Overview
overview
5Static
static
3HONEYVIEW-SETUP.exe
windows10-2004-x64
5HONEYVIEW-SETUP.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...se.rtf
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3Honeyview.exe
windows10-2004-x64
3Honeyview.exe
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HONEYVIEW-SETUP.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
HONEYVIEW-SETUP.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/license.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/license.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Honeyview.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Honeyview.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target HONEYVIEW-SETUP.exe
- Size 7.7MB
- Sample260709-xtfbzagt5n
- SHA256 831622fcffc89f5ed28a2d796eb0b4157a7d8bd8019d4faf4ef75ddc949933ab
- MD5 a0eb976627db97cb203cb592a172b47a
- SHA1 6f8e065cdde2aa3343d27c9f8a8e6d4225044b5f
- SHA512 8b76002b647641851e0ec7f4faf0ae2059658606896ed0184337cd7beca067c2804d7daa1d7a07505f2bb404ad98e6a7bed7d96a0eee60a136f462cb87df3031
- SSDEEP 196608:FI5dsTTBcqlsS2c2tS97660dBGHgG1yvzsYsJNmjV/k5u:FIzWiyZj9QbGHg+yIYSW/yu
- TLSH T108863318A409B821F2A44FBD5F876381A972E17C5D2056073B2E6BF31546883D26E7FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Honeyview\dll\ark32lgplv2.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Italian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\book.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\jxr.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\sr2.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\VersionNo.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Kurdish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\jp2.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\config.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\etc\RegDll32.exe HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\German.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\data\cmyk.icc HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\hv3.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\data\background.png HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\data\skin.data HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\cbr.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\French.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Croatian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Danish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Hebrew.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\PortugueseBR.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Portuguese.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Ukrainian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\data\paperturn.wav HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\psd.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\tga.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\libbpg64.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\libraw32.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Greek.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Romanian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\Uninstall.exe HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Bulgarian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Dutch.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Simplified_Chinese.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\dds.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\nrw.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\pcx.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\Ark32.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Belarusian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Farsi.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Polish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Thai.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\bmp.