Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 16:48

General

  • Target

    06914834645d9ab3058300de4c756954.exe

  • Size

    410KB

  • MD5

    06914834645d9ab3058300de4c756954

  • SHA1

    437546390ab6be7ab887e82148ba8b923bedd844

  • SHA256

    50c6eeab65b9c35d55dde8ba5cca1eaba4091d0a5611a353f9561e3e37453e67

  • SHA512

    08869a715d99a8034ee9e473c0c56f8fa4d35afbb67467a4d27ffd9d34f7d32f87a2b1f1141657ce7de27888fdca477af3d4756d6e5799d5dd27b5acbe2ff953

  • SSDEEP

    12288:3w06cUYTczdkibnD3WUgFooE3cVkO3rHGa6vSoW1:7TUHkibDGencVnHq6f

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06914834645d9ab3058300de4c756954.exe
    "C:\Users\Admin\AppData\Local\Temp\06914834645d9ab3058300de4c756954.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4440
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        3⤵
          PID:4872
        • C:\Users\Admin\AppData\Local\Temp\System\lsn.exe
          "C:\Users\Admin\AppData\Local\Temp\System\lsn.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3060
          • C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe
            "C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4916
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
              5⤵
                PID:4268

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

        Filesize

        70B

        MD5

        673c630c339470fb63850411fc5af025

        SHA1

        938da03d56e1c206abc0fb7d729855a0a877a103

        SHA256

        64b7ba818f2ac7e79037f57649b441d293bde5e213eae6289e1d16b753ecae70

        SHA512

        8f51561e75a5acc3bff8a8006fc0934b55884255b4ffd6a43b028f4d1379f74694464a614da94195b3a240abf1756a83cdb399efcef209b75ee37789743a0713

      • C:\Users\Admin\AppData\Local\Temp\System\lsn.exe

        Filesize

        24KB

        MD5

        0aa7e4dd12b1fc4d899bb86b0fd56233

        SHA1

        3bbd901ecc48959847deb145da3f3af6dc194afd

        SHA256

        d1267fc8e53b1cb8cda98eec93daf21ded66ba6ac9c05b0b7315444d459384e9

        SHA512

        2f2cd1892ab79a9dba46d1c1d848cd85ec876968b07316ccbda275b88960dc1718da7e4d433c88d0a52d2637bb5c99eda1135529f956e4a54c14f09bbc3f8e11

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

        Filesize

        410KB

        MD5

        06914834645d9ab3058300de4c756954

        SHA1

        437546390ab6be7ab887e82148ba8b923bedd844

        SHA256

        50c6eeab65b9c35d55dde8ba5cca1eaba4091d0a5611a353f9561e3e37453e67

        SHA512

        08869a715d99a8034ee9e473c0c56f8fa4d35afbb67467a4d27ffd9d34f7d32f87a2b1f1141657ce7de27888fdca477af3d4756d6e5799d5dd27b5acbe2ff953

      • memory/3060-51-0x0000000001210000-0x0000000001220000-memory.dmp

        Filesize

        64KB

      • memory/3060-36-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3060-38-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3060-50-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3060-37-0x0000000001210000-0x0000000001220000-memory.dmp

        Filesize

        64KB

      • memory/3660-48-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3660-14-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3660-15-0x0000000000F80000-0x0000000000F90000-memory.dmp

        Filesize

        64KB

      • memory/3660-16-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/3660-49-0x0000000000F80000-0x0000000000F90000-memory.dmp

        Filesize

        64KB

      • memory/4440-13-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4440-0-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4440-2-0x0000000000B20000-0x0000000000B30000-memory.dmp

        Filesize

        64KB

      • memory/4440-1-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4872-25-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/4872-24-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/4872-23-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/4872-22-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/4916-42-0x00000000010B0000-0x00000000010C0000-memory.dmp

        Filesize

        64KB

      • memory/4916-44-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4916-41-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4916-52-0x00000000753C0000-0x0000000075971000-memory.dmp

        Filesize

        5.7MB

      • memory/4916-53-0x00000000010B0000-0x00000000010C0000-memory.dmp

        Filesize

        64KB