Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-05-2023 09:09

General

  • Target

    microsoft10converters.exe

  • Size

    658KB

  • MD5

    5e9a63f5b3d8f53478a2889c0eefd510

  • SHA1

    d6d545146b969ac2ea389a1f11ffcda377549da2

  • SHA256

    4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

  • SHA512

    2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

  • SSDEEP

    12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 13 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 12 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 16 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe
    "C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
        PID:1692
      • C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe
        "C:\Users\Admin\AppData\Local\Temp\microsoft10converters.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:668
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe"
            4⤵
              PID:1496
            • C:\Users\Admin\AppData\Roaming\Windows Update.exe
              "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
              4⤵
              • Deletes itself
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:276
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
                5⤵
                • Accesses Microsoft Outlook accounts
                PID:1580
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
                5⤵
                  PID:1620

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Scripting

        1
        T1064

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Scripting

        1
        T1064

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
          Filesize

          59B

          MD5

          9b294a29cba9a63552604ad89c4d9444

          SHA1

          8e5bb542f31fccad06e69502c7dba5a62e9b9cb9

          SHA256

          a3f87150ecc0223f9099533d33c8839a435a2276bf243c7fbf0f063a182d31e1

          SHA512

          c45e8ae93eb82aefa86f7e46cbf47dfed4738b88b94e37925bc716a9b304ac6827f55d007f676783df6fed3a84d552f00ddf2dd00cbffdc1348f215878030a51

        • C:\Users\Admin\AppData\Local\Temp\holderwb.txt
          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          Filesize

          85KB

          MD5

          2e5f1cf69f92392f8829fc9c9263ae9b

          SHA1

          97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5

          SHA256

          51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b

          SHA512

          f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • \Users\Admin\AppData\Roaming\Windows Update.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • \Users\Admin\AppData\Roaming\Windows Update.exe
          Filesize

          658KB

          MD5

          5e9a63f5b3d8f53478a2889c0eefd510

          SHA1

          d6d545146b969ac2ea389a1f11ffcda377549da2

          SHA256

          4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c

          SHA512

          2ee785eafa4ff4e738f13c26659b479ef84d52977e0c6d054c4b38f228959a0909b8652923b821d557bef7ae3e5f129e6b2c5039b83bb1a71ef464d6e5ef5e87

        • memory/276-98-0x00000000005D0000-0x0000000000610000-memory.dmp
          Filesize

          256KB

        • memory/276-91-0x0000000000110000-0x0000000000194000-memory.dmp
          Filesize

          528KB

        • memory/276-88-0x0000000000110000-0x0000000000194000-memory.dmp
          Filesize

          528KB

        • memory/276-103-0x00000000005D0000-0x0000000000610000-memory.dmp
          Filesize

          256KB

        • memory/276-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Filesize

          4KB

        • memory/276-112-0x00000000005D0000-0x0000000000610000-memory.dmp
          Filesize

          256KB

        • memory/276-84-0x0000000000110000-0x0000000000194000-memory.dmp
          Filesize

          528KB

        • memory/668-92-0x0000000001FB0000-0x0000000001FF0000-memory.dmp
          Filesize

          256KB

        • memory/1580-101-0x0000000000400000-0x000000000041B000-memory.dmp
          Filesize

          108KB

        • memory/1580-102-0x0000000000400000-0x000000000041B000-memory.dmp
          Filesize

          108KB

        • memory/1580-104-0x0000000000400000-0x000000000041B000-memory.dmp
          Filesize

          108KB

        • memory/1580-99-0x0000000000400000-0x000000000041B000-memory.dmp
          Filesize

          108KB

        • memory/1620-111-0x0000000000400000-0x0000000000458000-memory.dmp
          Filesize

          352KB

        • memory/1620-107-0x0000000000400000-0x0000000000458000-memory.dmp
          Filesize

          352KB

        • memory/1620-105-0x0000000000400000-0x0000000000458000-memory.dmp
          Filesize

          352KB

        • memory/1916-61-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-60-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Filesize

          4KB

        • memory/1916-59-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-65-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-57-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-58-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-63-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/1916-56-0x0000000000400000-0x0000000000484000-memory.dmp
          Filesize

          528KB

        • memory/2032-54-0x0000000000470000-0x00000000004B0000-memory.dmp
          Filesize

          256KB