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\jpg.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\png.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\Honeyview.exe HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Czech.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Russian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Swedish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Traditional_Chinese.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\libraw64.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\libbpg32.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\ArkLicense.txt HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\dll\OpenSourceLicense.txt HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Japanese.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Korean.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Spanish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\HVShell64.dll HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Finnish.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\langs\Latvian.ini HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\cbz.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\orf.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\icons\pef.ico HONEYVIEW-SETUP.exe File created C:\Program Files\Honeyview\etc\RegDll64.exe HONEYVIEW-SETUP.exe - Executes dropped EXE 6 IoCs
pid Process 3096 RegDll32.exe 220 Honeyview.exe 3440 Honeyview.exe 4896 RegDll32.exe 3680 RegDll64.exe 4232 Honeyview.exe - Loads dropped DLL 8 IoCs
pid Process 3868 HONEYVIEW-SETUP.exe 3868 HONEYVIEW-SETUP.exe 3868 HONEYVIEW-SETUP.exe 3868 HONEYVIEW-SETUP.exe 3868 HONEYVIEW-SETUP.exe 4896 RegDll32.exe 3680 RegDll64.exe 4232 Honeyview.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HONEYVIEW-SETUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegDll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegDll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Honeyview.exe = "11000" RegDll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Honeyview.exe = "11000" RegDll32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.gif\DefaultIcon Honeyview.exe Key created \REGISTRY\MACHINE\Software\Classes\.tga Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpc\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpm\ = "Honeyview.jpm" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.sr2 Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.pcx\Shell\Open\Command\ = "\"C:\\Program Files\\Honeyview\\Honeyview.exe\" \"%1\"" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.ppm\Shell\Open\FriendlyAppName = "Honeyview" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.bpg\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.j2k\ = "Image (j2k) File" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.jfif\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\jpg.ico" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.gif Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.dng\Shell\Open\Command Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B6D38F3-8EF4-48A5-AD30-FFFFFFFFFFAA}\ = "Honeyview.Thumbnail.PSD" RegDll64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.dds\Shell Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.jp2\Shell\Open\Command Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.bpg\Shell\Open\FriendlyAppName = "Honeyview" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.mos\Shell Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.psb\ = "Honeyview.psb" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.mrw\Shell\Open\Command Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.hv3\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.gif\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.pnm\ = "Image (pnm) File" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.sr2\Shell\Open Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.png\ = "Honeyview.png" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.tif\DefaultIcon Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.psd\Shell\Open\FriendlyAppName = "Honeyview" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.mef\Shell\Open\FriendlyAppName = "Honeyview" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.jp2 Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.wdp\Shell\Open Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.crw\Shell\Open Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.nrw\Shell\Open\Command Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.png\Shell Honeyview.exe Key created \REGISTRY\MACHINE\Software\Classes\.tiff Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.j2c\Shell\Open\Command\ = "\"C:\\Program Files\\Honeyview\\Honeyview.exe\" \"%1\"" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hv3\ = "Honeyview.hv3" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.pcx\Shell\Open\Command Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.jpx\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.rw2\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\rw2.ico" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.mef\DefaultIcon Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tif\PerceivedType = "image" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.psd\ = "Image (psd) File" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pbm\ = "Honeyview.pbm" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.ugoira\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\Honeyview.ico" Honeyview.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.jpf\Shell\Open\FriendlyAppName = "Honeyview" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B6D38F3-8EF4-48A5-AD30-FFFFFFFFFFAA} RegDll32.exe Key created \REGISTRY\MACHINE\Software\Classes\Honeyview.dng Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.mef\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\Honeyview.ico" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.jpe Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.arw Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.jpe\DefaultIcon Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.gif\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\gif.ico" Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.dds\ = "Image (dds) File" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.ppm\Shell Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.jpx\Shell Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bpg\ = "Honeyview.bpg" Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.rw2\DefaultIcon Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.rw2\Shell\Open Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.wdp Honeyview.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.pef\DefaultIcon\ = "C:\\Program Files\\Honeyview\\icons\\pef.ico" Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.jpe\Shell\Open Honeyview.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Honeyview.3fr\Shell\Open\Command Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.png\Shell\Open Honeyview.exe Key created \REGISTRY\MACHINE\Software\Classes\Honeyview.psd Honeyview.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Honeyview.orf\Shell\Open Honeyview.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4232 Honeyview.exe 4232 Honeyview.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3096 3868 HONEYVIEW-SETUP.exe 88 PID 3868 wrote to memory of 220 3868 HONEYVIEW-SETUP.exe 89 PID 3868 wrote to memory of 3440 3868 HONEYVIEW-SETUP.exe 91 PID 3868 wrote to memory of 4896 3868 HONEYVIEW-SETUP.exe 100 PID 3868 wrote to memory of 3680 3868 HONEYVIEW-SETUP.exe 101 PID 3868 wrote to memory of 3056 3868 HONEYVIEW-SETUP.exe 102 PID 3112 wrote to memory of 4232 3112 explorer.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\HONEYVIEW-SETUP.exe"C:\Users\Admin\AppData\Local\Temp\HONEYVIEW-SETUP.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Program Files\Honeyview\etc\RegDll32.exe"C:\Program Files\Honeyview\etc\RegDll32.exe" /regieemulation Honeyview.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3096
