Overview

overview

10

Static

static

http://zahernabelsi....

windows10_x64

10

Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v200217
  • submitted
    21-02-2020 16:51

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://zahernabelsi.com/zahers/

  • Sample

    200221-xk83gt9c5j

Score
10/10
keyloggertrojanstealerspywarehawkeye_rebornevasionransomwarepersistencediscovery

Malware Config

Signatures

  • Modifies service 2 TTPs 161 IoCs
    persistence
  • Checks for installed software on the system 1 TTPs 60 IoCs
    discovery
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Discovering connected drives 3 TTPs 15 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Checks SCSI registry key(s) 3 TTPs 96 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • HawkEye Reborn

    HawkEye Reborn is an enchanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • Drops file in Windows directory 14 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://zahernabelsi.com/zahers/
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Discovering connected drives
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Checks whether UAC is enabled
    PID:3836
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3836 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Discovering connected drives
      • Suspicious use of SetWindowsHookEx
      • Checks whether UAC is enabled
      PID:3868
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W70IXR76\gf8oxriqyniw6zy.msi"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Discovering connected drives
      • Suspicious use of FindShellTrayWindow
      PID:1776
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Modifies service
    • Checks for installed software on the system
    • Suspicious use of AdjustPrivilegeToken
    • Discovering connected drives
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    PID:2184
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Modifies service
      • Suspicious use of AdjustPrivilegeToken
      • Discovering connected drives
      PID:3136
    • C:\Windows\Installer\MSI44D6.tmp
      "C:\Windows\Installer\MSI44D6.tmp"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Modifies registry class
      • Discovering connected drives
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:612
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UdQkDzlHNFEt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AF.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1008
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "{path}"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:908
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    • Discovering connected drives
    PID:2112
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3252
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      PID:2928
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml
      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W70IXR76\gf8oxriqyniw6zy.msi.294bb8s.partial
      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp3AF.tmp
      Download Submit

    • C:\Users\Admin\Downloads\gf8oxriqyniw6zy.zip.9v1evgp.partial
      Download Submit

    • C:\Windows\Installer\MSI44D6.tmp
      Download Submit

    • C:\Windows\Installer\MSI44D6.tmp
      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Download Submit

    • \??\Volume{2cb2d4b6-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{950664dd-2568-48b0-bd27-da445a9e2182}_OnDiskSnapshotProp
      Download Submit

    • memory/908-11-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2184-20-0x000002203FBC0000-0x000002203FBC1000-memory.dmp

      Filesize

      4KB

      Download