Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 15:19
Static task
static1
4 signatures
General
-
Target
eye.exe
-
Size
520KB
-
MD5
b40186916e876be867dd6037c004aad3
-
SHA1
406285de2f8e61389b7bd31d9dad8d6651af0f82
-
SHA256
aa95f10c49e042783c3b6a391b3d03f206f270ca11110a8e72e23a85de74836f
-
SHA512
6f06451b7a43c029e2ffb3cecade0850cd5cc2ac58dea7d9d0051e61400062d2c8464bb68023db72a6427c6a6b463e4d8730dbebdfc059e0afe220f8349f7c4c
-
SSDEEP
12288:IK5z5eQtqB5urTIoYWBQk1E+VF9mOx9pi:AQtqBorTlYWBhE+V3mO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" eye.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2660 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2036 eye.exe Token: SeDebugPrivilege 2660 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe 2660 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2036 eye.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2704 2036 eye.exe 31 PID 2036 wrote to memory of 2704 2036 eye.exe 31 PID 2036 wrote to memory of 2704 2036 eye.exe 31 PID 2036 wrote to memory of 2704 2036 eye.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\eye.exe"C:\Users\Admin\AppData\Local\Temp\eye.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4482⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2660