177da7fd9ca1cd14410bad2c87ae228ce5f234e9c0cbc375c399a929eab49f52

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Toolbar-SetDefaultSearch.exe
Size

187KB
MD5

59fab1b92573118a4f24bd097863e338
SHA1

60634ff68a50d4935da2a869a5a85fa060aa6c94
SHA256

f46ffe8b4fc2d5f4a79c7d19d9cf95c1e58beedcc4f73ceb286ab7603172e267
SHA512

7497972d7e964345e08906754fec4d094e150236195533587c3cb9197323b907a1ff3ef92bcfb70770dfb675f9d64cf5a820b639797fe4d4025b63fae49fe653
SSDEEP

3072:wY0AZ2H8mOeA21dN5ANbm4Nz9LrXRPJ4V72ejNi5OIqLb+LzW8d8mo:wY9Q82P1ANbmIZLNPywepCqLezWpm

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toolbar-SetDefaultSearch.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yahoo_ie.xml

Filesize
429B

MD5
0941e1ea3a374c96bc4f3537399d2b05

SHA1
632df909172522c52f67b71373615fbb934d8241

SHA256
c28cc9c6b141be5c98fc6a074eedd2808db1a0f39e3067810f4930c07d908564

SHA512
a6f736b85d44fe37600f066e8de7cc2a4d68bd729e6e826ea2f2f8b3d541d126ec1e1674813abf12a1e1ac2598377a1bff31676f6bba49b1f3619a88c2148e84

Download Submit