Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2022 18:03

General

  • Target

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

  • Size

    950KB

  • MD5

    72a29aa3364417f3194f8e34fad82668

  • SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

  • SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

  • SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
    "C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
      C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of UnmapMainImage
          PID:544

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

    Filesize

    102B

    MD5

    9f4ef3b0f356638ebb3f2a3e8ab0eb0c

    SHA1

    c11bf6ee80afb55b1435789775e2aa753c90c8dd

    SHA256

    6d580e6f0efd757b2480a5168b47229c5580cd0b17af19a08d23a1a343d30e88

    SHA512

    8c0f79b4254df77a0830dde96b6b2d60584537dd6233da004d71c6c68e468ceee0f3c2c66edb1981d4cf0a475a0ae737f9054f90016439d5387fa5fd8ef00114

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • \Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • memory/544-104-0x00000000744C0000-0x0000000074A6B000-memory.dmp

    Filesize

    5.7MB

  • memory/544-102-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/544-103-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/544-101-0x0000000008D90000-0x0000000009888000-memory.dmp

    Filesize

    11.0MB

  • memory/544-98-0x00000000025B0000-0x0000000002640000-memory.dmp

    Filesize

    576KB

  • memory/544-94-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1328-69-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/1328-63-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/1328-66-0x0000000001CE0000-0x0000000001D70000-memory.dmp

    Filesize

    576KB

  • memory/1328-71-0x0000000074BA0000-0x000000007514B000-memory.dmp

    Filesize

    5.7MB

  • memory/1328-77-0x0000000074BA0000-0x000000007514B000-memory.dmp

    Filesize

    5.7MB

  • memory/1328-76-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/1328-70-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/1364-59-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB

  • memory/1364-56-0x0000000000300000-0x0000000000307000-memory.dmp

    Filesize

    28KB

  • memory/1364-57-0x0000000075C91000-0x0000000075C93000-memory.dmp

    Filesize

    8KB

  • memory/1968-88-0x00000000779D0000-0x0000000077B50000-memory.dmp

    Filesize

    1.5MB