21370cb2a5f5f29fdf7808fde2846b1125ebc2cb251aa6486382ed803a1bfe28

Analysis

user interaction
yes
max time kernel
107s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
universal-simlock-remover-1.0-installer.exe
Size 2.0MB
Sample260804-ym23tsw1et
SHA256 21370cb2a5f5f29fdf7808fde2846b1125ebc2cb251aa6486382ed803a1bfe28
MD5 a37d390b48d080a200c8cee26b58215e
SHA1 d2bffc9ad3c6bbbc876de3c17f843a48f065db24
SHA512 c03e0fae505ef85eb7fde98a02c42e05c2b1233ea3e0a1c13b215cff06379cc6f204ac40898ef45ae7a1632966b83dd2fad5d3934f5d765e7bee167a2350abde
SSDEEP 49152:yuI2h0919WRHcTeynRkfg7ve+AhrWzOU2:y5O0919WR8zaQe+UrEOU2
TLSH
T182A5D03FB28B653EE06E5A3A7A72E110583B7A6165138C5696F4C88CCF254701E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery installer persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	2020	installer.exe

Executes dropped EXE 9 IoCs

pid	Process
4220	universal-simlock-remover-1.0-installer.tmp
2540	cookie_mmm_irs_ppi_008_585.exe
1436	OperaSetup.exe
2020	installer.exe
5124	installer.exe
4508	installer.exe
3352	installer.exe
940	installer.exe
5564	icarus.exe

Loads dropped DLL 1 IoCs

pid	Process
2540	cookie_mmm_irs_ppi_008_585.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks for any installed AV software in registry 1 TTPs 10 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\AVG\AV\Dir	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\AVAST Software\Avast	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\SOFTWARE\Avast Software\Avast	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	universal-simlock-remover-1.0-installer.tmp

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	cookie_mmm_irs_ppi_008_585.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4252	4220	WerFault.exe	89
2328	4220	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie_mmm_irs_ppi_008_585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	universal-simlock-remover-1.0-installer.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3336-1-0x0000000000D00000-0x0000000000DDC000-memory.dmp	innosetup
behavioral2/memory/3336-12-0x0000000000D00000-0x0000000000DDC000-memory.dmp	innosetup
behavioral2/memory/3336-208-0x0000000000D00000-0x0000000000DDC000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	universal-simlock-remover-1.0-installer.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	universal-simlock-remover-1.0-installer.tmp

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "0EC03442A4E93B807782D73BF46C389D"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAbYTwqJ6T0UG83fUxcZpurgQAAAACAAAAAAAQZgAAAAEAACAAAADYIF5ezl9Qvs5EHv64S7d1SV1/WuzKlqtsS/rQpTi1egAAAAAOgAAAAAIAACAAAACoPIiC1ZbwcEXeNmNhB4nyXm/loUEP3wMixHa6QWhnbYAAAABAHTsamx0BVMGZbej6kCeDCgk7Jf8T+dse4Il0f6ajq2U+CFoIFlxWNvOe75LRuVdKShKaIYw8/p3LZvDnCVhkp5TevRhS9fdCXqTWuuQkOWTEZYie654pAA/gk15ELwj7k41P5CQocZEW3Pa1FdDL5pnjUyZ53TIERvQ37yd/REAAAABV9IE2Q0aqs0FPSgx32pBtgtNQHX0c8ElAWc4rZhe5iRm+88UbEg2YsFOcpepE6tGPhBfV2CEXsHs+Oz7eOVHl"	cookie_mmm_irs_ppi_008_585.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "c2c72a07-e866-4807-8857-1458e776b77d"	cookie_mmm_irs_ppi_008_585.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	universal-simlock-remover-1.0-installer.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp
4220	universal-simlock-remover-1.0-installer.tmp

