Analysis
-
max time kernel
77s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
31-01-2021 13:14
General
-
Target
sampleB.exe
-
Size
521KB
-
MD5
cd86e9d8e318a3058e58bca4ae0197c6
-
SHA1
7f3f13309f866715df4e834b1e1be30efe7bbae2
-
SHA256
4862edfbf96fcb5c48f2b095f5e111d550e5c771d87e0576c6aaaae4095fe550
-
SHA512
af31c2763638fce6584ca3651ff06a8b641cba14d3d2399dc000e94060e8e6a244ee3eb78bdc7ea3758dfae5fe71f2e7766b77cb232c5f3a819d0c5ec7bbd978
Score
10/10
Malware Config
Signatures
-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 1682 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sampleB.exe"C:\Users\Admin\AppData\Local\Temp\sampleB.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 12002⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB