Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2022 18:29

General

  • Target

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe

  • Size

    447KB

  • MD5

    ddc2fdb455f2a23536aaacfab77af4b6

  • SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

  • SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

  • SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • SSDEEP

    12288:SEGuxoIOcHBkiCVt2Y8cz+PAZa8YuINE:uubduiS7z+YaZJ

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe
    "C:\Users\Admin\AppData\Local\Temp\89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe
      "C:\Users\Admin\AppData\Local\Temp\89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          PID:1512
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          PID:1792
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
            • Accesses Microsoft Outlook accounts
            PID:2284
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6.exe.log

    Filesize

    594B

    MD5

    fdb26b3b547022b45cfaeee57eafd566

    SHA1

    11c6798b8a59233f404014c5e79b3363cd564b37

    SHA256

    2707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0

    SHA512

    44d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Windows Update.exe.log

    Filesize

    774B

    MD5

    fc93eb9acb036dc0adcb7e9203deae84

    SHA1

    f6180e425e36b03252e18d9edb38c853a0546226

    SHA256

    8da330d49f43e46c3c34a7283f168ab399a37280b490503d7e7ca8ff34eaddae

    SHA512

    8ed8c6f1199da12f71819be099b2f129eced45e27e7bd7e1efbb07b09c7102bd31aaa9c39de85c9a583963b9331248d53d76eec0eb2b8ba7173ab0fdef25a620

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

    Filesize

    102B

    MD5

    ffcf2e2cd3bd02a157e8dae904373d24

    SHA1

    764c52751970eb22749a00605cbd5c3e8cded2e4

    SHA256

    4aeea137f4da8006dbcd4b58502a3e88bbd98a3f84e5c76b28cba1fd5497385a

    SHA512

    af7e77fb72dbbfedd2ef6d2d5f03f01edf18289b60e46f2e262a6d6c7ccbd5520afd60ade2353f429fd36bac428642d468aeff3e36091976de3ebc1d8d8a641a

  • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

    Filesize

    3KB

    MD5

    f94dc819ca773f1e3cb27abbc9e7fa27

    SHA1

    9a7700efadc5ea09ab288544ef1e3cd876255086

    SHA256

    a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

    SHA512

    72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    447KB

    MD5

    ddc2fdb455f2a23536aaacfab77af4b6

    SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

    SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

    SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    447KB

    MD5

    ddc2fdb455f2a23536aaacfab77af4b6

    SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

    SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

    SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    447KB

    MD5

    ddc2fdb455f2a23536aaacfab77af4b6

    SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

    SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

    SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    447KB

    MD5

    ddc2fdb455f2a23536aaacfab77af4b6

    SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

    SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

    SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    447KB

    MD5

    ddc2fdb455f2a23536aaacfab77af4b6

    SHA1

    a2b804041521b22dc107a22f64a09afb9f609973

    SHA256

    89a2faf1b65c932e10abea98097d72963708947d67dbf33324ba88a55c5e04e6

    SHA512

    8efbb24330973d7e270fd20a033c697a95b536fabd4e5aa2ce7224594916f923ff2a0647e9511dc391fa03a44f443b0eff575822b5afa43ffe3f73168dd655f5

  • memory/1308-165-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1308-164-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1308-162-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1308-161-0x0000000000000000-mapping.dmp

  • memory/1512-144-0x0000000000000000-mapping.dmp

  • memory/1792-146-0x0000000000000000-mapping.dmp

  • memory/2020-143-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/2020-139-0x0000000000000000-mapping.dmp

  • memory/2020-152-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/2284-158-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2284-159-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2284-156-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2284-155-0x0000000000000000-mapping.dmp

  • memory/3592-134-0x0000000000000000-mapping.dmp

  • memory/3592-135-0x0000000000400000-0x0000000000484000-memory.dmp

    Filesize

    528KB

  • memory/3592-138-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/3592-142-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4224-153-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4224-160-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4224-148-0x0000000000000000-mapping.dmp

  • memory/4572-132-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4572-137-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4572-133-0x0000000075320000-0x00000000758D1000-memory.dmp

    Filesize

    5.7MB