177da7fd9ca1cd14410bad2c87ae228ce5f234e9c0cbc375c399a929eab49f52

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2025 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Toolbar-SetDefaultSearch.exe
Size

187KB
MD5

59fab1b92573118a4f24bd097863e338
SHA1

60634ff68a50d4935da2a869a5a85fa060aa6c94
SHA256

f46ffe8b4fc2d5f4a79c7d19d9cf95c1e58beedcc4f73ceb286ab7603172e267
SHA512

7497972d7e964345e08906754fec4d094e150236195533587c3cb9197323b907a1ff3ef92bcfb70770dfb675f9d64cf5a820b639797fe4d4025b63fae49fe653
SSDEEP

3072:wY0AZ2H8mOeA21dN5ANbm4Nz9LrXRPJ4V72ejNi5OIqLb+LzW8d8mo:wY9Q82P1ANbmIZLNPywepCqLezWpm

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toolbar-SetDefaultSearch.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}\DisplayName = "Yahoo! Search"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}\OSDFileURL = "file:///C:/Users/Admin/AppData/Local/Temp/yahoo_ie.xml"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{7BB39544-E853-4C7C-873C-7AACE3F74DE2}.ico"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}\FaviconURL = "http://www.yahoo.com/favicon.ico"	Toolbar-SetDefaultSearch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7BB39544-E853-4C7C-873C-7AACE3F74DE2}\URL = "https://search.yahoo.com/search?ei=utf-8&ilc=12&p={searchTerms}"	Toolbar-SetDefaultSearch.exe

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Toolbar-SetDefaultSearch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{7BB39544-E853-4C7C-873C-7AACE3F74DE2}.ico

Filesize
2KB

MD5
3a07174943f82046370997254100d870

SHA1
ecb1e2e89af0ec6f45f875c22df0fbd45821ba80

SHA256
c6f7ee2cadae2e121342a8c4245141175bfe887776206deb17149d46cf3aa827

SHA512
0a589e20251f62f02c4b96b916fbd9359677a26379d46eeef4e455464643de0c9aeef921ad563d970e7436805dd18ae974de6942dfdf0c65089512d8a3b2fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\yahoo_ie.xml

Filesize
429B

MD5
0941e1ea3a374c96bc4f3537399d2b05

SHA1
632df909172522c52f67b71373615fbb934d8241

SHA256
c28cc9c6b141be5c98fc6a074eedd2808db1a0f39e3067810f4930c07d908564

SHA512
a6f736b85d44fe37600f066e8de7cc2a4d68bd729e6e826ea2f2f8b3d541d126ec1e1674813abf12a1e1ac2598377a1bff31676f6bba49b1f3619a88c2148e84

Download Submit