Overview

overview

7

Static

static

7

Hone - Installer.exe

windows11-21h2-x64

4

$PLUGINSDI...p.html

windows11-21h2-x64

1

$PLUGINSDI...x.html

windows11-21h2-x64

1

$PLUGINSDI...app.js

windows11-21h2-x64

1

$PLUGINSDI...uts.js

windows11-21h2-x64

1

$PLUGINSDI...dle.js

windows11-21h2-x64

1

$PLUGINSDI...min.js

windows11-21h2-x64

1

$PLUGINSDI...ons.js

windows11-21h2-x64

1

$PLUGINSDI...ics.js

windows11-21h2-x64

1

$PLUGINSDI...nds.js

windows11-21h2-x64

1

$PLUGINSDI...ies.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...der.js

windows11-21h2-x64

1

$PLUGINSDI...ils.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ate.js

windows11-21h2-x64

1

$PLUGINSDI...ler.js

windows11-21h2-x64

1

$PLUGINSDI...s.html

windows11-21h2-x64

1

Resubmissions

11/04/2024, 06:06

240411-gt1pxagh4y 7

11/04/2024, 05:53

240411-gllk1sdg28 7

11/04/2024, 05:51

240411-gj89asgf81 7

11/04/2024, 05:48

240411-ghl3dadf69 7

11/04/2024, 05:44

240411-gfgpwagf3y 7

11/04/2024, 05:39

240411-gcnn1sde52 7

Analysis

  • max time kernel
    90s
  • max time network
    112s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/04/2024, 05:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hone - Installer.exe

  • Size

    2.0MB

  • MD5

    67d529ffa7aef6629700ce3a9e990ac2

  • SHA1

    6ba55f541defc22f92473a45d2187848a0d4126a

  • SHA256

    bcc8812a2385f7a4db7d7633eb5ce0770e5cc3b5093873fd3e0a7c239f8daa1d

  • SHA512

    bdda91b0d95292ddae966754c6b3af618b60f4e575033306023db5e923b4a422b7a82bca1974645a15d8631221f7e4cacb399a34737c2c1f1961416c74ae7c64

  • SSDEEP

    49152:6Dr+mxE87vxpsrFpIvPBDurAaMs/Y6NTTCca:6H+4PN+TIvyMZ+O

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3956 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:1
    1⤵
      PID:1748
    • C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\OWinstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\OWinstaller.exe" Sel=0&Extension=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc&Name=Hone&Referer=hone.gg&Browser=opera -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://download.overwolf.com/setup/electron/mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --silent-setup --app-name="Hone" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Hone - Installer.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4748
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:8
      1⤵
        PID:2444
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:8
        1⤵
          PID:2628
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:4444
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --mojo-platform-channel-handle=5156 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:1
            1⤵
              PID:4864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=4824 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:1
              1⤵
                PID:3756
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=1596 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:1
                1⤵
                  PID:4060
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=4052 --field-trial-handle=1788,i,12725335091731201334,3560735918057503158,131072 /prefetch:1
                  1⤵
                    PID:3728

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\INetC.dll
                    Filesize

                    24KB

                    MD5

                    640bff73a5f8e37b202d911e4749b2e9

                    SHA1

                    9588dd7561ab7de3bca392b084bec91f3521c879

                    SHA256

                    c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

                    SHA512

                    39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\OWInstaller.exe
                    Filesize

                    298KB

                    MD5

                    698245574b5bc050e19cd1b3bee62439

                    SHA1

                    d0a48d07f102966f80c01186f70ed1f56f44a6b3

                    SHA256

                    971e35ab45daed3b5a837508fd151854db7b5f448785518c9df85f3d298a2c07

                    SHA512

                    ca4446593cd5372d1b0fe6b6280a32ac92b8e04c2860d5ce2c4ad41f12c6f72ecf77ef8f59e20b863ef689e0f93dc46701ea012899996777df7d22034187e72c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\OverWolf.Client.CommonUtils.dll
                    Filesize

                    645KB

                    MD5

                    4ede0a9a0c751563ab155934d9662b69

                    SHA1

                    10d4e31b6ef865f8ffe9f1e02384b4d9f462ca9a

                    SHA256

                    c9d29eb4d36152fa2841d2684c8f1769edcc50af6759712ad591b9a04b3d1622

                    SHA512

                    fe83de892d0c1ce8e4188ba6d2edf2b1e234065de3477bc7d09049c36ca011330a2785063a268a7e855cb2f521fda4b1a741f1a0f68e3c5e7b83fd547327e0e2

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\System.dll
                    Filesize

                    11KB

                    MD5

                    7399323923e3946fe9140132ac388132

                    SHA1

                    728257d06c452449b1241769b459f091aabcffc5

                    SHA256

                    5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3

                    SHA512

                    d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\UserInfo.dll
                    Filesize

                    4KB

                    MD5

                    9301577ff4d229347fe33259b43ef3b2

                    SHA1

                    5e39eb4f99920005a4b2303c8089d77f589c133d

                    SHA256

                    090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc

                    SHA512

                    77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\uac.dll
                    Filesize

                    14KB

                    MD5

                    adb29e6b186daa765dc750128649b63d

                    SHA1

                    160cbdc4cb0ac2c142d361df138c537aa7e708c9

                    SHA256

                    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

                    SHA512

                    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nsaC5F1.tmp\utils.dll
                    Filesize

                    55KB

                    MD5

                    aad3f2ecc74ddf65e84dcb62cf6a77cd

                    SHA1

                    1e153e0f4d7258cae75847dba32d0321864cf089

                    SHA256

                    1cc004fcce92824fa27565b31299b532733c976671ac6cf5dbd1e0465c0e47e8

                    SHA512

                    8e44b86c92c890d303448e25f091f1864946126343ee4665440de0dbeed1c89ff05e4f3f47d530781aa4db4a0d805b41899b57706b8eddfc95cfa64c073c26e2

                    Download Submit