Overview

overview

10

Static

static

3

HawkEye.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2024 16:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HawkEye.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Renames multiple (3247) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 27 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HawkEye.exe
    "C:\Users\Admin\AppData\Local\Temp\HawkEye.exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4136
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3780
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2408
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80d1a46f8,0x7ff80d1a4708,0x7ff80d1a4718
      2⤵
        PID:452
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
        2⤵
          PID:2300
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1804
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
          2⤵
            PID:3296
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
            2⤵
              PID:316
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
              2⤵
                PID:4356
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
                2⤵
                  PID:1632
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3448
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                  2⤵
                    PID:4988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                    2⤵
                      PID:1020
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
                      2⤵
                        PID:4972
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7421225262398858153,3415921305704659678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
                        2⤵
                          PID:4948
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3228
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4268

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML
                            Filesize

                            4KB

                            MD5

                            b86220001ace18aa7aab945f35e6d3cc

                            SHA1

                            98f01d0658bb6159bc58f846f0077dca5a819cb1

                            SHA256

                            201c47158942c9c973b9e287dfc90f217854a7d4876b0d9024f11c57c099e758

                            SHA512

                            9673a1641677a64d7a0db3f6440eca18efc427a353224e1b9fca7e08e77130547e15ca773e3176a4de21e8a68c5bfc41c774ce6074c9ac7d092db1dcd7a2ab03

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            18bc1d880e1a43364e572a20540c025b

                            SHA1

                            93b7043da91e7697d7268a52ca9a434a55ddbb75

                            SHA256

                            11fcaea6cf095ba038a344829e699198e7c981149f15e30a51229b8dbca6937f

                            SHA512

                            3e8ca38dbd4d9aa865fdfa359033fb47f581b93842f1ccb667f243cc630bfabf8390cbf8ed1de6110b18819f0d831312304806667bc68fdd13ea1bb09b44742e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            b1f40e0d6ceaf161dfc1dfdddcfc44af

                            SHA1

                            b6557a6331b4c54efb30597ad4da0be03013a23e

                            SHA256

                            065557e5cddcc8022528dc82c5fd618ca28c153d6e34978d2ba84d33227eed48

                            SHA512

                            0d7fd3eabf2d2b426c627531b29e433cab175232c169a77623213b7b9935458b3067a2860137b030235526e49ca4df6867534135cf9da60697d6fa43441e7818

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            ffa1aba5c68dc214871153dec9d8efbe

                            SHA1

                            ae1a32882b9945ac07a9fa4c829da0a720baeeb2

                            SHA256

                            69cd592b01e7496704660ea63f6eb6495b4b8f0d62eadf92bd066641d83f4fcc

                            SHA512

                            8eee177b1b400bd1a6a9887301d6d3b4a46bc2fb2068b0be39433d545869dc36a2b244aea1c018d3f447e1ed2d7cf605af3753b5af4737fff94bd4b60f5e23ba

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            3df5706d713f454ec2cd619413c2689f

                            SHA1

                            5c3ec186b3987501e92602d30f46712db2c6182f

                            SHA256

                            e6a350f620a0cee41575943ee6b4750f0d91579957b3b03d6326d19f86f55d11

                            SHA512

                            489189e7a2d60b6bf56a61e9dbc727d102ffa4346f70dbb7b45f638a0f23d50294617ddf7efa707873986fcdfe1b26a37e4db40eb7f4e516b32cbc960a95d693

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            9d55153e4ce84603e6eac28828b2eb6d

                            SHA1

                            c8a4dfac3ded158989a8bbb733e5977cac2f6888

                            SHA256

                            c1b07688203053ee1e4dceaa09c69604073212a138498e988f25a8aafdb7821e

                            SHA512

                            ea7c1b19531050ff3675400965e4c330cc9417eaa135a305047f71586954ef4f3d5fc84a6d6021bc2cdcd44eef6a1eb6db3b37125f9c95836f856f092d6585b7

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            a3f3a5849551ea753f90d6e13a779537

                            SHA1

                            40c27468aeb393f45bcbcc19244c1752f55b42e6

                            SHA256

                            111eafb394a745d401be14739ee6693aeda9dab29c870526abbdbc43c9de3f96

                            SHA512

                            0ba248ba122282b01c8755e248c09782ecaa063874f4ea2376e01dd2f6839155c7279381ae91c060e99c4b25d0b77ec206e639666837a6707d389f98e66132d3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            6d85970dfe33eaa86e6ede689e80201b

                            SHA1

                            c45ce3fd65a9afbc9edee6c47ec8b40f502bbd26

                            SHA256

                            37e523e05b288597f03de4fe8378207aa80d412428b84bdc5adb726dce42b7b9

                            SHA512

                            fda9ba7339409477cd73c61b722bee500667eb10ad346bf4d4a7b2b0d7aa898c504d670eb040eeda9505b89b0827bec985eff04641b89422fa48a10ae009ed9e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3F85.tmp
                            Filesize

                            15KB

                            MD5

                            1a545d0052b581fbb2ab4c52133846bc

                            SHA1

                            62f3266a9b9925cd6d98658b92adec673cbe3dd3

                            SHA256

                            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                            SHA512

                            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                            Download Submit

                          • memory/4136-8-0x0000000000BB0000-0x0000000000CB0000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/4136-10-0x0000000004F00000-0x0000000004F1A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/4136-0-0x0000000074F50000-0x0000000075501000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/4136-9-0x0000000004F00000-0x0000000004F1A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/4136-2303-0x0000000074F50000-0x0000000075501000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/4136-2343-0x0000000000BB0000-0x0000000000CB0000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/4136-3-0x0000000010000000-0x0000000010010000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4136-2-0x0000000074F50000-0x0000000075501000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/4136-1-0x0000000000F40000-0x0000000000F50000-memory.dmp

                            Filesize

                            64KB

                            Download