5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Sharing

Copy URL Twitter E-mail

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260815-nvfvfsbk2s
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  windhawk_setup.exe
- Size 11.0MB
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
- MD5 a1a8fbcbde2d70638957f3e69a8e034b
- SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
- SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
- SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
- TLSH
  T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  Compiler/include/wil/windowing.h
- Size 5KB
- SHA256 1a998285702f7fe94c5c4173d469a209b04555dbae3c5bec7162d68b8a7a138c
- MD5 af05d6d951339159040c6e90b4baeeed
- SHA1 cf0222d8e1225c1d65351cd9e55d11383f0e6ae3
- SHA512 1ceedf7a24fd29e86c9799de89841fcf0b6736cc03257fb70ff8589ca62f29a682cc48da1286d4e78f45bf91c73563fa99c3736eaecedf22f403398859270799
- SSDEEP 48:0C8QHFs0L7PBCilMHoBnkwE6HObkRTzMfUMXoJnUwQ/5PBFjxZ4Ux5+PBad49mBd:0C8QH9PBFooBbxBz4oJLQhz/Uce6noBG
- TLSH
  T151C10D4420376FA60DB1DFBA8605A3D1E62F64430F6F0612709DB3A16FFE5228399DC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Compiler/x86_64-w64-mingw32/bin/libc++.dll
- Size 2.0MB
- SHA256 74c541f76732d738642072e90f26343e44d66d97bb258db76f2f3bee7e30060c
- MD5 c8c00080c39825ffa74538fa15ff8000
- SHA1 f64e9091821a92d88c67f890d2b2a4311b066d7e
- SHA512 015c41ad8012255169772a21c629d8b7872f3b5ae3a318b54d879e4e078ebc349db85b38b636e0d44b63461e48916927d9956eff13bb2f038f8846d501f063e4
- SSDEEP 24576:tCVr3dvcA1YczEni9PzCaLrrAUpshSMXl2hTdR7l5SLujr+w4gCxSJBpKcKF5itY:41YczEniJCarrtfJBpKc2
- TLSH
  T11AA56C03A3E6CE5AC89EBB7491C7271AB334BD5117F75ADB521053206E837C99A3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Compiler/x86_64-w64-mingw32/bin/libunwind.dll
- Size 211KB
- SHA256 6e6d1e74d17ee361b3f3661faa3d07fa7597257df1cd3dd360719222e54aa36c
- MD5 30a2d4c1be541c3e7b15f25b07f710b3
- SHA1 6039918e2df8935ba3e8c8811d39855ef7824cb3
- SHA512 05e5e1926052000138bf87dc76020fc6a868da102b9978c9ba75766fed764f5b490b09d4195f8234778c82c7ae0c91ac43723c00af6cc60991252656087d8aae
- SSDEEP 1536:B/OQPJIbKEP1Qs7WdfVf/HrJW5hsfhmMHU3jXvLmbAY2j8SCmQ2FIeXi2MIL80Yl:B/OQPJIbj1lydtXavKwBl3FvXitIAJz
- TLSH
  T1C7244B4A97D1DE7BC91182328CA70718BB35E4911B439FCB2F0811797F637D8AE76A09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
- Size 88KB
- SHA256 cb4808ede8e31abb5142657187ebf51449331112c1679a3bca6792d6d1fe09bf
- MD5 946e03bbb184c44ca1a5e08be297ef53
- SHA1 65b6bc5fcf858943dbbdc13c1113c15d1bab9bd2
- SHA512 7e16c3787d6a06859cc950d4037fb4b9f744263154396272afebb75d3d271bea0d1e5ab664f32503d2a8a427d0cabe4f028cea297a909a9c64906e379fe08d23
- SSDEEP 1536:PtnI5t/JW5hsfgMHU5M/xS74Z1aJboKWRs8bXhnR9bfI7uw:FnI5tlx64Z1+us2G7d
- TLSH
  T1E3935B8B8761DB67DD408B32C1A7471ABB35E2430B424BDB692542385F53BE88F7B709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Engine/$R1/32/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 d9c4fd69f7bc0bf1f9066df0502a57de5f6d73dfff99c9fe5c75b491aecee86b
- MD5 81dfefdd5a24792d13f3096601a9b4a0
- SHA1 c994d24f553bc0c2376f0ef2142817699bc69272
- SHA512 6cd665b52d32eb1438bf48b5bb75c5ca8a6004b61633cfb7c888a42875c222041f5360501acc33962b059ba44e85f0e4807370b63554ce15f6191930d66c1c17
- SSDEEP 49152:0bQhj1xxRKpH9srFVSvI38QvLQ3ZdtrgDQtpYyB:00hj1olcFVCY8QS
- TLSH
  T1CAA53931E61ECA35DA8C1070AC39BB5F026DBA6E0B2555C7B3A41E3D6E325C27B34947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Engine/$R1/32/symsrv_windhawk.dll
- Size 320KB
- SHA256 7a9fadded044916c645789a1e7185b0bc83f226052dc93015d59826541dcfa4a
- MD5 7c424c4ca79cf880a0ee31888036dd58
- SHA1 2e6debed8fa94c91dd483311fbcb09d70b2d9df3
