Overview

overview

7

Static

static

7

Hone - Installer.exe

windows7-x64

4

Hone - Installer.exe

windows10-2004-x64

4

$PLUGINSDI...p.html

windows7-x64

1

$PLUGINSDI...p.html

windows10-2004-x64

1

$PLUGINSDI...x.html

windows7-x64

1

$PLUGINSDI...x.html

windows10-2004-x64

1

$PLUGINSDI...app.js

windows7-x64

1

$PLUGINSDI...app.js

windows10-2004-x64

1

$PLUGINSDI...uts.js

windows7-x64

1

$PLUGINSDI...uts.js

windows10-2004-x64

1

$PLUGINSDI...dle.js

windows7-x64

1

$PLUGINSDI...dle.js

windows10-2004-x64

1

$PLUGINSDI...min.js

windows7-x64

1

$PLUGINSDI...min.js

windows10-2004-x64

1

$PLUGINSDI...ons.js

windows7-x64

1

$PLUGINSDI...ons.js

windows10-2004-x64

1

$PLUGINSDI...ics.js

windows7-x64

1

$PLUGINSDI...ics.js

windows10-2004-x64

1

$PLUGINSDI...nds.js

windows7-x64

1

$PLUGINSDI...nds.js

windows10-2004-x64

1

$PLUGINSDI...ies.js

windows7-x64

1

$PLUGINSDI...ies.js

windows10-2004-x64

1

$PLUGINSDI...ate.js

windows7-x64

1

$PLUGINSDI...ate.js

windows10-2004-x64

1

$PLUGINSDI...der.js

windows7-x64

1

$PLUGINSDI...der.js

windows10-2004-x64

1

$PLUGINSDI...ils.js

windows7-x64

1

$PLUGINSDI...ils.js

windows10-2004-x64

1

$PLUGINSDI...ler.js

windows7-x64

1

$PLUGINSDI...ler.js

windows10-2004-x64

1

$PLUGINSDI...ate.js

windows7-x64

1

$PLUGINSDI...ate.js

windows10-2004-x64

1

Resubmissions

11/04/2024, 06:06

240411-gt1pxagh4y7

11/04/2024, 05:53

240411-gllk1sdg287

11/04/2024, 05:51

240411-gj89asgf817

11/04/2024, 05:48

240411-ghl3dadf697

11/04/2024, 05:44

240411-gfgpwagf3y7

11/04/2024, 05:39

240411-gcnn1sde527

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 05:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Hone - Installer.exe
  • Size 2.0MB
  • Sample240411-ghl3dadf69
  • SHA256 bcc8812a2385f7a4db7d7633eb5ce0770e5cc3b5093873fd3e0a7c239f8daa1d
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\OWinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=opera -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --silent-setup --app-name="Hone" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2928
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=2244,i,11986678581565715302,451159359636456336,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3668

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          SettingsPageBasic.xml
          • Path C:\Users\Admin\AppData\Local\Overwolf\Settings\SettingsPageBasic.xml
          • Size 752B
          • SHA256 93e51272f2b2cefaff5b0e5013b5e34d71960e0ad86597ff221100a402397fb9
          • MD5 SHA1 SHA512
          Submit Download

          CommandLine.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\CommandLine.dll
          • Size 68KB
          • SHA256 db072dafd56c8e71353ba12ecf5751723c65e56db70b90c57fc979850da7ea2d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          INetC.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\INetC.dll
          • Size 24KB
          • SHA256 c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\Newtonsoft.Json.dll
          • Size 692KB
          • SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          OWInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\OWInstaller.exe
          • Size 298KB
          • SHA256 971e35ab45daed3b5a837508fd151854db7b5f448785518c9df85f3d298a2c07
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          OWinstaller.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\OWinstaller.exe.config
          • Size 632B
          • SHA256 272e4c5364193e73633caa3793e07509a349b79314ea01808b24fdb12c51b827
          • MD5 SHA1 SHA512
          Submit Download

          OverWolf.Client.CommonUtils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\OverWolf.Client.CommonUtils.dll
          • Size 645KB
          • SHA256 c9d29eb4d36152fa2841d2684c8f1769edcc50af6759712ad591b9a04b3d1622
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SharpRaven.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\SharpRaven.dll
          • Size 80KB
          • SHA256 23d1590ca13f9bc7d6ce53a5cd5087f65d424172716de0809e61207640175275
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\System.dll
          • Size 11KB
          • SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UserInfo.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\UserInfo.dll
          • Size 4KB
          • SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
          • MD5 SHA1 SHA512
          Submit Download

          LatoLatin-Regular.eot
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\assets\fonts\lato\LatoLatin-Regular.eot
          • Size 66KB
          • SHA256 c6c970b103b3c3aa83f7a45172619a4451ea5f015f9f3ef4fd08c9a4aa895cbc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          icon.ico
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\images\icon.ico
          • Size 14KB
          • SHA256 81c69b545c347e1708603fb912511d8eddf755cb27f37fdc6a6fd959c6cfb94e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          index.html
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\index.html
          • Size 20KB
          • SHA256 f15c54f4ac4f55bcfa281b668220eb144e63b9de2292e970095a4dc566209682
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          app.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\app.js
          • Size 21KB
          • SHA256 a14fcaf11a16ad7d904960538ca35d5b05e1c1b6a916f228db6b319c6195acbb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          block_inputs.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\block_inputs.js
          • Size 789B
          • SHA256 f8dbd6793b35f7a26806f4dabad157aaafdf6d66fad094b50c77d60f223fd544
          • MD5 SHA1 SHA512
          Submit Download

          cmp.bundle.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\libs\cmp.bundle.js
          • Size 324KB
          • SHA256 7fbc3a088ec303143109e0c1b2c04f4c5a6e450a2d6f3071fefb66e92f643ea0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jquery-1.10.2.min.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\libs\jquery-1.10.2.min.js
          • Size 90KB
          • SHA256 bc44d3631ffef1df7960e359f02002d3ada45ee05205c2cf1edd85da2f518144
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          notifications.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\models\notifications.js
          • Size 5KB
          • SHA256 9dd03dfc92bcb74f3725aae60e904c0a56cc84f299bbb8e863a869719f6fdd32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          analytics.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\analytics.js
          • Size 4KB
          • SHA256 c37f0699cf8ba7d9e3e0f73f1b2af65f4bdc2a31f44594ffc8c73e98b6c2fd1d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          commands.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\commands.js
          • Size 12KB
          • SHA256 e874c959c7b8e4351d730d263231df7176b5062580a7d3e0a2684001b510f5d7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cookies.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\cookies.js
          • Size 1KB
          • SHA256 9d3cb3822e20d6f5157faa02dc69bdaef44576c3fb5523e00aa152107ce30287
          • MD5 SHA1 SHA512
          Submit Download

          modal-events-delegate.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\modal-events-delegate.js
          • Size 1KB
          • SHA256 267661f932a2ea78d8c7a98cc03d1b18d7cb8132deb84636772ecd1fcfbe4857
          • MD5 SHA1 SHA512
          Submit Download

          strings-loader.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\strings-loader.js
          • Size 5KB
          • SHA256 96445709fde2613af50f4b8908296d4bfccdccb2d9db9febc34a9bf4dcc70ecf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          utils.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\utils\utils.js
          • Size 118B
          • SHA256 b4f0c48cbfeaf8141fd44b12031e3f0410cb0cdc313888ffdb14fdf1d2341246
          • MD5 SHA1 SHA512
          Submit Download

          cri-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\cri\cri-controller.js
          • Size 3KB
          • SHA256 cee7fc5a36a01a439125be031923d7e7415ec56194255048098169a0108034b7
          • MD5 SHA1 SHA512
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\cri\template.js
          • Size 1KB
          • SHA256 505d3c4de7d9cf8f0155b5b1a3c8792bc0ca2eda6781b441bd85455f144be22e
          • MD5 SHA1 SHA512
          Submit Download

          finish-with-recommended-app-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\finish-with-recommended-app\finish-with-recommended-app-controller.js
          • Size 1KB
          • SHA256 5ca97132a258ed1f36e401d70ccb95be2c9e18395e6010c40f61172914477de5
          • MD5 SHA1 SHA512
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\finish-with-recommended-app\template.js
          • Size 681B
          • SHA256 b61dfc304b46e8cd95d7b15bb93c6160b30523a1a093397a84fc8b8bed00ac42
          • MD5 SHA1 SHA512
          Submit Download

          finish-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\finish\finish-controller.js
          • Size 1KB
          • SHA256 4cb4e1aa25c15ae5f2e63fa4658a8acff0ce63e0f59cb6eb634df2dfe336e2ec
          • MD5 SHA1 SHA512
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\finish\template.js
          • Size 1KB
          • SHA256 b05f111369e12ecb4cdc6526dd554061eb31097aa0de4bd126ddc185b69d922f
          • MD5 SHA1 SHA512
          Submit Download

          main-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\main\main-controller.js
          • Size 11KB
          • SHA256 84dc33e2eb3118fc77a38b0ca53af42c53f6eb85cfb1e8737dbe39fa03515653
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\main\template.js
          • Size 3KB
          • SHA256 63a43bb08403972d0f4b0e381bd264af14e826e0035242bc1baa9a815956b8fc
          • MD5 SHA1 SHA512
          Submit Download

          modal-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\modal\modal-controller.js
          • Size 2KB
          • SHA256 4565ee81ffe222b31982088b1c18850076e3acf59198ebce08118e12cbd87ea1
          • MD5 SHA1 SHA512
          Submit Download

          privacy-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\privacy\privacy-controller.js
          • Size 2KB
          • SHA256 14d9c60cd97f18e74fee2dd80b6a190eaccc526085991f356feb6b4d330a0fc3
          • MD5 SHA1 SHA512
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\privacy\template.js
          • Size 655B
          • SHA256 95c459eae0edccdb94702aea603a097e461daa0e5f37dcd0e30de7df665433a8
          • MD5 SHA1 SHA512
          Submit Download

          progress-1-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\progress\progress-1-controller.js
          • Size 1KB
          • SHA256 838bab990ce38372dfedb50eb0a270db705811729630ab8557c08bd1e9e8e105
          • MD5 SHA1 SHA512
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\progress\template.js
          • Size 242B
          • SHA256 a7128a08bca53dd919cab3e5cb4dab31ded7ae2dafc957209b9fdd23f3b944ab
          • MD5 SHA1 SHA512
          Submit Download

          settings-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\settings\settings-controller.js
          • Size 6KB
          • SHA256 b5c5dc5e0684fd97eb4c45896dc1c2de8a6a6fdc63b6aa83a99103c15787ef35
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\settings\template.js
          • Size 4KB
          • SHA256 8014a7c919da249ba2f2196d9c9b62639d20851be426f3ffaef161cbe477c45f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          template.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\welcome\template.js
          • Size 1KB
          • SHA256 42c546e9da748ef76fdab56b96fd511eb607617a9ba37b3dc420148b769d8acb
          • MD5 SHA1 SHA512
          Submit Download

          welcome-controller.js
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\js\windows\welcome\welcome-controller.js
          • Size 2KB
          • SHA256 6155691dbdd66290109afb91617f9cf68af6bd912991d5d27b922f5faa7f530b
          • MD5 SHA1 SHA512
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\app\manifest.json
          • Size 691B
          • SHA256 b05c3a93afae91439d7d43d05c71a058339afd4914f0a77739a097e015e7f23d
          • MD5 SHA1 SHA512
          Submit Download

          log4net.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\log4net.dll
          • Size 270KB
          • SHA256 ae9c8073c3357c490f5d1c64101362918357c568f6b9380a60b09a4a4c1ff309
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          uac.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\uac.dll
          • Size 14KB
          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          utils.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsh8BC6.tmp\utils.dll
          • Size 55KB
          • SHA256 1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2928-142-0x000001B76E1E0000-0x000001B76E1F4000-memory.dmp
          Download

          memory/2928-140-0x00007FF8A12B0000-0x00007FF8A1D71000-memory.dmp
          Download

          memory/2928-143-0x000001B770900000-0x000001B770E28000-memory.dmp
          Download

          memory/2928-161-0x000001B7706F0000-0x000001B7707A0000-memory.dmp
          Download

          memory/2928-182-0x000001B770530000-0x000001B770540000-memory.dmp
          Download

          memory/2928-144-0x000001B770530000-0x000001B770540000-memory.dmp
          Download

          memory/2928-183-0x000001B770530000-0x000001B770540000-memory.dmp
          Download

          memory/2928-179-0x000001B770640000-0x000001B770662000-memory.dmp
          Download

          memory/2928-139-0x000001B770320000-0x000001B7703C4000-memory.dmp
          Download

          memory/2928-135-0x000001B76DDC0000-0x000001B76DE0C000-memory.dmp
          Download

          memory/2928-146-0x000001B7703D0000-0x000001B770416000-memory.dmp
          Download

          memory/2928-218-0x000001BF73AF0000-0x000001BF74296000-memory.dmp
          Download

          memory/2928-150-0x000001B770440000-0x000001B770458000-memory.dmp
          Download

          memory/2928-220-0x00007FF8A12B0000-0x00007FF8A1D71000-memory.dmp
          Download