5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260812-wzpbdssend
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery spyware trojan execution persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
- Size 80KB
- SHA256 1c0e8105bdfb3c6a7f3a2ebd2f25e38e7c23dd66619364a3fe620e6603a0ba2d
- MD5 573ad7658e2f461bf11d5d1b61eaebd4
- SHA1 9730ed057bab427176eedbee8f583ff196e08d79
- SHA512 a3a1bd2cfdb71473e720cafbccac5df21db7e81af7ba67900ab041dd7d96d058ea60453bc1fc08b85350ab3a8825dcc8a2340ab5f8a62dabc593017a0a197941
- SSDEEP 1536:8aa8DgRl8sOQ0tolEGrhsEg+QOphmZgW0GNLd/IohnR91fIgUB:8aa8Dgz8t9tAW0GDIBgy
- TLSH
  T1EE837D499B24EB77DD424F3194E78312AE39C2530FC209AB9D6686705F933E98F5370A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 15KB
- SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
- MD5 d74bb4447af48da081c7d9b499f3a023
- SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
- SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
- SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
- TLSH
  T1B362A6124FF90BFEF1F16B352AB5553303A2B50124B1C21D5B91CE9A2831B9B5D74327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 198KB
- SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
- MD5 91c2e2f34b5bba068e9a6178e13a4e5c
- SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
- SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
- SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
- TLSH
  T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
- MD5 40d7eca32b2f4d29db98715dd45bfac5
- SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
- SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
- SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
- TLSH
  T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  AppData/Engine/Mods/32/windhawk-mod-shim.dll
- Size 80KB
- SHA256 1c0e8105bdfb3c6a7f3a2ebd2f25e38e7c23dd66619364a3fe620e6603a0ba2d
- MD5 573ad7658e2f461bf11d5d1b61eaebd4
- SHA1 9730ed057bab427176eedbee8f583ff196e08d79
- SHA512 a3a1bd2cfdb71473e720cafbccac5df21db7e81af7ba67900ab041dd7d96d058ea60453bc1fc08b85350ab3a8825dcc8a2340ab5f8a62dabc593017a0a197941
- SSDEEP 1536:8aa8DgRl8sOQ0tolEGrhsEg+QOphmZgW0GNLd/IohnR91fIgUB:8aa8Dgz8t9tAW0GDIBgy
- TLSH
  T1EE837D499B24EB77DD424F3194E78312AE39C2530FC209AB9D6686705F933E98F5370A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  AppData/Engine/Mods/64/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Compiler/aarch64-w64-mingw32/bin/libc++.dll
- Size 2.0MB
- SHA256 a9cadefd91f34043163fa8eacb44ca7b73abc0918b9cd834a7326cd38c3adb73
- MD5 46b9c144c0d560a592f523678cea16e1
- SHA1 4718130fea9ffd5db85491eb57697681e02840f2
- SHA512 fa78e6bc133b801ceb293b49de505479a0d78efe24a930032bf798ce69c7d192ac7cb09576248361311ced7042e62181cfb24e06121f51bc045d2365f9a49227
- SSDEEP 24576:0/HUz9U0fpjYzJZeMjQ8icHzDgQUA1t81N75Wey/ftLmpyHtgJBchSMXl2hmR7l3:iUz9pJeIPvSYIBpKGV
- TLSH
  T168A58E125BFECE07CDCA7F3869DB2B25B338AD9052B706A781159119EDC37C6D91AB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Compiler/aarch64-w64-mingw32/bin/libunwind.dll
- Size 200KB
- SHA256 271b6d7cc0d9e1cc189b163499a44c25abafce702f71c154ffe54ca8eccc564a
- MD5 d4dbf971a85c8cd1b015f5793c1e4cea
- SHA1 78e37e943a2852cbc461ba4bdb87c4cf22aad440
- SHA512 7726c4fc70bcf17bc60a40634a2a8eb2ab52e0840c734984a1524aca91cb88ffe4f10b3c0b5525b6b30787057924800e9e9e70a1d9da10b639162f0e952a2e9d
- SSDEEP 3072:jN1h81WxfhNgX8yWkkDZOSvFZhx3bxxR:R1VakUghV
- TLSH
  T193144A66DBD0CF67C895423888FB0B25BB31C89503475B0B4D05607ABF937D8EEDAA49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32