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	5564	icarus.exe
Token: SeTakeOwnershipPrivilege	5564	icarus.exe
Token: SeRestorePrivilege	5564	icarus.exe
Token: SeTakeOwnershipPrivilege	5564	icarus.exe
Token: SeRestorePrivilege	5564	icarus.exe
Token: SeTakeOwnershipPrivilege	5564	icarus.exe
Token: SeRestorePrivilege	5564	icarus.exe
Token: SeTakeOwnershipPrivilege	5564	icarus.exe
Token: SeDebugPrivilege	5564	icarus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4220	universal-simlock-remover-1.0-installer.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4220	3336	universal-simlock-remover-1.0-installer.exe	89
PID 4220 wrote to memory of 2540	4220	universal-simlock-remover-1.0-installer.tmp	91
PID 4220 wrote to memory of 1436	4220	universal-simlock-remover-1.0-installer.tmp	93
PID 1436 wrote to memory of 2020	1436	OperaSetup.exe	94
PID 2020 wrote to memory of 5124	2020	installer.exe	95
PID 2020 wrote to memory of 4508	2020	installer.exe	96
PID 2020 wrote to memory of 3352	2020	installer.exe	97
PID 3352 wrote to memory of 940	3352	installer.exe	98
PID 2540 wrote to memory of 5564	2540	cookie_mmm_irs_ppi_008_585.exe	99

C:\Users\Admin\AppData\Local\Temp\universal-simlock-remover-1.0-installer.exe
"C:\Users\Admin\AppData\Local\Temp\universal-simlock-remover-1.0-installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\is-27R4XEVR5X.tmp\universal-simlock-remover-1.0-installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-27R4XEVR5X.tmp\universal-simlock-remover-1.0-installer.tmp" /SL5="$701F0,848247,840704,C:\Users\Admin\AppData\Local\Temp\universal-simlock-remover-1.0-installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe
    "C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdEUMOgFSl8C94qnrdx1B9OmBbjRF0TaXAhhnYt2EGWg2GEHTjOrHwvOAwTeOH1lUfGwvQ0wiXHXE /cookie:mmm_irs_ppi_008_585_a
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\icarus.exe
      C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\icarus-info.xml /install /silent /ws /psh:agiSfNdEUMOgFSl8C94qnrdx1B9OmBbjRF0TaXAhhnYt2EGWg2GEHTjOrHwvOAwTeOH1lUfGwvQ0wiXHXE /cookie:mmm_irs_ppi_008_585_a
      4⤵
      Executes dropped EXE
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component1_extract\OperaSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdEUMOgFSl8C94qoX7MFASp8FaxgZUB1u10psHvXlk2AQhhQYayZpIjDCgybibsHQg7tdCqS5UWOi
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdEUMOgFSl8C94qoX7MFASp8FaxgZUB1u10psHvXlk2AQhhQYayZpIjDCgybibsHQg7tdCqS5UWOi --server-tracking-blob=OTcwNzlkMDQzMzM4YTkxYzhkNzZjZTJjMzIzMTk0YWYzMzlhZDlmMDk3M2IxNzYzZDJlYTU3MjVkNWI2MjEyODp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3ODU0OTU2MTQuOTcyOSIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiMWNhMjllMGMtMGViNi00ODM1LThiN2UtZjRjNjQyYjM3ZmJkIn0=
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff60fbd9d88,0x7ff60fbd9d94,0x7ff60fbd9da0
        5⤵
        Executes dropped EXE
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\.opera\b673cf29-a065-49bc-ab5e-2cb499cc5e24 Opera Installer Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\b673cf29-a065-49bc-ab5e-2cb499cc5e24 Opera Installer Temp\installer.exe" --version
        5⤵
        Executes dropped EXE
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2020 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\b673cf29-a065-49bc-ab5e-2cb499cc5e24 Opera Installer Temp\opera_package_20260804205606" --session-guid=92d946a8-290b-49bb-9688-6b66b3833816 --server-tracking-blob=M2NlMTg3ZmZmMzM5NDA3NDk1ZDUzMjkzZWUxYjI1ZTI3ZTcxMDQxOTYwZTViNGI0NTE2ZjY3YmU5ZjZmYmE4MDp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4NTQ5NTYxNC45NzI5IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmRFVU1PZ0ZTbDhDOTRxb1g3TUZBU3A4RmF4Z1pVQjF1MTBwc0h2WGxrMkFRaGhRWWF5WnBJakRDZ3liaWJzSFFnN3RkQ3FTNVVXT2kiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6IjFjYTI5ZTBjLTBlYjYtNDgzNS04YjdlLWY0YzY0MmIzN2ZiZCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3009000000000000
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2ac,0x2b0,0x2c0,0x288,0x2c4,0x7ff60fbd9d88,0x7ff60fbd9d94,0x7ff60fbd9da0
        6⤵
        Executes dropped EXE
        
        PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 948
    3⤵
    - Program crash
    PID:4252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 948
    3⤵
    - Program crash
    PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4220 -ip 4220
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4220 -ip 4220
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sfx.log

Path C:\ProgramData\Avast Software\Icarus\Logs\sfx.log
Size 11KB
SHA256 3852089962091a27b340620de6e752c7e496535cf61758f72e7c2ac0fec8bf04
MD5 7c7021661f940a698c643bce8c5fa67a
SHA1 f1b6f55803ca46f01a6a36629f0779450ee8be71
SHA512 edae3e43cb7ace6c01c3b9f8173d7b9c44d31e6017d4cf82031087553aa6ad70d4cbc00492eb587888b8894690d945eb61fff4b7a8eb0d1f4f0f79f278661860
SSDEEP 192:AKptWFh4gtcef1nprrtce81hIijvWBpzXlST7hiFs0Xtcel1Lg:AutMDtcKxprrtclXIijvgpzVST70NtcN
TLSH
T1BA425180492EB5F26B171B15F190AB9C3B70F605AECC0639749E796CF7A6C13C50B92E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC955A42A\installer.exe
Size 8.3MB
SHA256 49d33a257c47d2e32cbb967ef1c088c0ff5d71ced60950d902c9aa82311e306c
MD5 d9534337f6a0f2c96b59dc571e694474
SHA1 6e706ab155031e936ff35eff549d51b815c4de5b
SHA512 becf6953874c49d217482a211ed9fd50e3075506390d4f1c33ea88665fe529f4c8e9fbad6057dc63f3ec546171886f98de6ce8ba13b906b96a9ffce012c846fb
SSDEEP 98304:ZhLx1oEDfLTV7fi0obDaW6oTTOFO7g53QxheYNY8AFk:jLx1oKLTV7fYeDQxgXFk
TLSH
T1D9967C53F2A601E8D06FCA748B7A5232A9757C465B30A3EF0A943A251E75FD45F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

universal-simlock-remover-1.0-installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-27R4XEVR5X.tmp\universal-simlock-remover-1.0-installer.tmp
Size 4.1MB
SHA256 3a62ae0d102cff66fba0a1f0b9bcdf116ad369c3c4f0212eb21a53c766c75a7d
MD5 fa1c977a4003cc0793201a6f1711bb6d
SHA1 99687859fe21ab2c851da864ba0c90d72862ca57
SHA512 3fdd7887b940c005f54535e3d229d0c2f456bd9b2d28acc399c92078ec45adc334e065faa212d08fbd9495224b1767b18b1bde59150a32415df27d9727f59959
SSDEEP 98304:fYU5hnuOajWwMPdCpepI3GrwrA+Jz333E:JxuHjWfZIzc
TLSH
T1F5168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

100.png

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\100.png
Size 42KB
SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
MD5 faff96fb8080a98bd1def3c4f9cce9c1
SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
TLSH
T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

101.png

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\101.png
Size 51KB
SHA256 3f63f320e919830fb21fff8dbd82509ecc8330c89513163daedb1b7687a0a529
MD5 958233a25ac0c23fae9451963eca0de5
SHA1 8801e6dca9e4e4ad1f5b49caa097733877cf2e2e
SHA512 996177a1a878ca82c1ce02f8937f51285aa9b7c92471fe9c19b41892739e82aaaa7ebcb7f396d6d777da822578b1db1fea893ed55708521e4b8e31a81cacda0b
SSDEEP 1536:l7LeXprR91MWpD5Ko2ORwQWwyJUcbWb7H:ApzWTo2ORohKPH
TLSH
T1E33302A0B153C51FBA8B5211D2043975776E92F6F860FF4873CA016CAEE5D415B173CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUCCESS.png

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\SUCCESS.png
Size 1KB
SHA256 2b394e114deb3a0700c70feb80d74328c4c8668aa221b0e427de783d1ab8371e
MD5 e8c9048faf21f1cc959d73a0de5534fd
SHA1 9c27462a55fa51788102f7102614927a5561ddca
SHA512 87f26c7ccdf3e4ff4d2008504d43eecc5f563f91e22eaf7a85530c41b741253ec648ab7a7c1bfcc608336b2b87df666bab14d4a31df221a111d0e1819c6232fc
TLSH
T16D21426BDB812D97C19922382BF28B40FB3011E14712035744273970C4E8B893F0960E
MD5 SHA1 SHA512 TLSH

Submit Download

component0.zip

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component0.zip
Size 782KB
SHA256 4a59596213b8e401401fad6249213596400943f72f98d8810c48538374137f52
MD5 2c7be73f369c90ce32bbf5b6edcd9cd4
SHA1 aabd8f656ea80ea72dd17f2819fbee64e6f4b560
SHA512 312502f64439a7debfee5b47197e481eab490604803bd07eda5fa3d1a1e8e7de3e6e687693932ee5aee85e56ee059b790a7f47a3754f6818e14fa1cf6a0a7815
SSDEEP 12288:YV/ZeZ0C6U6lQzc2+KcqaYTmydhmdfLNz+g5WOcmpMi2VWmSKAf+4l:g/MZ0RTv2hnKydhEz0OcoMiCWNfj
TLSH
T1FA053380AE40F676EB81CA213FA7E5DF35538D923BC1797D61548088322DB6EF5CB258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_mmm_irs_ppi_008_585.exe

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component0_extract\cookie_mmm_irs_ppi_008_585.exe
Size 1.7MB
SHA256 2ab4329fb77df9f5b70ac45d9fc005f019c8ef930eabf82e6a10052f9cbeec2d
MD5 11a225495371d91ef254a5c69c967ea6
SHA1 ab136cbac42cc54a6aa15f7eb43eec1c6647dc74
SHA512 5012d9fbc9401b5c5a377f100560c637adc98d319749bb599a0a0487417915f647032430ef027c69cf1a8fecc2d63a741f1aaec71611dcf292db109a35c45023
SSDEEP 24576:tuRu5fl3AFG8CWgd3jEDigqqP9WhavTXeS0h0lhSMXlOncOy9x6mWFI/RV:bJlQU8CJjqF0wuS5icLxxWe
TLSH
T198859E207B42C07AD49A01B1992CBBAAC16DAE744F6550DB73F03F2D6D711C22B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

component1.zip

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component1.zip
Size 3.1MB
SHA256 a805e97cab649c94c40869299cd0a39e617e44bb2a1e726c40a0de907ba987bd
MD5 1afda37478a70e76c7db3740141756a4
SHA1 b656f8c2da3514e19f1558690725bf1a4fe5414a
SHA512 f1d3c1991d21fcdeb5d43803d0eba983b85ccfe263ada50c024b99253176c779141ec3778b125fb6396a383ffc296345d21cd2c66dbe94c13b8c0a60e40e56b3
SSDEEP 49152:IVAbwtDkQC3x3XyayaN+KYUkAjHMZ/buhf0R8sx/ggeOV2MsAwZu8DbALMKMeVPq:EAYgh3XyFaN+QiOy/ggJl3w0PLTL+n
TLSH
T12CE5231237448475C67312320F15E7A8A5BDF9652F72878733A47A5FCEF05C2AA26B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperaSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\component1_extract\OperaSetup.exe
Size 3.1MB
SHA256 234c787537b06446ec215fa072c524a4a2c49291c76040ec5ef45d457db89d16
MD5 f839db26159301a6a0cf18b7c422c2a7
SHA1 82d17a58136301554d41c20a85d6824a05c8e47e
SHA512 428f1eb89ae7d39f63fa5063dcbe7a299d1a4597f5322ad2b389231a105cc9d5462380a71e3b350bd49a16a2a9d8d4d07ccb2ec7be170ff1d4c3ed123f5176a3
SSDEEP 49152:vVAbwtDkQC3x3XyayaN+KYUkAjHMZ/buhf0R8sx/ggeOV2MsAwZu8DbALMKMeVPB:tAYgh3XyFaN+QiOy/ggJl3w0PLTL+4
TLSH
T1AFE5231237448475C67312320F15E7A8A5BDF9652F72878733A47A5FCEF0582AA26B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Users\Admin\AppData\Local\Temp\is-988VAWK57K.tmp\image.png
Size 67KB
SHA256 d3a3e4b0fba9357c49acc746f06845b246f2ee3405459ee0c472761c3ecbfd06
MD5 d6500e7fbc90eea8dfaf47b0f0a76cb3
SHA1 40e2072cd4026ee9b288ea3255ec53a7c282a17e
SHA512 5f754a887d919d2ea4e0c316d7b2ff708ad0e44c92322924a69ad912ce70698f37fcce2bf1bbe1b07a95989711f465d4e24b1f17f10328e09a1f8adfff672576
SSDEEP 1536:/ClmHfy2YvGyTy2wBgQLu3AWVfjotD+h6XlrW:/kmHfjvSwW5jONXk
TLSH
T1476302AB6651D373FBC4C133560131AF57322A81518256F86294ED8BE0CBD096EEBEC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 74e23041f78ec59e48404ba5231760a989df6b895a146400ef9485be7a564f7b
MD5 c01160493f79d182a9d5f94655136d75
SHA1 c2480504ea0df9377985d0488802fc54dfdf6d46
SHA512 d08ab47b1df643c99d7545addda39516defcfe0651ed689dee618a5f7cb5e03f9799f93ad8b211a2e095efb23c65aa87dda2a5afef830979963aef39db7b3f44
MD5 SHA1 SHA512

Submit Download

icarus.exe

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\icarus.exe
Size 9.3MB
SHA256 48bd9a443922dbb3115b502e274d04a52093452ae1893b994d2f069b75a4b8e3
MD5 e9de3472b63f6b1feebdc0158d785368
SHA1 c7a09f82285ee44837ae4d1fc2d315bb4f8997f1
SHA512 1aae253e12e0723291f4070d5638fd992927da72423cc5c9f99d56495b132c179bae7930376dc80265636ba22d71cb3bc4b109afd5a33e370dd9dab572cbb496
SSDEEP 98304:v/GbIjdIM5fQyjRVa0dHGnkpIw7N23YhHtXM:v/GkjdIWfFPPHGnkpIw7N23YhHtXM
TLSH
T1A8A66C1EBA6D01E5C1FEE1788A47641BEE717C95033996DB66E08D461F23AF09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icarus_mod.dll

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\icarus_mod.dll
Size 16KB
SHA256 450267277b701624056ce7e2c106bca2d6a7540c346c1bdbb0cf0cde3bb044e3
MD5 8bda40f35eb88e50d52a776d74b33b0e
SHA1 e3964c8e39125c68d1d941f418f14e138366ff05
SHA512 667b3ee3e4c374550b55af4c8fe167532ce7b50485a74e6df7cb23816add400c8a1d310c435a939dabe1722cef57f669dd8793a8fb00595f93aa6e720d481aae
SSDEEP 192:3DSfyQYbG0TJqx/ql3pPIKfhig1/C59jq7Ggfv5jMdPf43x++Xa21R1bRpzIQ:3D+OGGAa3pwKNsZqnv9Mwx7bLRRFH
TLSH
T18F724A473F302582EFC78D74A4D88BA7AD7073A1AF5548D61574819CADA4BC23A7812F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-def.xml

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\product-def.xml
Size 2.2MB
SHA256 7f3013ef6908be0fa291371582144b0d2eec0afe90a683ba96e352384341946e
MD5 91f66f8220d3f8b0792b03715602f5cc
SHA1 f0d26cefd389b5492463cef1a2fc6b97dcdb9514
SHA512 d34c3c6bdff4e5e8687a01a49a9aa4f986ea8749bb69d086d1a1a3251ea34521b1efd4015aa6163abdeada84aff81f7e94e76e0f3132ba5a90d945aee2651c46
SSDEEP 24576:VpmyL0k5X+Biz9w5bfe1XZoap/6M6nHKjT00NRtlMIeg:WywkBhSeG0D2g
TLSH
T124B55F76359E7C6F714A50FBB480BC80629FDD788DE05C97F1B33240A252EA29E75A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

product-info.xml

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\common\product-info.xml
Size 11KB
SHA256 eca4b91c7356245b6199a0bfe6c0a732d5e84d265c398c7c70cf352f158f25cf
MD5 ef89db6ce3fe81b3555a3d483f2cc26e
SHA1 4d9ef9f9b1583b09cdc75abf4045c62b03f6593f
SHA512 47439ba99a5197892718487f373181478a85fa0e29fd2fa5eabc22091a01d4e8b2fe0aac136d46282b5628e0127c2c05db8b086acf69283ad37f6b55af2c66c3
SSDEEP 192:/xy4KAxEOLSMRmNpB/81fxvaeQc7U8wqOVvN/3cLWG3vV/vG3E1AqldWDjuLsWcR:jKwzmemNjE1wCw8yCj3XWn7Cse4
TLSH
T1B9323275201CFF6B321FA0D3E0D5B59121AFFC1D8F942C27E1273640A2AF568B906975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epps.edat

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\epps.edat
Size 80B
SHA256 c6528b50bbe1265eeb1beb88535e7f6257075daaa245ed693e9ac38511b297bf
MD5 5438e42d44c84deaf1c0d2ff11760e49
SHA1 87a6d26a9a158a169f2808ea1702daa188865498
SHA512 ff1f32e2379a4f6d0b642d31baaf558090dbe2ed6031f88f25438d0100f89651cea3af3690dbef151f3c3fce0582d0fbf5b85b7392ad7a885815d957cd8041a5
TLSH
T195A00188D40182F320A0D20073889187301A00C45E49318D79FAF94A2389B8B9AA84E0
MD5 SHA1 SHA512 TLSH

Submit Download

giet.edat

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\giet.edat
Size 8B
SHA256 c2cb92b00918d830aa68e4d5496ca412e3bc86f88444cb3de9d52e62a877b93f
MD5 faeee7fa0a7dd54b32eb730697448ac2
SHA1 85314fe3f7a2a838afb9b5ae64f00577cdaeb664
SHA512 1640cb35c92e0214808fe14ca3658549a927817195bb16b82f87bb3cf2e7e6e623bf04f42147ee97c66a52fbb11a55f253688d5a8363f3a836044e65b21d5b3a
MD5 SHA1 SHA512

Submit Download

icarus-info.xml

Path C:\Windows\Temp\asw-b0d3f242-26e8-4f57-8697-ae5c96a06e39\icarus-info.xml
Size 2KB
SHA256 e6bae4558a45d9ec75708d72436f1b46f2314d8569c9d93bbecd54e238f93383
MD5 75230ab73351495098db4cb3d082659f
SHA1 a1b520a805aa59306d6e58f5b85df278fd493fa7
SHA512 7f074eda105f4a13c39253b9c379e0b99bfda8f28126fbd3dc7bb5a2dad44aed5f548b6f53f9bcecf06967cdfccb270ceb1e260c202a562e93453ef8ccb26d63
TLSH
T1555142B8A13D9E1A772A99EFF2C4F8C067EFBD558BD4096341077091DC6A5F02941074
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3336-1-0x0000000000D00000-0x0000000000DDC000-memory.dmp

Download

memory/3336-12-0x0000000000D00000-0x0000000000DDC000-memory.dmp

Download

memory/3336-208-0x0000000000D00000-0x0000000000DDC000-memory.dmp

Download

memory/4220-28-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-49-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-47-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-44-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-40-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-140-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-38-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-159-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-37-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-36-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-31-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-32-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-29-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-22-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-23-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-14-0x00000000010D0000-0x00000000010D1000-memory.dmp

Download

memory/4220-13-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-206-0x0000000000290000-0x00000000006C6000-memory.dmp

Download

memory/4220-207-0x0000000005DB0000-0x0000000005EF0000-memory.dmp

Download

memory/4220-6-0x00000000010D0000-0x00000000010D1000-memory.dmp

Download