Analysis

  • max time kernel
    144s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-05-2024 01:00

General

  • Target

    ORDER SHEET/ORDER SHEET 1.exe

  • Size

    550KB

  • MD5

    dd178d434937b7482e5a9f7c1a807d24

  • SHA1

    10e0dd5f0b95babf7072bf35dbd786ad408def16

  • SHA256

    84053f784641d90e9b053ffcb2e07e95e84f2f647317a4dd716ebca9fc9ac539

  • SHA512

    9073b5817779a12d6eb5091ed69f6ca28ac5c92dbe6dadce66b0a098a2c8289b42c189589ce8a94593baab0f381b491dc9af291cb68f8c787e356a746780c56d

  • SSDEEP

    12288:2rUQtoZo1W5EChbp0aKXRTyRdIYSkF9jO8ng1wNfv4fa9/K:2QiomnGfUTyLIYSg9m1+map

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Nirsoft 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDER SHEET\ORDER SHEET 1.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER SHEET\ORDER SHEET 1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\cmd.exe
      "cmd"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\filename.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\filename.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\SysWOW64\cmd.exe
          "cmd"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
            5⤵
            • Adds Run key to start application
            PID:4868
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\\holdermail.txt"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:2920
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\\holderwb.txt"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

    Filesize

    4KB

    MD5

    73ddf6cd83c2ad8a2fbb2383e322ffbc

    SHA1

    05270f8bb7b5cc6ab9a61ae7453d047379089147

    SHA256

    0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409

    SHA512

    714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\filename.exe

    Filesize

    550KB

    MD5

    dd178d434937b7482e5a9f7c1a807d24

    SHA1

    10e0dd5f0b95babf7072bf35dbd786ad408def16

    SHA256

    84053f784641d90e9b053ffcb2e07e95e84f2f647317a4dd716ebca9fc9ac539

    SHA512

    9073b5817779a12d6eb5091ed69f6ca28ac5c92dbe6dadce66b0a098a2c8289b42c189589ce8a94593baab0f381b491dc9af291cb68f8c787e356a746780c56d

  • memory/220-25-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/220-32-0x0000000000460000-0x0000000000529000-memory.dmp

    Filesize

    804KB

  • memory/220-33-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/220-26-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2920-19-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2920-21-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2920-22-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/3576-2-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/3576-0-0x00000000745F2000-0x00000000745F3000-memory.dmp

    Filesize

    4KB

  • memory/3576-8-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/3576-1-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-16-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-13-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-11-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-9-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-10-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-34-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-35-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-36-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB

  • memory/4180-37-0x00000000745F0000-0x0000000074BA1000-memory.dmp

    Filesize

    5.7MB