-
-
C:\Program Files\Honeyview\Honeyview.exe"C:\Program Files\Honeyview\Honeyview.exe" /regall2⤵
- Executes dropped EXE
- Modifies registry class
PID:220
-
-
C:\Program Files\Honeyview\Honeyview.exe"C:\Program Files\Honeyview\Honeyview.exe" /touchurl "https://log.bandi.so/inst/app.php?name=honeyview&configid=Global&ver=5.53&lang=English.ini&first=1"2⤵
- Executes dropped EXE
PID:3440
-
-
C:\Program Files\Honeyview\etc\RegDll32.exe"C:\Program Files\Honeyview\etc\RegDll32.exe" /s "C:\Program Files\Honeyview\HVShell32.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4896
-
-
C:\Program Files\Honeyview\etc\RegDll64.exe"C:\Program Files\Honeyview\etc\RegDll64.exe" /s "C:\Program Files\Honeyview\HVShell64.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3680
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Honeyview\Honeyview.exe"2⤵PID:3056
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files\Honeyview\Honeyview.exe"C:\Program Files\Honeyview\Honeyview.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4232
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Honeyview\HVShell32.dll
- Size 1.4MB
- SHA256 3434004b48e9c6142142a9c5a0e2a5751bac5f4a4455f767d74bceede81fbd0a
- MD5 f2262ec93fe0520ce8552b1d31fc0d0a
- SHA1 89b0487272218ad9b87edb302f21b261253583cd
- SHA512 c275438e0bf8b5018a894b1af1ac168512e7292733a7114c241ba750d175830de7c9f51f9bf8eef9270cb5258d25087041759e47a9af0260b2c58f454cf5b7c9
- SSDEEP 24576:TGQNxBsW6+TwL9SHdCExbtgd8m6WTGDE40:50WztxJ88dWTsY
- TLSH T192652842E9D14C63CBF50130CDAAD631673AB92C6BF3C2B3B24876E4793079176652E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\HVShell64.dll
- Size 1.6MB
- SHA256 6ef35587fa3729a1a31234918e28dce24d9bb696365c978d004b31de28141284
- MD5 e21f4111803696d08da779977f6477ae
- SHA1 e80baebd4de2fd9a98f2fe3c72e008c93a7253ad
- SHA512 e9b7d2d727070535d1edff1fcb0d5a6b9b4dcf9b54adf6845cc84706c215052fbd4473ce7a2bc8d6eb5e4b347cb651e313d509a45c881f489260165527eb590f
- SSDEEP 24576:CQf4ABy37Z79YX31KlSho1Zt0KdEHFPomgNJispqTA7o3Id59R:C17ZK31joaHFQFpqT2
- TLSH T173852906EAE01CA7C7F68034CDAAC226E372745D67F387B77280A6F53E237903516695
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\Honeyview.exe
- Size 12.2MB
- SHA256 761c3cb86a9b7dc73c4dc59c34e72396f5a45a717502e2e49590fa641548692d
- MD5 3cf65b21c4b1eac960d32d8066249b6a
- SHA1 3407252f13bb673f483f8ba12cfa9a6832b545d7
- SHA512 6bedcbc431d8671b9f544206d1c8ce95816d8b792fbe1a76a65a0192bbcf8837932951c049711669a0a351b9f04be206172cd2e6d74842898a76aa7469e4fdb5
- SSDEEP 196608:m8feaDRSqJNrmy2xnrzdj3VxiC1SYk/8NdLFwIAyljW6QeVWQJCpDtBFJet8QA5s:DV0
- TLSH T123D64B42F0D200ACC1626971C9BAF15BE630384947E456A767D29EE42E73FC07D73B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\VersionNo.ini
- Size 31B
- SHA256 d2ed328ecdda2383449085b3d51cdb505f4fb458d35dc82de85751bb0b8bf67a
- MD5 d3b83003d8f8e1f00cd044b16364dd03
- SHA1 8cc69f79518c2d52857ec9ac37257128045ddbb9
- SHA512 218274ee12744860a77929a40c401dbb66ba79939f5896ec65fe66d8cf423c69973bddc62c923dab30502bcb515495360e4ab962bc054c1b211fe60d533d7206
- MD5 SHA1 SHA512
- Path C:\Program Files\Honeyview\config.ini
- Size 517B
- SHA256 bb70bbbd2b863ac27b99222e66749780f325dec226f627e40bae0c4d0c7209ae
- MD5 af735d57aab5f46dc8779ce4c262aa11
- SHA1 074ae85095e70aedef33c55971ddaa879c6296ab
- SHA512 41ce1e7e1b291b482b8e82240b2fe67700351ee7c4285117c9080111dd4462cf1f220d3d9b26b70ef0af781d95018aaf583071226c56291657c579894dd563d8
- TLSH T118F0C9FF230A859F880DB2D96010BE4CE22322EC2D8CBB9C8200A0012987867301E208
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Honeyview\data\background.png
- Size 6KB
- SHA256 8536fe8c6bd42ba57e64940e1731fb1aef4ac4f9ebbf8729d0176b5ecff799d3
- MD5 7bfa5b23014e319944bdc48e056d7610
- SHA1 331b84d29c9a6ee8f7a8e37f7fe743b31d208a57
- SHA512 8345dd2bf0aa6a1411ce824b01fd7182756b67ef0f6048d9ba15f141afe69473e79ad927409ad91e32b06492f1be4f3eec716cf5150cbfc29566c3b5787bbcdb
- SSDEEP 192:BAHkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkV5Fc688j7tAdqh7kkkkL:O4jcWJaqt
- TLSH T179E1F0E63AB4116B2B4090824F53B6E67B3DCE7BE4507FA3420D04A5DE319C359C972B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\data\cmyk.icc
- Size 705KB
- SHA256 0bcab27ae2d7ed8a259cc9d06d5bfd9f2295a51fe2dc0da50d0e75fd30904bb8
- MD5 12a17c21311f56318e5152f3b7838e45
- SHA1 3adcfe8bd5bfc693e2a793d7bc5db3876c31bc37
- SHA512 69ef25860862c6c17c863b31e6e50fcf206e77ffa0908a0b36258b88dbd52a360db8cba5df4ef1f3886f0dd7504347b572f34594def6e24d94b51fe76c72354f
- SSDEEP 12288:17Y/zZCImg8kGoAT1IOHo8MPPaWBBB0GgMY2:5Y/FdmNT1IFXnBBBRgMY2
- TLSH T145E4F8447B73C0C4EA2D3DB04A9BAFC54EAB7FD0598161A7B134B20F287278456B7678
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\data\resource.h
- Size 41KB
- SHA256 fea59c8808b5b606a6794187b00591bceeb6f7506a698edf9e7daa81d6dd855c
- MD5 9baa007ad1bfa97d43a5d0dd2e9880cf
- SHA1 cf78f00bd2ac4723b0ccebcf0add686e73e38f5b
- SHA512 42ffd55e377a0d3d907776b85606b580ce674323b122abc857741349949217c4b340f9d691d110d8e5369da9b8205b965308036028adf6bc3b317e71edef0a5b
- SSDEEP 768:iM/bBVpUkgX7oFQ5zXTujPI7wskCukKZwjXzS0g4pkIyl//ZVwO+9KzTleG2ddIb:ivzXTujPIUskCukK+jXzS0g4qI+//Tww
- TLSH T15813B80C1DDB2ED6A4B8F488456E876614AADC3319B498ED716C2E8D4F581084BFB4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\data\skin.data
- Size 216KB
- SHA256 e584e80b005f645f1db27fb0f3215bbfebed8e1d6014b2a266a1baf7a734764a
- MD5 20cea1e33390f32fcc2e758a42ab3e96
- SHA1 b0b8759239dce926d5d0f47c185b81fdd7bb536d
- SHA512 3972f2927641e95074b60e5d8f0116847b9882963773f6d3c3bcb5f3da52467c524b0a3785965de4e3eaf93098b714bc34040b5845e00a1e14fda68f9490c177
- SSDEEP 3072:tW3YudPXEw53xl0fHLWpZX65yzk+bCf6fh5CUNMKR1mcgjjvgyIA26r3MaytKLjf:tBuxXE8hl0mAyHMJP
- TLSH T136242943B7DD1404F1BBBAA56BF680325B22BD80557DDC2D20998D0E85B3A917813FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\dll\Ark64.dll
- Size 1.5MB
- SHA256 cd0fa5cbc4217350b39d66e406b5619fae642129816d75e36f83a331a0577ad5
- MD5 a7567e70215ae3ca7f15eb17425866d3
- SHA1 b48b45b6f840081f8b6eb4f9982476f20e847941
- SHA512 19bf463b14da0a07ec98d442cb3148dfbce4ab342c8cc2b0d9f244d5c6fa7b9c5b2cade114602b9be5ddf00ed7588ca4643bc06efa49bd00d4ed31b572c42777
- SSDEEP 24576:Xy1rC9rjQkKnhsgqEQreSaiAXUJX7I9+vsDJNmoz8gF5B7AaRRGzNJmrqw6cSnim:C1rC9rjCSr9A/SjpfSTvmV
- TLSH T1C4656B0BF3B940E4D167C17DC9578B1BE7B1B0451B609BDB56608B6A2F23BF15A3A320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\etc\RegDll32.exe
- Size 145KB
- SHA256 ada1334f40e26d8fa0b8dda18db09ba94a254795dcdb7c0b342edab33c75e678
- MD5 b3a8db89ec5ca49568e6da5c935949ba
- SHA1 53059f659a2c0a49c785f1d25011f48ea146a0ba
- SHA512 12c1eee86fb49071d21f5a6661676b089ba63d789494289ae51b8e44d7c78bf20c36acfc03a2da50e54ab9607fa16a2f110c3c77156e95886f0802f273cf8c95
- SSDEEP 3072:L1YO9gjfBui84Z29PLE+fDNayt5LfpP7gyhGhx2n:LCQgjfBui84uLE+bNrrfpP7gy8in
- TLSH T10BE3180276818071F7090B315995FAE049AEAE3D16D4E58FF2787E3A6E312C35A7724F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\etc\RegDll64.exe
- Size 155KB
- SHA256 b9211f02a0268d2966f8b07a095d53d3d2abe42d546b87a2669a1cc48f3eb4aa
- MD5 99c85b9f6b3699a6d1b2bcaecfd67334
- SHA1 d6ec2514220a7c35472cb8e00bd45f3244dea5f3
- SHA512 e955a5d5bd59e54dba2b9556e91a2adbd7810bead2cdc2010cf95e45163f87a9de9c6555ae33405dfabb765db7e316f5fe148ddb35e1bc5d3ced095bf2b49412
- SSDEEP 3072:V4Bp3Qix6aD594azJQ2X5J6mJqt/jbS5DbEZyAlpehShP2a:V4Bp3Px6azJQgH6GqtXsbENlpegAa
- TLSH T1E4F3E646661110A5F3198B348992F5C59BA17C3D16E4E78FE238BE762E332935D3B20F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Honeyview\langs\english.ini
