0b6db0cbd5af09eba2eea7a3145f468ca190a1db48905df96a28acddb96efb67

Analysis

max time kernel
144s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMPImg/PazeraToolbar.exe
Size 2.8MB
Sample250121-tsrf3asphj
SHA256 db3119182761d71fe962e662aaff8aba64121130f3f1d39ac548020f26deec77
MD5 4d14c69f86a74fc25ad116c38f8f05f9
SHA1 bf8399d5f22aec7e4db7b4c385591ed5d42e71d0
SHA512 2f4acf84eb9e588ebe7a1c4731a472c0664f280982f90ec104c04021fbf6e9fc1c4708ce639fb1433ea014954ed24cd79fa94a5d3617e13b8b2e2058cac7a4dc
SSDEEP 49152:qKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEd:JmUoU+LSGtYJVqraOb5yds0tf0EOevXT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2120	PazeraToolbar.exe
2120	PazeraToolbar.exe
2120	PazeraToolbar.exe
2120	PazeraToolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PazeraToolbar.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	PazeraToolbar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	PazeraToolbar.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	PazeraToolbar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyC717.tmp\ioSpecial.ini
Size 696B
SHA256 43ad8cd4eb66b19dfa1b90ee1c70c9bb4fcc2b9dff09e18902040edf130453b4
MD5 cb8c3f0475c7d9dde49952c9aa4b35a5
SHA1 b8d67841b3da5efabf2a88de6dbd801000aea437
SHA512 5cd9ff2103eea9478d11f0be1dfb15ce163776bd35350f941fb0818f10ea608f2089aa63d678525c8a77b64c2e4674eb4be8e8914011e5144df7de52d8aa757f
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyC717.tmp\ioSpecial.ini
Size 735B
SHA256 6bd1cf5e1c70955fc0fcb91ccd2ab3db1e76fcdc0333d2d45628e1a5ced9c523
MD5 f0f93e2796d496a199114adda6ee27f8
SHA1 f8b2d59dd717fa0f1c999f9045c51102faa8cbfe
SHA512 515b603fd51f26165396c97109fdd21786761cf1ba6b26d77f9f2cb47ede52d48d148e38d3c4f9fbba58c78940987baabd57b23ced568f8eb89275157add87c1
MD5 SHA1 SHA512

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyC717.tmp\options.ini
Size 1KB
SHA256 8b64fdd0bb991cd9c0c3977097d370af18cfd1b155fdbca10cb6f0a2bdb8467d
MD5 fd6c4fd5e823d52f7c92705186735ab4
SHA1 256688162a5aa1696a8f2c38863c07907cf564e3
SHA512 01f5bfcaf7448b41c228097a1d273da02f30b3dcd515ff53bca1293e4c77217571ae5012a5856cecdd69bad8db8ec0902a0fbeccb01a77a6a038271977cff2a5
MD5 SHA1 SHA512

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsyC717.tmp\options.ini
Size 1KB
SHA256 dc32acd706e63a56a52a81c91ad4401fc198decc5b718c4d976a903199354b64
MD5 74c5c318c3a4a0e258d6ee918bfb60cf
SHA1 fbe312bc328d8704c163d763a2a74802fb643374
SHA512 c73d8b67aa9a705d24c3089d0cc34c99dd26a49f4f25b8a654acfcf04455bc72c459a321f93b4657a3c1bd17e9d26f8d5a0d6498ba884fd1a83f39a84282ebfb
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path \Users\Admin\AppData\Local\Temp\nsyC717.tmp\InstallOptions.dll
Size 12KB
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScrollLicense.dll

Path \Users\Admin\AppData\Local\Temp\nsyC717.tmp\ScrollLicense.dll
Size 58KB
SHA256 d81d764e13b8e7a7ede9964f118d2de44b13c39c442527c0ffa11ed25cac5014
MD5 9de28704babdcf38f423c36eae737e17
SHA1 dd7f7b03430bbc9d568c6ea31de88fc281c3eec3
SHA512 74e0b8b2cbf2de7ffde19e31567976e4c59fc68df351621acee5b0f00734fe7cb95f29fc822313f58ab9cf5f2822763d6021643e088fa6a37bf6d4672f6cbeea
SSDEEP 1536:IU49ZxlN9m68X7Yo7n8roGNHyJelIXkzqGvl/H3C:OZxz9QA1SkHzvl/XC
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path \Users\Admin\AppData\Local\Temp\nsyC717.tmp\UserInfo.dll
Size 4KB
SHA256 74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d
MD5 eaf5036ef8e7fbdfa76d42c18233764f
SHA1 acd9f46c0500b00648933c4a172ef258ec64a1f3
SHA512 93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads