hawkeye | 12d16205504a26ca42877320e0dd4adc6c44e0c9314fc9bc07b0ca900f08db58

Analysis

max time kernel
124s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhpDataObject._fdp.exe
Size

2.9MB
MD5

b194af41cab7bf7d0a4818a31c23271f
SHA1

924244e1cd05e292a4ca710f03573b2f6f8d5a4f
SHA256

ddbd74f87f973b4a96f5d08e87fc6553154a913a7beed65113f3010fd99fccdc
SHA512

eaed2565185ceb323a158a4f4a2105910fd643726050772ecdb750b2eab7bb20e57d4774715654cb3bc3ec26d690847fcea2df1b689842d0ab3aff4c19bbb110
SSDEEP

24576:rZQtqBorTlYWBhE+V3mON3BeGixx6YC34gizrpT8FDn+UPk++H0uUP3XXuQ4kP86:rKtqFWM4mEI9jCod/gX/+Hy

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x0007000000015d48-10.dat	Nirsoft
behavioral1/memory/276-36-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/276-37-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/276-45-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2144-46-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2144-47-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2144-55-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/files/0x0007000000015d48-10.dat	MailPassView
behavioral1/memory/276-36-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/276-37-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/276-45-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/files/0x0007000000015d48-10.dat	WebBrowserPassView
behavioral1/memory/2144-46-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2144-47-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2144-55-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Deletes itself 1 IoCs

pid	Process
2660	Windows Update.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	Windows Update.exe

Loads dropped DLL 1 IoCs

pid	Process
2664	PhpDataObject._fdp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 276	2660	Windows Update.exe	34
PID 2660 set thread context of 2144	2660	Windows Update.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PhpDataObject._fdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Update.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	vbc.exe
2660	Windows Update.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	Windows Update.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2660	Windows Update.exe
1872	AcroRd32.exe
1872	AcroRd32.exe
1872	AcroRd32.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2664 wrote to memory of 2660	2664	PhpDataObject._fdp.exe	31
PID 2660 wrote to memory of 1872	2660	Windows Update.exe	33
PID 2660 wrote to memory of 1872	2660	Windows Update.exe	33
PID 2660 wrote to memory of 1872	2660	Windows Update.exe	33
PID 2660 wrote to memory of 1872	2660	Windows Update.exe	33
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 276	2660	Windows Update.exe	34
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35
PID 2660 wrote to memory of 2144	2660	Windows Update.exe	35

C:\Users\Admin\AppData\Local\Temp\PhpDataObject._fdp.exe
"C:\Users\Admin\AppData\Local\Temp\PhpDataObject._fdp.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Roaming\Windows Update.exe
  "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1872
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:276
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BFile_1.pdf

Filesize
853KB

MD5
80efc6aa19efc275b68050edefcbc414

SHA1
dae55a079ca7456e528b0c9926383c713fd7493b

SHA256
ff6f1b548b98c1278c9a80fdf40c653cc537fed639d8a16dce7f77cf91fb9a04

SHA512
b2f611d9abf7c435b1f061720038bff174c0d247e4f4aefbed98644501e15480b4bcecdc17d1a37695f008081085482d271a5059ebef2e5b3d32f348d85671ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
56B

MD5
d8f7513092f5de5d4573d609f40f2e48

SHA1
98340d14a2da04c2c866613ea07290f051b50b1a

SHA256
fa0ceb58d336a38786702b102dae743569fb4ef3c72b210ac456c27d83b7b7d4

SHA512
18d1241e0998d48643fde6888e31f258bbbc6e1dfa1a26f01948a56cbad3478f2707cbe173d9594411d5fc01ddd46bd87b3b639eb705f2253f66727f982e366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e5f5b97372d495dc33fe6f2b3da41c32

SHA1
86ea1d06488c2d6c860f02471e31d9e7789dd751

SHA256
7d0b6a13186de11d0524d1d447a7c08eaf10aa674f926ad3cb28586dc0fc9569

SHA512
844e9b0ae4f749e322e0e7276af10ba1e5548b23de2e3e9f210732a56c852f77a2b6d3f5a704ccd56e65f27e522c52b494662e68470fa0b8bc0383f29477b7c6

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
2.9MB

MD5
b194af41cab7bf7d0a4818a31c23271f

SHA1
924244e1cd05e292a4ca710f03573b2f6f8d5a4f

SHA256
ddbd74f87f973b4a96f5d08e87fc6553154a913a7beed65113f3010fd99fccdc

SHA512
eaed2565185ceb323a158a4f4a2105910fd643726050772ecdb750b2eab7bb20e57d4774715654cb3bc3ec26d690847fcea2df1b689842d0ab3aff4c19bbb110

Download Submit
memory/276-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/276-45-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/276-36-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2144-55-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2144-47-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2144-46-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2660-13-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-38-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-39-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-40-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-41-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-12-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-48-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2664-11-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2664-0-0x0000000074E71000-0x0000000074E72000-memory.dmp

Filesize
4KB

Download
memory/2664-2-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download
memory/2664-1-0x0000000074E70000-0x000000007541B000-memory.dmp

Filesize
5.7MB

Download