- Size 52KB
- SHA256 b72cf242504520efef8da0e0d5d4eba991d5e044f901057b09dbcb448d0533a8
- MD5 e1759d197147a8faa012f9c748449b28
- SHA1 b870f4ec13aecf4da66c7551c162d413e343b2e0
- SHA512 5580200eaa70ea3f56d3e359ba990884cd289b1c2b8d88d27b1eaba58887e2326227f220b7e9edf8bbd7a0cb07e9e8d4d7375dee3de774ca25348b2927106c15
- SSDEEP 1536:kOO3UUTANzM2PrCgHbLLKevQPGmokvbPAoDuGYW+CaMI2AKs0:M9TANzM2PrCmmevQPGmokvbPAoDwCavk
- TLSH T1FF33B3122AF9102AB177BB959FB9D1B48B37B5E4867BCF3D1084114B17E2D50B9223B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02
- Size 1KB
- SHA256 3622ee83e81c316e0f2ec0de385560f1638ef02240c77cb58a3a46df3ad35ef9
- MD5 c3626d635a0986fed8526665b7b591b5
- SHA1 4f093c49c7b525d1e9130d5709d70075b154b3c1
- SHA512 557e5d83371933ee80c51819c20c4849604be206a819900a728db443978eaffee60d787cb060a1f38877b99c54424b4d6bd9f0bbbb10fb99df1af4a57d62f325
- TLSH T17231CE8C49456233DD067F20D9DAEDA3ED7033542BC1906F8B545A512DA1EAE4FC21E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
- Size 727B
- SHA256 6275ce49a6ed86dacc17cb3e4d77d05a756255c586573b41e41b18f396285beb
- MD5 c26550fa12b9e5f46dcde6a08624f465
- SHA1 4d40aaa92319ed23cfdc09e8aa3c75f8857394e0
- SHA512 886700cd32c1a551c43d83699b5141d1c2014fbe8b8bdcda5a16ff810eeb7e7ab7d9a8134a337b95fb88f540fafc397eaf68a25052c4276e2cf6e311b9fb46b0
- TLSH T1A40199070DAE4150A7D64765BD70493D32A0D5431CCF8E4A6E3030663D987432AF8271
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF7002F7D134054FD81B7E8F30ACE57
- Size 600B
- SHA256 bd1966774131f2812e9d22889bf8ee5e18f98f604d1a6e3b9df0cdb8e8a6066d
- MD5 62ade38db81e54726a618334cfadebc2
- SHA1 468fe73dcfb21d73cb0813ec3da73c37684254e2
- SHA512 6ccb58913ddc1b3f283e00a2b01f7c55aa1b785c0aaddf70fc8eea528497d81e27e871ab9fe5f673b6e37d0513ad09437f7f20e057ebe0c9191da7d34460702e
- TLSH T140F0B7404F2845F8F05AC53D03A49EEAA13933625BC0365A717E16F03446D29674B01F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02
- Size 330B
- SHA256 a1b125e95b0018da695f47bfc9927a7baf1a9d772448a6bdb5cd5b35ade45953
- MD5 a46c4f20faf9365823e1188c4cf57b5e
- SHA1 f1569a317720a98bdc264882e29af10dab4085b3
- SHA512 69dd0686b64307ac398d5f134645455a5ee3875ae01b0c48684ebdab728de9d21125e8e3d1fc147536b3d000edc66d6a87b7b2ca443dab154bfd0960520310a7
- TLSH T148E0C2287B9C8226E2BA12B5E9E25D82CC27B897A542CA960B3F030E1C24F008C6110E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1593701BD276673B04DEC503D761A9E_E1F945BF658DCC7B1DD3A7B88D3398BA
- Size 484B
- SHA256 ed56bb2f6000446e72cf7ddf9987bb9207f19041a05173fd460dc39f0f3e8ccc
- MD5 91072030875f1a38a72273b005166212
- SHA1 27842253d97035fa594d00430265016140d00113
- SHA512 99ac6493a5a81b4105281244485409d54d2054cfc2f0ff9cd22e4a12415edde4cbd348e15d5c3370d8fe94ec8a0d701b65b6cc9d2cf24a8f77cd1ee816b5358f
- TLSH T15DF0AB5C11FE002AF5F3EE7DEFECB929996EF057184539E51A9119896602F009D22838
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF7002F7D134054FD81B7E8F30ACE57
- Size 480B
- SHA256 63b3f3b4731f29443a578e068f275dc3e14ba5c5564f3f4927983dbf6f7e7841
- MD5 1b890cf2997448df6181a7b018f869a5
- SHA1 adbddca567121b78c7b71df80fa8baa9f5a12125
- SHA512 751a693f11ead59d4e04b280f672d2d1bb8d4c48522de39f71c6ae4c52f4124b8a6a631ee5b831913ab5cc7a20ea1249a366a9fc57504a2f4df5ea96497f8a58
- TLSH T16DF0AB3801FD060FF2B6D6395ED962E19EAAB00338410ABE46E112AA1A02E415CD3066
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp436F.tmp\LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- TLSH T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp436F.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp436F.tmp\UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
- MD5 2f69afa9d17a5245ec9b5bb03d56f63c
- SHA1 e0a133222136b3d4783e965513a690c23826aec9
- SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
- TLSH T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsp436F.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH