f82a9374eef71d76cba7affa81b22e5b342ed24e8edf4dba13e31fa90c030cec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
free-mouse-clicker-1.0.6.0-installer.exe
Size 2.0MB
Sample260728-phebjaha74
SHA256 f82a9374eef71d76cba7affa81b22e5b342ed24e8edf4dba13e31fa90c030cec
MD5 4b80431ce33ec7c4cf1829c3e1443b8c
SHA1 0d36227fcd56b98f9128120d9fd8819cf65f9a1e
SHA512 a01283aa5f8861f97d14b18ce20af8d750b73a2b13c20b6a33a749a8001b2e22f662eafe9d58b4874187f38df0b979e31d50fa97415a3eaac31a69b96c902a35
SSDEEP 24576:HXNrSLScusMmOvjjhzvLV5jeKBgkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc6o:8uI2h7jHHcTeynRkfg7ve+AhrWzOUR
TLSH
T179A5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery installer persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	3032	free-mouse-clicker-1.0.6.0-installer.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	free-mouse-clicker-1.0.6.0-installer.tmp

Executes dropped EXE 9 IoCs

pid	Process
3032	free-mouse-clicker-1.0.6.0-installer.tmp
4616	cookie_mmm_irs_ppi_008_585.exe
2936	OperaSetup.exe
2216	installer.exe
2508	installer.exe
4812	installer.exe
2296	icarus.exe
2664	installer.exe
4336	installer.exe

Loads dropped DLL 1 IoCs

pid	Process
4616	cookie_mmm_irs_ppi_008_585.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 10 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\AVAST Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\AVG\AV\Dir	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Avast Software\Avast	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	free-mouse-clicker-1.0.6.0-installer.tmp

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cookie_mmm_irs_ppi_008_585.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024420-116.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free-mouse-clicker-1.0.6.0-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie_mmm_irs_ppi_008_585.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3512-0-0x0000000000710000-0x00000000007EC000-memory.dmp	innosetup
behavioral1/memory/3512-7-0x0000000000710000-0x00000000007EC000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	free-mouse-clicker-1.0.6.0-installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	free-mouse-clicker-1.0.6.0-installer.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+gGScZbDF0KpMZlYTR7vPQQAAAACAAAAAAAQZgAAAAEAACAAAAD+PEFTlZZUbl+RzaZGThpc61PiIJ4PGOpKVLg94OPxTwAAAAAOgAAAAAIAACAAAADzwoG/ZVjnktEFAJbXRnVk3gTsHItmdyHM3KK94/UvsYAAAACU/COHKrsCHviqXLSTMJ1WF/pjK/7WigpXtZMwmDFz6g3FSMjPWgk+r/RFk5tLAtwlTSo5PAvd19OJGlk1vcSKCfWFRD4pVNLq3bKfQfBmuPYuY89SjNAfjIf7Pt241G2YqVfLskvRL0pAbjs8LpZtm5cPjzrso0M3VpiuA1VNI0AAAACL/ppn3AVMzGoqx53mpUWXh6VmWpdI+V17+J4pgel8luk00mGqOhEa17bJj8z/wLw3wRQPaRZ9DcHCoCNJnrK0"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "85bcdd84-c24b-4ca8-8ecf-5b8a329bc1aa"	cookie_mmm_irs_ppi_008_585.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	cookie_mmm_irs_ppi_008_585.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp
3032	free-mouse-clicker-1.0.6.0-installer.tmp

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	2296	icarus.exe
Token: SeTakeOwnershipPrivilege	2296	icarus.exe
Token: SeRestorePrivilege	2296	icarus.exe
Token: SeTakeOwnershipPrivilege	2296	icarus.exe
Token: SeRestorePrivilege	2296	icarus.exe
Token: SeTakeOwnershipPrivilege	2296	icarus.exe
Token: SeRestorePrivilege	2296	icarus.exe
Token: SeTakeOwnershipPrivilege	2296	icarus.exe
Token: SeDebugPrivilege	2296	icarus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	free-mouse-clicker-1.0.6.0-installer.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3032	3512	free-mouse-clicker-1.0.6.0-installer.exe	84
PID 3032 wrote to memory of 4616	3032	free-mouse-clicker-1.0.6.0-installer.tmp	96
PID 3032 wrote to memory of 2936	3032	free-mouse-clicker-1.0.6.0-installer.tmp	98
PID 2936 wrote to memory of 2216	2936	OperaSetup.exe	101
PID 2216 wrote to memory of 2508	2216	installer.exe	102
PID 2216 wrote to memory of 4812	2216	installer.exe	103
PID 4616 wrote to memory of 2296	4616	cookie_mmm_irs_ppi_008_585.exe	105
PID 2216 wrote to memory of 2664	2216	installer.exe	106
PID 2664 wrote to memory of 4336	2664	installer.exe	107

C:\Users\Admin\AppData\Local\Temp\free-mouse-clicker-1.0.6.0-installer.exe
"C:\Users\Admin\AppData\Local\Temp\free-mouse-clicker-1.0.6.0-installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Users\Admin\AppData\Local\Temp\is-XDXHVHCCZR.tmp\free-mouse-clicker-1.0.6.0-installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-XDXHVHCCZR.tmp\free-mouse-clicker-1.0.6.0-installer.tmp" /SL5="$B0058,848247,840704,C:\Users\Admin\AppData\Local\Temp\free-mouse-clicker-1.0.6.0-installer.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdEguYAcnjAFqfprWTzBQHy3loslbG45ZYqofRGyKESykmO3aH1TqMC9j9vcGWeal7GwLeWXarHrp /cookie:mmm_irs_ppi_008_585_a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\icarus.exe
      C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\icarus-info.xml /install /silent /ws /psh:agiSfNdEguYAcnjAFqfprWTzBQHy3loslbG45ZYqofRGyKESykmO3aH1TqMC9j9vcGWeal7GwLeWXarHrp /cookie:mmm_irs_ppi_008_585_a
      4⤵
      Executes dropped EXE
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component1_extract\OperaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdEguYAcnjAFqfptsNPfQq8PpnFKwzLWwp9wkAJtrhYT7XrcfxMr8YpYkTa9aqFwh87tt1niXoWi3
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdEguYAcnjAFqfptsNPfQq8PpnFKwzLWwp9wkAJtrhYT7XrcfxMr8YpYkTa9aqFwh87tt1niXoWi3 --server-tracking-blob=MmFhMTdhZWE4NjhhOWNkYWEyYzY1Njc3ZDMwNzNlZTA3YTQ5NjJjYzE3YjBiZDZjNjBhYjYyODU0N2JlMmY1Mzp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3ODQ5NzcyMTEuMzI2NSIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiYTQwODliODktYzEwMS00ZTQyLWI5MTMtZTBmNTU3NGQzNzE5In0=
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.85 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7c286ad88,0x7ff7c286ad94,0x7ff7c286ada0
        5⤵
        Executes dropped EXE
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\.opera\ef713999-7bbb-4dc7-b813-1facc2e87ec7 Opera Installer Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\ef713999-7bbb-4dc7-b813-1facc2e87ec7 Opera Installer Temp\installer.exe" --version
        5⤵
        Executes dropped EXE
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2216 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\ef713999-7bbb-4dc7-b813-1facc2e87ec7 Opera Installer Temp\opera_package_20260728132150" --session-guid=257fa6db-7b72-4a34-b864-af6b87db4408 --server-tracking-blob=ZjVjMDk1NjljYmIwNzdlZDBmOWMxMzY1ODUwMTdjMGY5ZTU1ODMyZTVhYTE5NjAyZTIwOGMwMjdlM2I3MDM5Njp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4NDk3NzIxMS4zMjY1IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmRFZ3VZQWNuakFGcWZwdHNOUGZRcThQcG5GS3d6TFd3cDl3a0FKdHJoWVQ3WHJjZnhNcjhZcFlrVGE5YXFGd2g4N3R0MW5pWG9XaTMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6ImE0MDg5Yjg5LWMxMDEtNGU0Mi1iOTEzLWUwZjU1NzRkMzcxOSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=D407000000000000
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.85 --initial-client-data=0x278,0x27c,0x280,0x248,0x284,0x7ff7c286ad88,0x7ff7c286ad94,0x7ff7c286ada0
        6⤵
        Executes dropped EXE
        
        PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 8KB
SHA256 766d65e7ca3075f20dd1f6c16941e9e5987b65d19dc6b5fc74b4e3acdff75d3f
MD5 b2a46eaca60f3631506b3cb4139d6540
SHA1 75de0907570cc0955f578af4b6a5f492965792ea
SHA512 4961d171fad74d0396a1a59c688f3f25e9972c2a9fc9e14760787e10d8bd63fce17e117633a2a4b82be160dc4161d1ccef09c0ac597f1064c1b033dc7ba83c01
SSDEEP 192:YKF6Ii44m61eZ1HhqK+MjUWB0X3GTAhiSsUJ:Ym6mZ614BhqK+MjUg0HGTA0+
TLSH
T18002165FA93FB0B30229AB82F5413F6C6B5DB1193BDD4865753C201C772A822A76FE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS87B76CE8\installer.exe
Size 8.3MB
SHA256 3a849bcab0ee94873a4cd5d14906cfcd242257b5f23c1029fe901d6b902fcfa5
MD5 18348621dc86f326e834d517fe797d08
SHA1 d784448ad64b8156288c1d2d4480145781fcfb11
SHA512 83c5faba185d93601100f97de67e913c3b0ea6b2cffc76a0da7c274f585730e022ceca73d23b8f180ad11899a1c60ec10af203892e0be0301b0287e2a96918c0
SSDEEP 98304:k/06Gb0nq73PcI/Ztlg1RbdsuJXMZ+sUYNY8AF4:S03b0o3x/zwVC+NXF4
TLSH
T1EE967C53F2E601F8D06FDA748B7A5232A9357C464B35A2EF0A9436251E71FD46B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

100.png

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\100.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

101.png

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\101.png
Size 51KB
SHA256 3f63f320e919830fb21fff8dbd82509ecc8330c89513163daedb1b7687a0a529
MD5 958233a25ac0c23fae9451963eca0de5
SHA1 8801e6dca9e4e4ad1f5b49caa097733877cf2e2e
SHA512 996177a1a878ca82c1ce02f8937f51285aa9b7c92471fe9c19b41892739e82aaaa7ebcb7f396d6d777da822578b1db1fea893ed55708521e4b8e31a81cacda0b
SSDEEP 1536:l7LeXprR91MWpD5Ko2ORwQWwyJUcbWb7H:ApzWTo2ORohKPH
TLSH
T1E33302A0B153C51FBA8B5211D2043975776E92F6F860FF4873CA016CAEE5D415B173CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component0.zip
Size 782KB
SHA256 4a59596213b8e401401fad6249213596400943f72f98d8810c48538374137f52
MD5 2c7be73f369c90ce32bbf5b6edcd9cd4
SHA1 aabd8f656ea80ea72dd17f2819fbee64e6f4b560
SHA512 312502f64439a7debfee5b47197e481eab490604803bd07eda5fa3d1a1e8e7de3e6e687693932ee5aee85e56ee059b790a7f47a3754f6818e14fa1cf6a0a7815
SSDEEP 12288:YV/ZeZ0C6U6lQzc2+KcqaYTmydhmdfLNz+g5WOcmpMi2VWmSKAf+4l:g/MZ0RTv2hnKydhEz0OcoMiCWNfj
TLSH
T1FA053380AE40F676EB81CA213FA7E5DF35538D923BC1797D61548088322DB6EF5CB258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_mmm_irs_ppi_008_585.exe

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe
Size 1.7MB
SHA256 2ab4329fb77df9f5b70ac45d9fc005f019c8ef930eabf82e6a10052f9cbeec2d
MD5 11a225495371d91ef254a5c69c967ea6
SHA1 ab136cbac42cc54a6aa15f7eb43eec1c6647dc74
SHA512 5012d9fbc9401b5c5a377f100560c637adc98d319749bb599a0a0487417915f647032430ef027c69cf1a8fecc2d63a741f1aaec71611dcf292db109a35c45023
SSDEEP 24576:tuRu5fl3AFG8CWgd3jEDigqqP9WhavTXeS0h0lhSMXlOncOy9x6mWFI/RV:bJlQU8CJjqF0wuS5icLxxWe
TLSH
T198859E207B42C07AD49A01B1992CBBAAC16DAE744F6550DB73F03F2D6D711C22B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component1.zip
Size 3.1MB
SHA256 20bcd5d9f6946fb0d2aa0b317d0af45b88db8dda506c9a1c98dd54f4a39f9d99
MD5 b6d354b12ba21b27e2ca11026cc7b573
SHA1 238b5336fb0e833279f8a8ec886da6a4402de89d
SHA512 567a49b6ef4840ba34947e05bf9b4e9860846a185839f05862af11be3276040832fc40610a688f6b5a8591973a7e0478ade9354f8c2061844a46e422adbaf259
SSDEEP 98304:AA1p2uPKsuXudDjsnDdOlPmZr4JFTxe6HRn5CoZh/:npI8cDdOcUj9xbD
TLSH
T1E9E5232277C0C874C62321335F1DFFA8A5BDBC201E66964B77886A6E8FB0581D635F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-6I1GZCYVRO.tmp\component1_extract\OperaSetup.exe
Size 3.1MB
SHA256 3702b306211cf30304e73c9d0a9650149220eaa71cbaa9e96f2074419a9331df
MD5 c267694b041db1ac6b76a26fa75c6823
SHA1 27c339514a2dd79b45f580e1a63973a7244c33a8
SHA512 f3565f814b6ad2de752f9b60e2fc73dd91d7668992065fff1b53c252ed01592033f10a71bac49b72816fc7bebec7b3e2f09992b7340a613e9191fbb9bc13b061
SSDEEP 98304:wA1p2uPKsuXudDjsnDdOlPmZr4JFTxe6HRn5CoZh3:3pI8cDdOcUj9xbz
TLSH
T179E5232277C0C874C62321335F1DFFA8A5BDBC201E66964B77886A6E8FB0581D635F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

free-mouse-clicker-1.0.6.0-installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-XDXHVHCCZR.tmp\free-mouse-clicker-1.0.6.0-installer.tmp
Size 4.1MB
SHA256 3a62ae0d102cff66fba0a1f0b9bcdf116ad369c3c4f0212eb21a53c766c75a7d
MD5 fa1c977a4003cc0793201a6f1711bb6d
SHA1 99687859fe21ab2c851da864ba0c90d72862ca57
SHA512 3fdd7887b940c005f54535e3d229d0c2f456bd9b2d28acc399c92078ec45adc334e065faa212d08fbd9495224b1767b18b1bde59150a32415df27d9727f59959
SSDEEP 98304:fYU5hnuOajWwMPdCpepI3GrwrA+Jz333E:JxuHjWfZIzc
TLSH
T1F5168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 a0a1a5c5246958d8270a70d3750659f87c61951b9ddae0c38491bfd91d2af177
MD5 ec254684839cc0959851df3846f9b35c
SHA1 bf40538f612b4258f1305faea4160450022f0954
SHA512 fc3cc4c5e0a1fde0f17201d3fee9701ae53c38a3ad5f86e1605b42c291c15ec03bfe1922e142feb302cc85b369ff33242b7b5ab1054d156f93f198c40a48db60
MD5 SHA1 SHA512

Submit Download

free-mouse-clicker-1.0.6.0-installer.exe

Path C:\Users\Admin\Downloads\free-mouse-clicker-1.0.6.0-installer.exe
Size 446KB
SHA256 b2b8828bba33755ea4830968e6bae83c3e4d2cd8b9ea6b370570fd6c115028bd
MD5 77652d318a4e61f0a6d76028b75493a3
SHA1 7b7705febecc286e81b3524400cd8459d8e7c7bf
SHA512 8b8ed31798171a2799c9cc8b095d5b592676e8b811597f8f8b626355a1891a1115788d99bf9751be8965cf4454c61988f7639651ff562245192af0a75d380c2a
SSDEEP 12288:ViSF6ddmV2Q7lzwCH+vUTOwEeNkJMR3smUW8yP7v:d6dd0zJZxhEkkJG8cPz
TLSH
T126A4DF5232540885D4F9417D558AFCB3ECA5FE33C3AC0483A6CC7F3B7871AD849A56AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\icarus.exe
Size 9.3MB
SHA256 48bd9a443922dbb3115b502e274d04a52093452ae1893b994d2f069b75a4b8e3
MD5 e9de3472b63f6b1feebdc0158d785368
SHA1 c7a09f82285ee44837ae4d1fc2d315bb4f8997f1
SHA512 1aae253e12e0723291f4070d5638fd992927da72423cc5c9f99d56495b132c179bae7930376dc80265636ba22d71cb3bc4b109afd5a33e370dd9dab572cbb496
SSDEEP 98304:v/GbIjdIM5fQyjRVa0dHGnkpIw7N23YhHtXM:v/GkjdIWfFPPHGnkpIw7N23YhHtXM
TLSH
T1A8A66C1EBA6D01E5C1FEE1788A47641BEE717C95033996DB66E08D461F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\icarus_mod.dll
Size 16KB
SHA256 450267277b701624056ce7e2c106bca2d6a7540c346c1bdbb0cf0cde3bb044e3
MD5 8bda40f35eb88e50d52a776d74b33b0e
SHA1 e3964c8e39125c68d1d941f418f14e138366ff05
SHA512 667b3ee3e4c374550b55af4c8fe167532ce7b50485a74e6df7cb23816add400c8a1d310c435a939dabe1722cef57f669dd8793a8fb00595f93aa6e720d481aae
SSDEEP 192:3DSfyQYbG0TJqx/ql3pPIKfhig1/C59jq7Ggfv5jMdPf43x++Xa21R1bRpzIQ:3D+OGGAa3pwKNsZqnv9Mwx7bLRRFH
TLSH
T18F724A473F302582EFC78D74A4D88BA7AD7073A1AF5548D61574819CADA4BC23A7812F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\product-def.xml
Size 2.2MB
SHA256 7f3013ef6908be0fa291371582144b0d2eec0afe90a683ba96e352384341946e
MD5 91f66f8220d3f8b0792b03715602f5cc
SHA1 f0d26cefd389b5492463cef1a2fc6b97dcdb9514
SHA512 d34c3c6bdff4e5e8687a01a49a9aa4f986ea8749bb69d086d1a1a3251ea34521b1efd4015aa6163abdeada84aff81f7e94e76e0f3132ba5a90d945aee2651c46
SSDEEP 24576:VpmyL0k5X+Biz9w5bfe1XZoap/6M6nHKjT00NRtlMIeg:WywkBhSeG0D2g
TLSH
T124B55F76359E7C6F714A50FBB480BC80629FDD788DE05C97F1B33240A252EA29E75A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\common\product-info.xml
Size 11KB
SHA256 eca4b91c7356245b6199a0bfe6c0a732d5e84d265c398c7c70cf352f158f25cf
MD5 ef89db6ce3fe81b3555a3d483f2cc26e
SHA1 4d9ef9f9b1583b09cdc75abf4045c62b03f6593f
SHA512 47439ba99a5197892718487f373181478a85fa0e29fd2fa5eabc22091a01d4e8b2fe0aac136d46282b5628e0127c2c05db8b086acf69283ad37f6b55af2c66c3
SSDEEP 192:/xy4KAxEOLSMRmNpB/81fxvaeQc7U8wqOVvN/3cLWG3vV/vG3E1AqldWDjuLsWcR:jKwzmemNjE1wCw8yCj3XWn7Cse4
TLSH
T1B9323275201CFF6B321FA0D3E0D5B59121AFFC1D8F942C27E1273640A2AF568B906975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epps.edat

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\epps.edat
Size 80B
SHA256 c6528b50bbe1265eeb1beb88535e7f6257075daaa245ed693e9ac38511b297bf
MD5 5438e42d44c84deaf1c0d2ff11760e49
SHA1 87a6d26a9a158a169f2808ea1702daa188865498
SHA512 ff1f32e2379a4f6d0b642d31baaf558090dbe2ed6031f88f25438d0100f89651cea3af3690dbef151f3c3fce0582d0fbf5b85b7392ad7a885815d957cd8041a5
TLSH
T195A00188D40182F320A0D20073889187301A00C45E49318D79FAF94A2389B8B9AA84E0
MD5 SHA1 SHA512 TLSH

Submit Download

giet.edat

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\giet.edat
Size 8B
SHA256 c2cb92b00918d830aa68e4d5496ca412e3bc86f88444cb3de9d52e62a877b93f
MD5 faeee7fa0a7dd54b32eb730697448ac2
SHA1 85314fe3f7a2a838afb9b5ae64f00577cdaeb664
SHA512 1640cb35c92e0214808fe14ca3658549a927817195bb16b82f87bb3cf2e7e6e623bf04f42147ee97c66a52fbb11a55f253688d5a8363f3a836044e65b21d5b3a
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-ee7490aa-0554-48e7-a341-3483aaa42967\icarus-info.xml
Size 2KB
SHA256 520972000df34fa628a9427860791b114735f57251b5fd1f15b537efe68e56a6
MD5 40f1cda559c79d86fd1c8ee48a3310cb
SHA1 41b0a4d54d4d87c83206ae38ba7660888627fd1d
SHA512 23d0652fd496d8b9512e04e1b8cc7d5b36efb9da1b60a2722c7ca79fbd25d232060f5b2db779bb9c81d82836f034954c321e558fb4d26633ec51b7bf1c4aa410
TLSH
T1CA515EBDA03D9E2B372AA9EFF184F8C527EFBD519B90496341077086DC6B4F02985064
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3032-26-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-5-0x0000000001290000-0x0000000001291000-memory.dmp

Download

memory/3032-70-0x0000000000430000-0x0000000000866000-memory.dmp

Download

memory/3032-35-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-33-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-34-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-113-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-32-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-125-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-9-0x0000000001290000-0x0000000001291000-memory.dmp

Download

memory/3032-28-0x0000000000430000-0x0000000000866000-memory.dmp

Download

memory/3032-25-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-177-0x0000000000430000-0x0000000000866000-memory.dmp

Download

memory/3032-21-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-20-0x00000000033A0000-0x00000000034E0000-memory.dmp

Download

memory/3032-15-0x0000000000430000-0x0000000000866000-memory.dmp

Download

memory/3032-8-0x0000000000430000-0x0000000000866000-memory.dmp

Download

memory/3512-7-0x0000000000710000-0x00000000007EC000-memory.dmp

Download

memory/3512-0-0x0000000000710000-0x00000000007EC000-memory.dmp

Download