355935f216d6b959d1b0e5faea2364883e1720da3d45055637d08267aae6d9fea61757b85c6e59a09c5319dda337c50fb04ffb46aa2fce7bc0d3c55

Download Submit