Overview

overview

10

Static

static

3

HawkEye(2).exe

windows7-x64

10

HawkEye(2).exe

windows10-2004-x64

10

Analysis

  • max time kernel
    26s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 11:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HawkEye(2).exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Renames multiple (1998) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HawkEye(2).exe
    "C:\Users\Admin\AppData\Local\Temp\HawkEye(2).exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3012
  • C:\Windows\System32\xpsrchvw.exe
    "C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\SwitchLimit.xps"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2232
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UninstallRequest.mpeg"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    c51b474758b95f2b9b9f45501598caf7

    SHA1

    245e047b5021f1cb2cd4cd4828b254f171f7c5bc

    SHA256

    e806e3a3f0d58ddab8de908f4407e82df42d75ac880c11455cdea45d7d0dcd2a

    SHA512

    cbfa7873788a3571afe12d7b43aa8c3047d4a7b1210dd4e803c636c99b618c925b0ec295ff036b75effaab0f3a53f9050d53c770d2ca7928ce864cceadfcab27

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab7C15.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar7DC1.tmp
    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    Download Submit

  • memory/2224-4260-0x00000000009A0000-0x00000000009E0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2224-2-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2224-10-0x00000000004F0000-0x000000000050A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2224-9-0x00000000004F0000-0x000000000050A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2224-8-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2224-3577-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2224-0-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2224-4263-0x0000000000350000-0x0000000000450000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2224-1-0x0000000074710000-0x0000000074CBB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2224-3-0x00000000009A0000-0x00000000009E0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2232-2703-0x0000000003130000-0x0000000003131000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2968-4313-0x000000013F210000-0x000000013F308000-memory.dmp

    Filesize

    992KB

    Download

  • memory/2968-4314-0x000007FEF64E0000-0x000007FEF6514000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2968-4315-0x000007FEF5D10000-0x000007FEF5FC4000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/2968-4319-0x000007FEEC6D0000-0x000007FEED77B000-memory.dmp

    Filesize

    16.7MB

    Download

  • memory/2968-4320-0x000007FEEBE00000-0x000007FEEBF12000-memory.dmp

    Filesize

    1.1MB

    Download