d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8.exe
Size 1.5MB
Sample260828-j2cddscc58
SHA256 d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8
MD5 2d72cc3df54a86f74670f1e183025551
SHA1 4816feb74eaff05e9c3446936e55943a2a0e7c0d
SHA512 b7f1ca8f54d64a6154f139584e154cf8f05eb05c589b8880c9957d14d660d7bb720f6ae5b1b418e52d7ecb538371a9bcf3f6face98f17609d3ffc79c7adcd06b
SSDEEP 49152:rN2oAjMgSkKr4ml0sJZk+fOZxVhNdOnyq2D3:rNoM/kq4a0sJm0ObPOnyqC3
TLSH
T128752200F620D239D8F3013959F9967504A8BE51CB6969EB77C86F0D4BBA1E1BB30367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
4620	uh.exe

Loads dropped DLL 3 IoCs

pid	Process
4620	uh.exe
3848	regsvr32.exe
4900	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hajdbldhghecdpmkgnhnnngmcpgnaomd\1.0\manifest.json	uh.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ = "SearchNewTab"	uh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\NoExplorer = "1"	uh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ = "SearchNewTab"	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SearchNewTab\1.x64.dll	uh.exe
File created	C:\Program Files (x86)\SearchNewTab\1.dll	uh.exe
File opened for modification	C:\Program Files (x86)\SearchNewTab\1.dll	uh.exe
File created	C:\Program Files (x86)\SearchNewTab\1.tlb	uh.exe
File opened for modification	C:\Program Files (x86)\SearchNewTab\1.tlb	uh.exe
File created	C:\Program Files (x86)\SearchNewTab\1.dat	uh.exe
File opened for modification	C:\Program Files (x86)\SearchNewTab\1.dat	uh.exe
File created	C:\Program Files (x86)\SearchNewTab\1.x64.dll	uh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	uh.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	uh.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	uh.exe
Key deleted	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	uh.exe
Key deleted	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ProgID\ = "SearchNewTab.1.0"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ProgID	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\VersionIndependentProgID\ = "SearchNewTab"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32\ = "C:\\Program Files (x86)\\SearchNewTab\\1.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID\ = "{2A2B359B-A60B-1B0B-56C8-929110C21AD7}"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer\ = "SearchNewTab.1.0"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\VersionIndependentProgID\ = "SearchNewTab"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SearchNewTab"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	uh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32	uh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\VersionIndependentProgID	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ProgID\ = "SearchNewTab.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\ = "SearchNewTab"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\Program Files (x86)\\SearchNewTab\\1.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID\ = "{2A2B359B-A60B-1B0B-56C8-929110C21AD7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID\ = "{2A2B359B-A60B-1B0B-56C8-929110C21AD7}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32\ = "C:\\Program Files (x86)\\SearchNewTab\\1.dll"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SearchNewTab\\1.tlb"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer\ = "SearchNewTab.1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\Programmable	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	uh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}\InprocServer32	uh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7}	uh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	uh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4620	904	d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8.exe	86
PID 4620 wrote to memory of 3848	4620	uh.exe	87
PID 3848 wrote to memory of 4900	3848	regsvr32.exe	88

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{2A2B359B-A60B-1B0B-56C8-929110C21AD7} = "1"	uh.exe

C:\Users\Admin\AppData\Local\Temp\d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8.exe
"C:\Users\Admin\AppData\Local\Temp\d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\00294823\uh.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/uh.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4620
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\SearchNewTab\1.x64.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\SearchNewTab\1.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\1.dll
Size 416KB
SHA256 e23b94a809d4306dce3c0fb5a7dc76ad25e133cb74daa489629419ba1d849ebe
MD5 b5e8219112f5de28e71487fd8c367b8f
SHA1 cc60f4497ee2328e43e89474c412d75a90be2e1b
SHA512 d4dd2a41ab9c17125263824f3f4b5c6f3a5f8dc7c78adc298391a6a18b495a521388e2c8524c5050b7452df89d048a12b014e711fef7e4ed8b439d8959a7357d
SSDEEP 6144:9/c93WBQEoIK6lNS1huqSFeACGcW6kbO36JDWZA+VbfDKHAN2xq:9/c93WBLKUvbhBukbrbqb+gAxq
TLSH
T1F4944A00F281C138E4BB11B67B7D96956428BE720B6988C7B3C86E5F5D709D36B30B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.tlb

Path C:\Users\Admin\AppData\Local\Temp\00294823\1.tlb
Size 3KB
SHA256 2e46c45652d03653c407468ca871f4e910b4cec36af85853e2bd06f3fb7ad4ae
MD5 8d1f5f85eefb09e07c0f1357289b7251
SHA1 f9e39ac9d8e978d8fe834c527a6160eb58392e77
SHA512 df483e23bf19f90b07cf70d5e4bf7a26ece3bea39cc78b0dd652d179890000ec2c603841f5354e27676f60055094e13749ad6fc11dcf56aa8be32a8a7d916fd7
TLSH
T147817B4AFB91CB63C4A941315D6ED3E91670FC198E116B03332A332E6D727897F224A0
MD5 SHA1 SHA512 TLSH

Submit Download

1.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\1.x64.dll
Size 463KB
SHA256 5b9f026657796490c626a88c1b7533fc23a1ee92b4bad819f4d0940e18d0c7ae
MD5 51869d78edfbeb04d0805522d9232518
SHA1 4c1a736dbf800b83580265a6c6ae2ebd13e0b3cc
SHA512 9f99165b2c27df5f43131d857340aeb197d24b00a7176943c98f9b45bd7919e4ce002f68c9c1ed03424f42a1ce94ff3968b315cf9f6d2edfba708d86fc2c03fc
SSDEEP 6144:vubh8V1Yg80MDKAjY9HzGSAAbMhj1jT9rtnzkSaTTKPn:vuEa0MDKaY9lAA+TdkSJP
TLSH
T16FA4E746EBB350E8E0B2C53885A3A22AF5727C1587349BDB9341DF6A5F22BD0E53C351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L59.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\L59.js
Size 5KB
SHA256 80f726003731b7c61bb5483d4af448a17bb1a7e6f53b89ce6b320786ae2e982d
MD5 32f927288c9f5de7fb529898a90dc32a
SHA1 2d472e867fa865cf8ee0e130f822ac46b65af04d
SHA512 36281b0773a925eebf457157c8a8954019c51e234ee46505014bd444e6f221c8b7c7ba3f723553f284b0d3aee14ade63b4cea19ed17d5d0fd385e0e64a2f55e3
SSDEEP 96:Zh5LJxjTWgUB+U+/p+nM+m+n+7+h+6p+QWN0wvpjeXY7/aU7HJJ0vOaR:/NKgUB1epmM76ge3pX7qpIY7/aU7m
TLSH
T1E6C1644CB1B3536A41737F120CBF0DA9599660C24F884E65B4ADA2E0AFB4686015FBBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\background.html
Size 140B
SHA256 682639ddd2b3369d8ed6344b94d7a98a7ea58b848dc31db76fb66a73566421e3
MD5 14e6494d4622f9f5f6d3125435d17338
SHA1 c60ff3fdf9eed52bc23f5f6a9a01fd1645dfc5c5
SHA512 7e93c01e9a5e4282e1bf4fda309707aa5d497c87e8416443f0df8af861df5ccbb2bb54653bd932c4c132fc8059f2732c2bdf747467db4e9dc36daaf0db4424a6
TLSH
T1EEC09BD9BD54906CA9503DDC0EF1F25C4C4C8515B8A1CD2819F8343949413BD8C17655
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
TLSH
T142D01227F73D7CECD2293CB9C96A8A0063F30911B912247271F5D6802D74E003559AB5
MD5 SHA1 SHA512 TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
TLSH
T1A4F0AF3A5157233340A76EFFB86A2428A671D702E51C06613E7207803C9839F03A5DDF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\manifest.json
Size 554B
SHA256 d1652678db28a88503ed4a52d8e4fad2160af4a355c5b36738299f5b54294c2d
MD5 1442a9e536e94d6b50798ae27e8d2fce
SHA1 f060dd8cf1f7abaf6d1e4c3ef8110845d803a0ea
SHA512 aadced78ea820eb6ea8157f89da089f10a5f10b0f8b3cf43589acd14e0fc512fc3c338763ca3dbb1781073f094bfb2a9011b6f367a41f73675a63beda17e98c2
TLSH
T179F02B73E840887A22FC9F5165B85243FB22178F64900C4FB53E605C0BB1A7610A1324
MD5 SHA1 SHA512 TLSH

Submit Download

newtab.html

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\newtab.html
Size 374B
SHA256 d26b9dc5e6feeb5f2c2d8232e2fa7b4740ba0a6719c0e28404f72af78af2b4f4
MD5 ee05ab333acf6e5e9655ef16a97fc026
SHA1 ec0d03c17740c8adde90b567e9e3bdc9dcd609ce
SHA512 dcb35f289d968259b988b0c4a835f28770e187dbf52346577a59abc83c7a394a52a9770a26dedd3cd0d76e32f0f7375873e851b81a6c437404f5b87dab9b2efa
TLSH
T1DDE0C0FA1985B01CC521D6E0F8C3B4DCD608E698F3408D20EAB0397E248C51AD446BFC
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\hajdbldhghecdpmkgnhnnngmcpgnaomd\sqlite.js
Size 1KB
SHA256 9deb06307f4ddf27bc2bb6e95fc754861c90845f2c410b6ec10f5ad19ffdecfc
MD5 52148041ec63a17e1677baea74f1c5f6
SHA1 c1a8f32649e0aaf2c98c109b0945bb1c7a91745a
SHA512 c97dda2d5f0b283df02e68c7c46b347fc5349641c940e548039866f7fd210fd6ff9d50a3e8e90c13e64e36ec903c6eebbadef30f97adc8ad3ce6b68b13b4b69b
TLSH
T1BB213A9E7917797300AB7A32603F098E657F6244ED9241F07C7252D05D3962D209ADBC
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
Size 2KB
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030
TLSH
T1D951F14BA5F92410047A3E256B1FA7A535438672398D8E453BA88380FFE0CDBD792DCC
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
Size 96B
SHA256 dc5e7bc5dddccb1a4f3fb37c3e37e9252cc6aea7d134375d407268ea38079b4e
MD5 a1086fb0a9f1591226279d07fa4ea5d8
SHA1 8b40235ee4c738496ef5835cc00fc20f853b4871
SHA512 b73f6c7579b1fdfc03575e72bdc641bc89a2aced6e2db33c7bd812c5e833febfe16d99219617963c211e22384549c814695088378fc3e7093ff7a5288f373fde
TLSH
T140B01231130F056C7BF5CC80104338103E708831C0901011B0D900CC82C0342CDCC758
MD5 SHA1 SHA512 TLSH

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
Size 9KB
SHA256 c1f1dfc85b4d0c706e1852b759a7c3b62d19182ec8ab41029c7d42f810f6d98f
MD5 03b54b8799879dd47f49d9058a65360e
SHA1 b2d908fa38e74d4c032902c71e1636de3e8412f8
SHA512 cc89609639e01c0aa6ebc56f9f5b5d5e8c44afa9d1d8304ca5225a8ed2252af4f93a51bf5c2ffda485f731df68ff6870cd6b8747383cf0ac6cc2b05eaa6deb7c
SSDEEP 192:lo3v4vCemV235UsZkJn7ERhzJ1epmM76ge3pfVqkYTyac7tZ:uvWD6u1ZkJ4PzGwBTyyBz
TLSH
T1CB12C559B2AB162300727B324C7F1D9985EF90C29DCC4955BCB953E09F6468A01AEFFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
Size 604B
SHA256 b52faa0cbca3f9adff96c9e02fa83f1767d73f8bb921b366649c30c30747f5f5
MD5 0d962cf79d79c361031ed0841d78011c
SHA1 ad3f172c8bd26587662249e89155ebd6b0fcc73c
SHA512 550da9bbe527a2074bce37a326e65d431eea1e0528bc6eb3d091392bb860a261f2125ddcbe9f5ffc9ef5daf718199026fb8a696ef325c549c806e3025fb4ffe4
TLSH
T158F0F4198E45AE54E27BCB262C709144B275276E81428088FD9F1E134B9C6EE51B7242
MD5 SHA1 SHA512 TLSH

Submit Download

uh.dat

Path C:\Users\Admin\AppData\Local\Temp\00294823\uh.dat
Size 3KB
SHA256 0971b7eec65c1c12ce69a852c137bd01bde0ea579c52a5745a72cdd3f45fc8d6
MD5 c36ac4da74c83a8d892d98e580209cfe
SHA1 665e84646c25c77950dd4f851ffcc8955efa46d1
SHA512 771b835f24f8b2366acb2a466692145910856db0b0c86ba600ed8278344a97b221c02cb8d09a9a41ec403d723ac1d0f51ebef8e580c23a9d44319551af358973
TLSH
T169815DBA16FC7D0EAE8C9AC87FA70532471F9C70749BF6CE67485882190EA640B67056
MD5 SHA1 SHA512 TLSH

Submit Download

uh.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\uh.exe
Size 482KB
SHA256 bf0a543d607d8c4f6a64ceb3a09488cfd7631191eb2c6ff6db3532ff1d34a62b
MD5 2f21b030acc94619252a33d36dc2694c
SHA1 82c9801ec0d132500bc823defe9aaa1b8679d198
SHA512 27cb565725965634f7ee0b50ec1502cc188273194c4960545d503e91891d59d842d7a1c3f4b3347d501dd2e5ee89af9b148be1c7fbc6df65488a675eb42e030f
SSDEEP 6144:a4Zy2MXj5/9jquOtXilmKb6xS2UFt6XQCKkHzE/m463cHR5PK7NMtNPvdQ:Byn5FIXLS6xnyi5KkHz749Pi+PPvdQ
TLSH
T17DB45A21B3A2E035E4B316B27B2ED36614357E704522846BB7C01E9D39B49D79AB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads