Analysis

  • max time kernel
    152s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 15:19

General

  • Target

    a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe

  • Size

    988KB

  • MD5

    43bce7d2d4566464370caaed1ddc3e8d

  • SHA1

    d141faa5ec358cdf27d46abb00ab42b09d8b7561

  • SHA256

    a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

  • SHA512

    99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

  • SSDEEP

    24576:TIEd98/23P+JcpDNTRK/yr4+OCx9fr4WdH:cEdC/QWETKvEyWt

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 15 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 15 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
    "C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
      "C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:968
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1108
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
            • Accesses Microsoft Outlook accounts
            PID:1704
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
              PID:1156

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

      Filesize

      102B

      MD5

      f1cb9d842d3741847a1636b09a8809b5

      SHA1

      0ccd48d839bf422bad1fa8ec375efa991536d630

      SHA256

      76b6f817981b2010bdcb62781b377bfe53abda1a0838818528243fe791a35803

      SHA512

      664dc68d8a3430d309e840d8bb17692ffabd9cab09cf423136f90e0b111ddfdc49b6e840d2daa13dc7c7be380f282a455add90b3baa63a94a01eb1ec7442324c

    • C:\Users\Admin\AppData\Local\Temp\holdermail.txt

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      988KB

      MD5

      43bce7d2d4566464370caaed1ddc3e8d

      SHA1

      d141faa5ec358cdf27d46abb00ab42b09d8b7561

      SHA256

      a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

      SHA512

      99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      988KB

      MD5

      43bce7d2d4566464370caaed1ddc3e8d

      SHA1

      d141faa5ec358cdf27d46abb00ab42b09d8b7561

      SHA256

      a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

      SHA512

      99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

    • C:\Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      988KB

      MD5

      43bce7d2d4566464370caaed1ddc3e8d

      SHA1

      d141faa5ec358cdf27d46abb00ab42b09d8b7561

      SHA256

      a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

      SHA512

      99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      988KB

      MD5

      43bce7d2d4566464370caaed1ddc3e8d

      SHA1

      d141faa5ec358cdf27d46abb00ab42b09d8b7561

      SHA256

      a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

      SHA512

      99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

    • \Users\Admin\AppData\Roaming\Windows Update.exe

      Filesize

      988KB

      MD5

      43bce7d2d4566464370caaed1ddc3e8d

      SHA1

      d141faa5ec358cdf27d46abb00ab42b09d8b7561

      SHA256

      a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

      SHA512

      99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

    • memory/968-68-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-77-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/968-66-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-57-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-71-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/968-63-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-58-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-62-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/968-60-0x0000000000400000-0x00000000004B8000-memory.dmp

      Filesize

      736KB

    • memory/1108-95-0x0000000000090000-0x0000000000148000-memory.dmp

      Filesize

      736KB

    • memory/1108-110-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1108-120-0x0000000000CA5000-0x0000000000CB6000-memory.dmp

      Filesize

      68KB

    • memory/1108-91-0x0000000000090000-0x0000000000148000-memory.dmp

      Filesize

      736KB

    • memory/1108-98-0x0000000000090000-0x0000000000148000-memory.dmp

      Filesize

      736KB

    • memory/1108-101-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1108-103-0x0000000000CA5000-0x0000000000CB6000-memory.dmp

      Filesize

      68KB

    • memory/1156-119-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1156-117-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1156-115-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1156-111-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/1612-54-0x0000000075091000-0x0000000075093000-memory.dmp

      Filesize

      8KB

    • memory/1612-56-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1612-70-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1612-55-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1704-108-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1704-109-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1704-104-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1704-116-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/1724-99-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1724-78-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB

    • memory/1724-79-0x0000000074110000-0x00000000746BB000-memory.dmp

      Filesize

      5.7MB