f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupAuto.exe
Size 512KB
Sample261014-nbwrkab151
SHA256 f552d818f17841efb7f06803ecd2479fe5c9b2a0d3c4dad2c9d90b42e2e9d7d5
MD5 ff0198fd1f59b71c1deec34b6b0b0c07
SHA1 cae622ad91a3bab0996589e3bf905c9d4eeb6059
SHA512 96795276eefcde81b0ad4ac85f4aaec368cb93bd9e9912c343316912f1502f3a22d845af3ba75ea5aa92b1936028558d48c11a77d331d49bd77f58b886868ccc
SSDEEP 12288:Qnm2P17YuUAlhZk4ZN5lviET7MacVdekBCaeKOKEZQM7gM7ZQN:Qnh17YuUAlh+S5ZdT7sbekOKEZQM717M
TLSH
T199B423181BE1986BE9F722B0206567B9D3FFAE49521C19074B942FD11B228ABCC0797D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "C:\\Users\\Admin\\AppData\\Roaming\\2YourFace\\bho.dll"	SetupAuto.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\NoExplorer = "1"	SetupAuto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupAuto.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "2YourFace Addon"	SetupAuto.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\2YourFace\\bho.dll"	SetupAuto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ThreadingModel = "Apartment"	SetupAuto.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe
5532	SetupAuto.exe

C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe
"C:\Users\Admin\AppData\Local\Temp\SetupAuto.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd716E.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd716E.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd716E.tmp\ioSpecial.ini
Size 707B
SHA256 bd72d09ffa0a19b7cb1369383e5e0de974ab60e15433c988cf6cf5c7865ba486
MD5 0ffadea219de3481c46549bd48ad8a43
SHA1 2ff5cd74eb00a39876c9adfc60cdc0d1d5c29e28
SHA512 da9285c8541382e15e48a54f58dc8d47075c34f1f453e622c137ac5d2e28ea5e91ede4824f84efe2f734f72af44687fee9cb61d031ef3debb9c02ae40bd424e9
TLSH
T17A017088841F93694420549664FA37919BE01D2C4B153DF6F0628887934DDD38AEADD2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd716E.tmp\ioSpecial.ini
Size 694B
SHA256 fd5cbfaeb366f300f150b20183b41e44f18efd950e5930535603a27770760273
MD5 c770a0cc6c4e02feaeb4b6210ade8822
SHA1 421252190014bc53754801b1147916fc81ca3e6a
SHA512 d7f21cbbbf8c61d3a413d114335ad7d5ec783f6493b8541e1a4888b1a73dbe2aa15a49ed9f9247b730f45588693814ca9f0ed49bed636bbf5762ea68434b0621
TLSH
T1CA019488841FD3694420549664FE37919BE01D2C4B113DF6F0628886934DDD38AEADD2
MD5 SHA1 SHA512 TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd716E.tmp\nsProcess.dll
Size 4KB
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
TLSH
T10E91D77693D440B2D186093255A31AA31BEDC536035B590EAF835E937F90DFBECB9322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download