Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2022 14:19

General

  • Target

    519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe

  • Size

    646KB

  • MD5

    13b470ab4c1dde94867a567d88fdb673

  • SHA1

    ffd3e2e7dc16bbe5d3e5b64ecae040a924cbcdc2

  • SHA256

    519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb

  • SHA512

    74ddc6aa93a5890762e856d2bb1b74cdf2acf1609edb27b3b790ad3efdbae00104ce5640ebc6b7edae07fe3267b5b4320a4c6bcb1400dc116a07f24b8242b568

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 6 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 10 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe
    "C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\519391b8556e2eb1920af3d56f40c239319188265e0bdc7585fcaf6ab2bbaecb.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGaqmF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB13.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:2284
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:4840
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

    Filesize

    3KB

    MD5

    f94dc819ca773f1e3cb27abbc9e7fa27

    SHA1

    9a7700efadc5ea09ab288544ef1e3cd876255086

    SHA256

    a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

    SHA512

    72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

  • C:\Users\Admin\AppData\Local\Temp\tmpDB13.tmp

    Filesize

    1KB

    MD5

    d298d00c287e5a12d5f2b54a041b0a0d

    SHA1

    efc63dd827a9cf2f2d56a547cf4ca0dd03740a34

    SHA256

    8524f0549eafecb09764eadae9406abf58536f02bf5e8a1ebb7bbd17d38dfb66

    SHA512

    1ffcb19d3ad96b4c8ef304d5161c24cabb4bd1bd87bf57cfee31cd7158c6d98a7c301d2ea5b3e0f7a2c692e140fc1f6b222f8f1c0c1eaf48c2fa5e5c36e711ea

  • memory/1120-132-0x00000000750A0000-0x0000000075651000-memory.dmp

    Filesize

    5.7MB

  • memory/1120-130-0x00000000750A0000-0x0000000075651000-memory.dmp

    Filesize

    5.7MB

  • memory/1160-134-0x0000000004D00000-0x0000000004D1A000-memory.dmp

    Filesize

    104KB

  • memory/1160-135-0x0000000004DF0000-0x0000000004E98000-memory.dmp

    Filesize

    672KB

  • memory/1160-136-0x0000000004F40000-0x0000000004FDC000-memory.dmp

    Filesize

    624KB

  • memory/1160-137-0x0000000005590000-0x0000000005B34000-memory.dmp

    Filesize

    5.6MB

  • memory/1160-138-0x0000000004FE0000-0x0000000005072000-memory.dmp

    Filesize

    584KB

  • memory/1160-133-0x0000000000580000-0x000000000058C000-memory.dmp

    Filesize

    48KB

  • memory/2020-158-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2020-156-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2020-155-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2020-153-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/4164-143-0x00000000007B0000-0x0000000000838000-memory.dmp

    Filesize

    544KB

  • memory/4164-146-0x0000000007F50000-0x0000000007FB6000-memory.dmp

    Filesize

    408KB

  • memory/4164-145-0x0000000005040000-0x0000000005096000-memory.dmp

    Filesize

    344KB

  • memory/4164-144-0x0000000004D90000-0x0000000004D9A000-memory.dmp

    Filesize

    40KB

  • memory/4840-150-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4840-151-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4840-148-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB