0b6db0cbd5af09eba2eea7a3145f468ca190a1db48905df96a28acddb96efb67

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2025, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMPImg/PazeraToolbar.exe
Size 2.8MB
Sample250121-tsrf3asphj
SHA256 db3119182761d71fe962e662aaff8aba64121130f3f1d39ac548020f26deec77
MD5 4d14c69f86a74fc25ad116c38f8f05f9
SHA1 bf8399d5f22aec7e4db7b4c385591ed5d42e71d0
SHA512 2f4acf84eb9e588ebe7a1c4731a472c0664f280982f90ec104c04021fbf6e9fc1c4708ce639fb1433ea014954ed24cd79fa94a5d3617e13b8b2e2058cac7a4dc
SSDEEP 49152:qKmU/FmbvQyw+Lx8GtekgJV2cEraOdDJLQDwydRm0qw9d/YDTn3UOesiX9iYvmEd:JmUoU+LSGtYJVqraOb5yds0tf0EOevXT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2932	PazeraToolbar.exe
2932	PazeraToolbar.exe
2932	PazeraToolbar.exe
2932	PazeraToolbar.exe
2932	PazeraToolbar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PazeraToolbar.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Internet Explorer\Main	PazeraToolbar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	PazeraToolbar.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPImg\PazeraToolbar.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\InstallOptions.dll
Size 12KB
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ScrollLicense.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\ScrollLicense.dll
Size 58KB
SHA256 d81d764e13b8e7a7ede9964f118d2de44b13c39c442527c0ffa11ed25cac5014
MD5 9de28704babdcf38f423c36eae737e17
SHA1 dd7f7b03430bbc9d568c6ea31de88fc281c3eec3
SHA512 74e0b8b2cbf2de7ffde19e31567976e4c59fc68df351621acee5b0f00734fe7cb95f29fc822313f58ab9cf5f2822763d6021643e088fa6a37bf6d4672f6cbeea
SSDEEP 1536:IU49ZxlN9m68X7Yo7n8roGNHyJelIXkzqGvl/H3C:OZxz9QA1SkHzvl/XC
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\UserInfo.dll
Size 4KB
SHA256 74a4283da525512b7fa14d40cafd905e63a8c2a3c9faca4d0605ad71f1a05a7d
MD5 eaf5036ef8e7fbdfa76d42c18233764f
SHA1 acd9f46c0500b00648933c4a172ef258ec64a1f3
SHA512 93d3e698c5d40f28c9d899f95f5b8ae60eceb8e96e57000ed458b9bffadcc98616aeadd4d6b930f3f91bd2a822681ef284dfc0eda6ae776ba1b7cc6ff87704ef
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\ioSpecial.ini
Size 696B
SHA256 59847043b1825a34c78cf5e099a2764e5ba7b160dd078fa9d609d9ad6b9191f6
MD5 1c1429c7f80cd903cd2c030ef9539131
SHA1 a790788a748af1aa1e8060f5aa9b4f09a9e0ce01
SHA512 693d01f6d1f60f88b890451b64926170e72a695f933f25788b1bc43a810447d5e2c1003b4eb9ed28547efd517c5b3032fe51f3ca8ce93ca2acc0ee7d185b2fd8
MD5 SHA1 SHA512

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\options.ini
Size 1KB
SHA256 6c0769d520ab6394290dd4e03b181a9775b045d58104c505b0775ba1369b464f
MD5 d0c1fe1203bc8efa9d0588d82dc7a38f
SHA1 384b3e295f0d19e7898adfc7cccd5abe28756d75
SHA512 30e46003f2c825d7854c87d49bc36cf34a49eeced209533ebe90690ebe4b74e6618189071b0a412ee561d7f8f9375da945f45dc51c09cb4a32ddd54af2b51162
MD5 SHA1 SHA512

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsi8137.tmp\options.ini
Size 1KB
SHA256 049d9e42dab4fa1cf511d59690b987240a1e169c1c38b7afb0bdafd517943b02
MD5 f6c38e640baf25800afe5476c65ccfad
SHA1 8ffbd4c4f862fbccd2fc9da677248483e7753437
SHA512 675dde053b41bafe648dd5b2aa4055ca06d746bda47db5b6785fb53ea9a2dc34f6a64a3cf11f0aa7cb7d65137a5ede77eddc7f1b17b79182cbb9ffc90fa4b46e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads