Overview

overview

7

Static

static

3

ef9f232e31...f5.exe

windows7-x64

7

ef9f232e31...f5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    75s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2025 02:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.exe

  • Size

    2.2MB

  • MD5

    02b4a52ec119d3cf966d70da67eb3cef

  • SHA1

    b424858fe8871e2ca7b513f34f7568e4d04ec4cf

  • SHA256

    ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5

  • SHA512

    3a1bedf763bb685be3d1712db82f9e201a0102956839ce3b31664b91a796eca92c41b606e2b7a6b95c5f43b0550a761b35f7458aac3f38c38b66dee621acabf7

  • SSDEEP

    49152:GeZM+VKH/ZKhwqQtUWzpDMnOmB7ebA5rOYiZnS:7GWwvtt1jmxebSivZnS

Score
7/10
adwarediscoverypersistenceprivilege_escalationstealer

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.exe
    "C:\Users\Admin\AppData\Local\Temp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\is-2GC3K.tmp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2GC3K.tmp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.tmp" /SL5="$400F8,1666168,70144,C:\Users\Admin\AppData\Local\Temp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
        "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /regserver
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:332
      • C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
        "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /install
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:2452
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox.dll"
        3⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:600
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll"
        3⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1148
      • C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
        "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /afterinstall
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Inbox Toolbar\Buttons\blue_green.xml
    Filesize

    52KB

    MD5

    73ae8ec141d41888f4f4efc96e3158aa

    SHA1

    ed00518da7d76b725af71e493026e1645f33a9f9

    SHA256

    3b18558a9b1f02bc5724b37c128389804f89a6aee5f9b9b484e94d0548057110

    SHA512

    95adef46aef2529a9f33050a88dde6a8217e88f4ae6246ffc2f9fbdf985bd1bef1b505561a8bf10ddef376ecb340e632994be127f5a7b36f60bc0b4642cd0108

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Buttons\converter_calculator_fr.xml
    Filesize

    5KB

    MD5

    399a73749278980e95ce700b63df5fe7

    SHA1

    70d422373678cd28595b833220604c2c87fe91eb

    SHA256

    0722786036cff066f462926dfc0c111666ca828641a6002743a05b4d8a94a6f1

    SHA512

    9cacf2e2fcaa80a2e05d41e4c08f683a71eae7a6e34f8ecf239fadfb019c814bb4783f60307c2de4efc974cf5d42f4ce0c3fd155cab33635f4474da2a24dd7dd

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Buttons\converter_currency_fr.xml
    Filesize

    5KB

    MD5

    32b33bfcbc9c1e3824a9f85b824bf014

    SHA1

    71a9518c7dc16a058f2fac5a1550e51fcf4b7a6b

    SHA256

    01e7740dc4ce754aa12eb4ed8ffb3bd143c86c972007728bf48e5d125c948066

    SHA512

    e4338811a934a5f669be46b82a26e7d6daa2436cf461b0163a68e84c09360e5ca60012c9424aa913d83bc4989f92621c44c37829514f1782a85d4824c2bacee0

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Buttons\converter_measures_fr.xml
    Filesize

    5KB

    MD5

    3768bdfb68565925cece53689dbc5f55

    SHA1

    810033ee9d466dba9a8d01bc87f0098202c56fb6

    SHA256

    a904b7a2a89a01409fddc8b76062d61e420f450cbae25a51918d6cc64d41c320

    SHA512

    845131ea94b1b714f16d895ba6abee3a5d85cf45ff923005ea0647a9b2f014b738dadb3da6e3972972c121c0b0a646dd20b41117a5265a1ca65bb61d883fc9a8

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Buttons\converter_unit_fr.xml
    Filesize

    5KB

    MD5

    641bb69a98502dc4c69aa74569e982bf

    SHA1

    e0ca90f45ab0be5514ed47554b14b430b8492619

    SHA256

    21ede483f4db58c9a871e816de2a5e609e24363356aae5431225893a126fe9ae

    SHA512

    527ee5a12706500c20e2aa6659cdaac2eadeb7310869a50efcc3000cf2d4454b2a1a334ed87f99ab4b7efbd5c963c8c68329b3cde75baae2eb8436aaf3aed3e8

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Inbox.dll
    Filesize

    1.0MB

    MD5

    2a4e801ff572a6090416229da357a453

    SHA1

    79f786edd3b590f017916527af27220bf944cd0b

    SHA256

    dff29dcf0d005b1c86362027f5e916a3acc804b0193f802fbecdb9b3aeba191a

    SHA512

    b227e511b2981840bf051adec34e89b1c3a8369d0e28c923e4302f300570bc91153e899c7dc9b60692e6fe675ae0c1106baa2efdcfbbd002694308970ccd1b29

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Inbox.ini
    Filesize

    2KB

    MD5

    4933891732a3eb9ee44a5abebf8c84ad

    SHA1

    5f95c4cc04ad57277231d223c4c3798691dd313a

    SHA256

    93502ac1feb805ae8075a7235814b9f5014c6f0138a7ff88afef04f6a0526951

    SHA512

    6dc43eac8623cd4f719453fe1199d89b7e19ba13566e91eb0b1c4f902c0cb52a8175cac80c413b335cd162c395d3cbef19bdf0beaa16bfc830e33800a2639a8c

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Inbox.ini
    Filesize

    2KB

    MD5

    8f0d4ab82c5be4a95f01a743ad5a383e

    SHA1

    b242084a38b997eabc51c37f23316abd25b7ea04

    SHA256

    e46bc5159440ab1b3aac00317f2815a8159f823b8509de43454536ee6b725fe5

    SHA512

    39a7b13551a55444e5306ed7bb54490222d94eaae9de5e6d5631bdd0c0d4461ec80edeca53aa95d366f8d0a00fa9bd3fed8e52498823122ba7c7ba6c969bc99c

    Download Submit

  • C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll
    Filesize

    1.5MB

    MD5

    7e248eee50e58cb6ce8fe84679e22916

    SHA1

    a193272ffe368f83bd3e0c58ddbe59bfb03ccbeb

    SHA256

    49be722168c360177d98607927ea7b3d9d5753fd5a4a6757fa1d5d15bd4a1ab5

    SHA512

    fefa6e9070a19c3d6f79944c70d7800ceac3a0c70129cd946f01dc64ec5a35a08077ea1ce9f6bf6d2bcefc2f8fde1cf14f16c6e234df45b9b19527cf140d85b0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini
    Filesize

    29B

    MD5

    3ae883e8a3e0272e3b0844d35a05fd87

    SHA1

    45b5ad9ea39c60ee61d6ad5776b82975c27191c5

    SHA256

    c37f72f8519621289d97d31889959c508ecd8ee7a18dd04462fcce53b74719c1

    SHA512

    5dbcd8f6ed1891f9099723934f46955f90d9219dc07ba468ab1cd286f9b96154365f4ada2515639a8f0710b98fa01451d01e02482ba334905d9443782eb2ed0d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\translate.ini
    Filesize

    89KB

    MD5

    6b72fbdc939dffb3c9d268d521459f91

    SHA1

    948023c34ddd35bab4b83d80cabf6b7fb06eb5f2

    SHA256

    9b1c3b8a08541289d360526f37a4647a59fa40f474d2288ea6a5c3a947364fff

    SHA512

    f8948e0cc24361f361886a4f9467b8316ed093e0def78df860ed221e345a69a8cae785f57d08cfd3ac54741ea9dbde97f035eb88aa8d35b5529c32cf50b1d8e3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{C04B7D22-5AEC-4561-8F49-27F6269208F6}.ico
    Filesize

    1KB

    MD5

    34f4618666b7e80e687b25b82a7da5e2

    SHA1

    ab543a8992b71891139d608d77403a59bfabd501

    SHA256

    fa975f7a7a854a7730b1c92d1567706dce2eab80d78cf131eb1cec40e88cb7e3

    SHA512

    b7e4eeccdd9d84d9a352e9490f19d08c06c54554ac52e3ba9aa1a81de2181a6a185387a323122021303afe32da21ceb3f1f6aa3524c45a6c8d9abac4144237eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab517C.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5556.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-G0HOS.tmp\RI_AfterDot.bmp
    Filesize

    84B

    MD5

    7ccd5a0af4da51cf4962f184fcf9456a

    SHA1

    de37f4521fa7fee49b37898f4136728e8971ee0f

    SHA256

    8f2374b30622dfae1fd0b9706520de34c5e1597c1531fddbff65bc0201132ac7

    SHA512

    d7c4fbc6a4413dc457400fa2e026dea5d639a5b413164cc6939284c46bb46b6ae8ff10184ba2da4f32ace89646b026400db2a49dd9894d71e88d003a91c8267a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-G0HOS.tmp\setupcfg.ini
    Filesize

    44B

    MD5

    07352ba73699fdaef6e2f996b9aa8f74

    SHA1

    512b73da0a2645a123835777327864bd72d3fbed

    SHA256

    30b91bc9116288231a2c574e4f78c678a049c08867d56e7b280b6e569449f01a

    SHA512

    b3ce3222ead04c4bf4b0252def84f6b19c950fc012ca97ef7faa3185df35c4375490b15035ae06b3fc709c76c7e7cd4e9a5ffa7851773fcc7ed4c45270e05671

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-G0HOS.tmp\tbr_dots.bmp
    Filesize

    164B

    MD5

    adc799ec79eeaef366ea4dddf099c3ae

    SHA1

    556c915615a34a2499604b7b732ab304b20fdd4e

    SHA256

    7e7f18c73560f9c020abe1ab1f22705083281e2ea16ab0030fc927901b5b5d1e

    SHA512

    76962a17cc26d3f9886828be4e43373ac530165e1c627272ed7c0bc731133e97608e55d2e31f44592aad0d0974352155f41a0718aa0666ec128406b1050c1d6c

    Download Submit

  • \Program Files (x86)\Inbox Toolbar\Inbox.exe
    Filesize

    1.3MB

    MD5

    4f5e181c0b6744c28c2baf7e06fc3693

    SHA1

    3b757aba2cd2f1ee9d5b5d87095bffc3222667fa

    SHA256

    5a22ff570d2cef55533c32e31d50d60daaf93ef98c853046b95ce4240b2574d9

    SHA512

    3a523ee2e6ed46cbce048a995611a401f74364fbf4ec90739f2406febf274b850fb1dd4785ee9fe66a53b760b7ea6001acc9e323556ed05fe360e904beb6ecc0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-2GC3K.tmp\ef9f232e313d9dd77d7db51379f86c150c19373344bd27b592b1a803cfe9f8f5.tmp
    Filesize

    1.2MB

    MD5

    e7106fbf42fbc6d5b08a18ada4f781b4

    SHA1

    36d4a629f79d772c0b0df8bd2ae2ea09108d239d

    SHA256

    64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

    SHA512

    adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-G0HOS.tmp\DownLib.dll
    Filesize

    183KB

    MD5

    db25dfdd4c1f2b65c68a230881072695

    SHA1

    94cd6a3438041f0e61b0a1bea7b66461854efe69

    SHA256

    1b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73

    SHA512

    db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-G0HOS.tmp\_isetup\_shfoldr.dll
    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    Download Submit

  • memory/332-193-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/600-225-0x0000000002650000-0x000000000275B000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1148-228-0x0000000002340000-0x00000000024D1000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2104-349-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/2120-2-0x0000000000401000-0x000000000040D000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2120-0-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2120-220-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2228-231-0x00000000049F0000-0x0000000004AFB000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2228-223-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2228-9-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2228-22-0x0000000000620000-0x0000000000657000-memory.dmp

    Filesize

    220KB

    Download

  • memory/2228-346-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2228-348-0x00000000049F0000-0x0000000004AFB000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2228-222-0x0000000000620000-0x0000000000657000-memory.dmp

    Filesize

    220KB

    Download

  • memory/2228-388-0x00000000049F0000-0x0000000004AFB000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2452-219-0x0000000000400000-0x000000000055A000-memory.dmp

    Filesize

    1.4MB

    Download