Overview

overview

10

Static

static

3

HawkEye.exe

windows7-x64

10

HawkEye.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2024 12:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HawkEye.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeraransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Renames multiple (2002) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HawkEye.exe
    "C:\Users\Admin\AppData\Local\Temp\HawkEye.exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Downloads\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:344
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:344 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML
    Filesize

    4KB

    MD5

    50dca0fff0245ce7d01cdc0b6e246295

    SHA1

    e86a53db81891ae031d35a5f9ceb4f8df3056d09

    SHA256

    2fae793791bdd79c3eb5741cfe61ab9b54dbf187aec1c558c221b34aee5ba911

    SHA512

    a9412894ba3e102fdcb3df5aabc687aa268075a0406b54e6344ce3971436f6ed3bf61ea0817813c3076e00a41e92a3f8d63136bc5d154d0d66d0730db963ea38

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    86e5500d2d2fa8cd09ff65d305befd9c

    SHA1

    47a0941f6a97f8605dd54785500c6fcb24146558

    SHA256

    24f5a698fdab26b2ae376003c072b94b4fb9b773d93e47a3f7aa1f2c7e8e462d

    SHA512

    f09f0ccdb0f14899dbdbdec534657b8bd24385828787ed4ad5f364c2cdd279e6eb1e5499faf38cd93e9901b3611c514d05a836d6436049f0514576fa9b80fd7d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f0076b68121a1bb5ded617593b07fce0

    SHA1

    6f59829c0734249b16cb040990dcc4a85d1019fb

    SHA256

    d2fde5b8e1a7b0c0efd69199374d8fbeea22089b05ad5ef7923ca07b3f012c65

    SHA512

    ad63c25c123971aba5ee846d338bc71c49d450b5e15662a09f810478bfa4da71b963ac1fe2f8eeb801aa7fb984c545bdecf94d6116e08e78ba54a39c0ae6eb18

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    cd5b2bcff6c3eda3eab43b59efa0c7e4

    SHA1

    6faf0877dee07a7faf46cb556445fd3f8665f312

    SHA256

    6f19f0a821fc07723afafad8ec48a354ee52a11bf09b0b6bc5c6a234f737a762

    SHA512

    08c48678e4049a40c3fe8388316cab4c27275672b419fa04a526c046aeab2fffe759f5e9405bbeadcd254c062d59ef76f04d33544b5e1ee653a03e2f81673d9b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0fc51a10e63cc182e9fe03571f8cb6e0

    SHA1

    270953beeb8d1ebc426c8c7e5738c76558452134

    SHA256

    35889c837466822da18fadbcfecf5bc2ac43246da7e0bbacf198584d8c5b7ef0

    SHA512

    38d663fee778b16a84a58fd45f0b999df28bc5b9c366b38ae67ec0a5f0f1cc5381f33203b9b9c9e388eb7547f447e2b83298d614e35daaff0302c94795c6b914

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4144fb1d9a78cec29ed44a7760b28ebb

    SHA1

    e02f5e8f4c4b6da584f69ada3c993b42a5b64bb9

    SHA256

    74b1bbcf668a766ee62e32fa12e7825a187b5757222536f91e902826b236fe74

    SHA512

    36d4daada29e1423305f37641aca8b762ef8e2b8d966f42519c1a78bf5c2e7fadd3b7f2accd29fcce6fd13e938fa4de4ce5e18a17cc7a667905c50546b9a47ec

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    cc4a3b187f0aa182a0fcba1ffbf6c71e

    SHA1

    173f0dfb8aae98d4160c133bad9b46b88ec4cb8a

    SHA256

    9c1506a9973cbb2c597301f8326a72c0bb95c96aadd17e4ba7bb0fd754d5de49

    SHA512

    15b23ffba6244669800a1603973b35a665c8adf6bee5a9a3edb0799281a2e5f4e4afe10bd8083a359adb87de27a20806f115b81a15febd40729588b432904590

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    af0111195bc8cfb25b34a11280daeb1a

    SHA1

    b29d9160a6f35ed42255a6977f065aebe6c684c2

    SHA256

    2a2e8496ef9f1432bab7ca1c33578983ec8e34c3dbdb652362d3a29f9e303b5a

    SHA512

    37d781fd7f06abede43c4393ccd5889775e9facc7866cc879d01c35ab82e0cadddf2bcbae9be816e0df1f6325f7b5dfbd1c4764d16395a72d6d9b6b667e51269

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8fe059f40cf04161604d406956076446

    SHA1

    084de76a205a8ef2e12a5600a80a4e07a2977bb7

    SHA256

    8ece175fd26c9ffe1379b4721b1575f289ffb41429b638006bc4a67ae0e3540a

    SHA512

    7dc5985b1e2d027e23ab7cb1fa54abc0bdb723e3405dd77603c568a8a9f8199e925efb3dd53cb7188f5a0ac4afa1eb105f7880ac13e1bca0ae5da7731d54e1e3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1afb41e5c25195ce7a8a1bf9c834be07

    SHA1

    d93d7f4dfd96434dda582cca054e4a50d9ee12c4

    SHA256

    9dcf14133dcca80b8e0d9d1c8aec099308c4fb3f613953b452e49be95c3f2e82

    SHA512

    42a6ba037aed64747ddecb3ec2cd5c351ab050fbb67c6a35331a9f9fb40f5d60c26bc53cfc3b2447a68a60c2f35e0ece8204d3f04dcaff87d351e0f6e5e18567

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabF52A.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarF57B.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • memory/2532-0-0x00000000743C1000-0x00000000743C2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2532-9-0x0000000000510000-0x000000000052A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2532-8-0x00000000743C0000-0x000000007496B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2532-3-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2532-2-0x00000000743C0000-0x000000007496B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2532-1-0x00000000743C0000-0x000000007496B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2532-4759-0x00000000743C0000-0x000000007496B000-memory.dmp

    Filesize

    5.7MB

    Download