Analysis

  • max time kernel
    74s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • resource tags

    arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2022 14:19

General

  • Target

    519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe

  • Size

    646KB

  • MD5

    13b470ab4c1dde94867a567d88fdb673

  • SHA1

    ffd3e2e7dc16bbe5d3e5b64ecae040a924cbcdc2

  • SHA256

    519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb

  • SHA512

    74ddc6aa93a5890762e856d2bb1b74cdf2acf1609edb27b3b790ad3efdbae00104ce5640ebc6b7edae07fe3267b5b4320a4c6bcb1400dc116a07f24b8242b568

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 11 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 10 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 15 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe
    "C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGaqmF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F3F.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:432
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:1896
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
          4⤵
            PID:1196

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\Temp\tmp7F3F.tmp

      Filesize

      1KB

      MD5

      01e5a2b46c8cde634f2df81af8895f4e

      SHA1

      ae470ad391273d02eaf02adab5e8ad055545fa7c

      SHA256

      13ec7b542deb175a950f5fbe04ea60d30397033d485e80f07679de9344c7d363

      SHA512

      ad2818e4e3683c30b9c5a1317d4dac2ea54979d8bc610aae1e58cd1f89f4a62fd31a1ed05cb40f402b5166707d15edfaed2ec5c114b51d11fb8b40e36dde3164

    • memory/584-72-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-76-0x0000000000B55000-0x0000000000B66000-memory.dmp

      Filesize

      68KB

    • memory/584-85-0x0000000000B55000-0x0000000000B66000-memory.dmp

      Filesize

      68KB

    • memory/584-77-0x0000000000680000-0x0000000000688000-memory.dmp

      Filesize

      32KB

    • memory/584-74-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-63-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-64-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-66-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-68-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/584-69-0x0000000000400000-0x0000000000488000-memory.dmp

      Filesize

      544KB

    • memory/960-54-0x0000000075801000-0x0000000075803000-memory.dmp

      Filesize

      8KB

    • memory/960-56-0x0000000074A30000-0x0000000074FDB000-memory.dmp

      Filesize

      5.7MB

    • memory/996-60-0x0000000004F30000-0x0000000004FC0000-memory.dmp

      Filesize

      576KB

    • memory/996-57-0x0000000000CA0000-0x0000000000CAC000-memory.dmp

      Filesize

      48KB

    • memory/996-58-0x00000000049A0000-0x0000000004A48000-memory.dmp

      Filesize

      672KB

    • memory/1196-86-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1196-90-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1196-92-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1896-78-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1896-82-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1896-83-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1896-84-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB