Overview

overview

10

Static

static

3

HawkEye.exe

windows7-x64

10

Analysis

  • max time kernel
    36s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-04-2024 18:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HawkEye.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Renames multiple (2007) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HawkEye.exe
    "C:\Users\Admin\AppData\Local\Temp\HawkEye.exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    656852cd740404fda1a02c5134afd7e5

    SHA1

    4ec024fbc780221fb152a7b63cc34857a7a0fee8

    SHA256

    7aa2d3e0dcb9236ee0d5ed31511dac6802d9e535813e87df2db0aeffadfd737c

    SHA512

    cbb211ef270be2ee4cb2576f04751c93a59941e0bae068b8b5f99c8ff61652927e82fc9fae00d78602acdf934e4b745a6106d3bf841d8f683e8ab3d0b7cf70ef

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    539b4a886f1bffd53542517c2fa9d1e3

    SHA1

    a1b5fc21e45a68b9a5d9d0f6e36529684aabf343

    SHA256

    cdec2890f6b9c6a2ea688b4d584c012e486b3259459f4679640a255727e75d10

    SHA512

    a64f81f7f4e48127dd27ad38a3797ab9a66ff313b683f6794941a59f28ccc491bec66690f325eba3507127832a79b80259250978648ff5c8052a7a490e8b1e5b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    84daac38fa64cca39a961f64561f6d59

    SHA1

    3ac66b5277a1d4f723f3308140b3c2c123415422

    SHA256

    4a4cacc9e24e159abfa8845f8195a57fe5ef06d5ebe6df8060bb22683136e2b1

    SHA512

    867e85c66d78e771c059ac78981c81fe3a7634b65ca0f504901a84e9f6e6ff0b25a707db40908322da95d1e8ac37fa4c1dd1ddf81efabbd9b0e6b84aa9c8fd55

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b0f9c63845f4674fdf324c677662ddba

    SHA1

    858b5c9ae8671a96a73b0a0bdc50d576bf296b49

    SHA256

    33167fecbfa29daf6d10f7984c21c7d83e5be9d0b462693fe9b2349ef614e70b

    SHA512

    87007727d730f743adb5f9a32921e5814a7abb730cdc4ebb5a55c331c90eb0d905324540b797a7451393731334fe3d685a1c8ed41fcba8d063b146f69d0dc43e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b026360a5afe92d768a7b0070b669883

    SHA1

    3a367870537acd1b5af90e8167ad79ed0eb8988b

    SHA256

    2754b423d026bbbda10d8727fb3fbf7abe076b06209912e7e12469535502ce99

    SHA512

    dea25ae59274f8ed3ad288ebef125d5fd5826ec8d4d84788310286b3920cf292bab83ec41d4ae71ed8545dee37438636387fd79f176ff11ee1f418fd7cc82668

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    27df9837734c9d931fa4ecf41f90ceca

    SHA1

    65b9a72609b5a931b53742c3373170f3bf174ffe

    SHA256

    0d19e43b96c8ae24d14bfec1a084757ccaea52a3902fa47d98e2a26855109886

    SHA512

    2727d11f7816d899184b8c3dc47b37eb912d7aa227a7d41562806253ac0b98a90b221b724f695f76d16ab440b0e392c6a4126c7e9eab035bd11265d16bf71ecf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    3e2e5699ad4124f35a17f873696c7dd2

    SHA1

    be1f353d732fbbfcc7ecb530d9bfe26de03efa8d

    SHA256

    4c2de5ac3b19e4d1372e87a9356bd7d7205cce4c72afae5c561802bf6d423302

    SHA512

    e104471829d74f9dfe55337b9decc5932b6bd88ac11a9c4521c9c8248df6a691b85e2a33776144bc1de88faf33fb55f26a4672478a877602caae4886e789f69c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4a991225ea18fe50566a62b15c2dba34

    SHA1

    be73721933b8ffe63083a9fc07bbd1801d71acc0

    SHA256

    5ef28dc5103928c8944e83ab597c1e23852fc0610e763e5c61d3949e7bf1ccb5

    SHA512

    44d129ab2bf07156957d98b6b5e200087e52ab84c9326ab6780ecc4c5a499a5fc5a9d71b800d66d45f597fb65a374c8b8449027477d0f7f1beca31d8a3e82ea9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ac45689336491c93db914c17349f60fc

    SHA1

    fbdd6f7288f15d30cb0a3d2b85a635d9a65a36a5

    SHA256

    9fcb958a0853a5fb9fd3b16aa5608bc1dc09195725b8982d1f79a2fd3734fea5

    SHA512

    10eab5047124e926f71c8254a7ee043e1646912656317aaa1851fdc8f0dbe96ee6edf86b06169fdc91af7b6712f3f68659b37bf7367f3774c190fe65a449086d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    456b6c8a1932346f8baec7cb9c93380b

    SHA1

    228428adb851d3c141ff976a2a8a45660d5f69bb

    SHA256

    870ce25b9fd9f60363e06e0dae483017731832c5b6c5721d3cbb1c97fbd00aaa

    SHA512

    dee39a29a8dacfefd432a82ba9081cc5765d4043ec55b23048eed4bfafcd8a3880950cd4a6ba599f7529d56b78b781bbade926d4bad5b56bf048fad464556476

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1948c13177b777fb78ed69bc1f0ce9d4

    SHA1

    9434d6f7efa898a10171470732fab0bb8f60a9bf

    SHA256

    d2dca03e58240ea85acdbc54a19a13d5f558aad160dff59d1da463ff7ce03460

    SHA512

    097899d4016a490b223b711aabe2e4fa454268f0ad950f9f31aafd86c33d238dd18c443d4b5fca136522f9e112ed2c81fe0aa676217a1e0e19177a4334a65e6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab42CC.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar440B.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • memory/1956-3-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1956-8-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1956-2-0x0000000074660000-0x0000000074C0B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1956-1-0x0000000000080000-0x00000000000C0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1956-0-0x0000000074660000-0x0000000074C0B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1956-9-0x0000000000510000-0x000000000052A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1956-10-0x0000000000510000-0x000000000052A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1956-4325-0x0000000074660000-0x0000000074C0B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1956-4714-0x0000000000080000-0x00000000000C0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1956-4778-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

    Download