- SHA512 ae06e52a7bb0111b1d566079cb907b2437e9f99ca07b3dffae76e149f41ca375cb0e5eca6f4bdf939e98d9506c93817b98f365842691567ac038545aa5d74c58
- SSDEEP 6144:Iyd17qp3JfUkAa/Bvk3j7DndpaXPSUh/4+LRA:Iy37W3dhGXdEKUhAIRA
- TLSH
  T1A9643A2366D89175F9FB36B47AFCA669867D79A04B72C1CF1240968F0865AC09F30373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Engine/$R1/32/windhawk.dll
- Size 905KB
- SHA256 67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f
- MD5 f7bb000645c99f89ff38c6f7616c205f
- SHA1 4f76a9b030ecb1b9b9861e5be2787f63e78c0723
- SHA512 33623281a35d29ee18d59fc9d286b9c83903d781b5634d4d9fc7918cc5b74027cb2d9f6fd8ecf35391c201549068d1898cada742c6947c00bfc9cbb91c1ee6e7
- SSDEEP 12288:vPtFKXRL67yB1dEQ3d6GHBKLP+M+sWe1NUtcpNd+5w6uZNZcLpixp:3tRI1dvBOWM+sWeDww6uXZcLpixp
- TLSH
  T132153A72EE41B433ED3419345DA6076B663E91A0976281C7278C293E5DD1BD02F32FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  Engine/$R1/64/msdia140_windhawk.dll
- Size 2.1MB
- SHA256 6465aca7b9a162726ca98c6e633fc70b8cb2a8c0a4f90c2b32e0ca99fb5f9cf8
- MD5 8851e33bd5380f05720d25139d6f84cd
- SHA1 481577bdebd28ed0d6db90f181dbb09998f26c89
- SHA512 98e785d61ea14be511f27d9c865780f237ab0f5276f8a0feb921ac102c81ab6076e4a03ca088f2609c3cdedba040140ce258359c8479c2cd3d877c7bcafbed16
- SSDEEP 24576:i4xB9eY1DnidGfmPPUmSyankyA7IJ7cPBNWOWtY/YmBpoMXyOkr0ZZ+1E:+kZmHZSywAIJUBNYtYAmL6Okr04E
- TLSH
  T10DA57C67F3A841ACD1BAC07CC56B9606EBB278460320A7DF12A0567E7F13BE159BD311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral16 behavioral17
- Target
  Engine/$R1/64/symsrv_windhawk.dll
- Size 422KB
- SHA256 67bdff85d161888f2c6a8a385f9b35aa1c1c231ed3b59c01fa54f598ac37d374
- MD5 2148e12ba31e49c815b83d52af8d2a61
- SHA1 abb520caf7133df5f61b787367d84859de375d31
- SHA512 26aec2331fc040ec13f6e81555a05d1d9f41e5e74ce23375a1d4f0a4aa1cb4e3a5d82259ba4f2e8ffafcfe3252cef7b60b5aee4a2745d0a04d7ccd8765876f33
- SSDEEP 6144:0Y7jrEtTBlB+HqbtYnwbnt7aSjAGqx0lcdEzlDy21qar2bXQY:0YgJ64Yct7a+AG8zi1yUqc2T
- TLSH
  T13A94192DE7E80465F1B2B5388AB78605D7B278A91775D2CF1194C13E0E27FE4AA34B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Engine/$R1/64/windhawk.dll
- Size 956KB
- SHA256 0aad074caf156200be7a77e4615f9171cea884cde96baf90397366c28c4f10a1
- MD5 5e377e811ac2772eb6ecaaf04063ac3d
- SHA1 6d1f24c87be48ef93ffd6773957f73eda7652192
- SHA512 3b5686eb8501015edf228d9552f55c89450934f69f2553069018188b5483b1f9ced43010a9a105cdc29dbf012f300a6652e60662f4c1a76b198b8ceb019d5af2
- SSDEEP 12288:LuItYj/l9fjIoAQ2BAM7UtcpNj+5goVuQxrDY:L8j/zUoArAKu7Vu+4
- TLSH
  T105253BB3EF502476E831953489B30727A27BB4909761C6CB2748252E1ED2BE02F36F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Engine/$R1/arm64/msdia140_windhawk.dll
- Size 4.8MB
- SHA256 385ce9aae0dc0cdcbfa21e86abca5a9ea4a7fbf891d43b51852fa7d023a629cf
- MD5 134053ab9dc9f855bc0bad52a05e3abc
- SHA1 4bd552ab8f7f21c370aec808363b358c9140d71c
- SHA512 9ffc60ab29e8e6fdddbd58e775b9efad4c8fb438a4f63b92ffae2004b7814d7abefb107eb79998f3f549f1743ee2da131fa3e6e8a64546710b07edbdbc7ed1ab
- SSDEEP 98304:EzqS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0KB7cFLDiXEpYk23pnaV2sd2xF6tjRxy:RS75B5XaeJ/ggFx6sQ22LJIwK/gr+o0e
- TLSH
  T1AF365C11AE8CA835D2DAD33CEFA34F60213BF574C0688D87F25A035CED96FC19596296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Engine/$R1/arm64/symsrv_windhawk.dll
- Size 708KB
- SHA256 97610e918b8f33fa5ce3b337512534d817057f1bcbed257241aca0c7f30c65ea
- MD5 0f965e8d97122f7ecbc01dca6ee16a61
- SHA1 4a9c724c922b57220858004861511b67b7bfeda9
- SHA512 1bc1fc5a6615e82f4709a4662b136a57ab211cf123dc796d7eb07d67e869cee62f2a2e82a125336d54d81fbf902f212fa448ef33985ceabddd563690ced79af4
- SSDEEP 12288:fyJ+9eO2zqg7XRueQEYpOfUQuj6VhHaYk+nyo3M9NdaknHX:xLjYkzo3Mdakn3
- TLSH
  T167F42A826ECC9845D2D6F73EDC678A24633BB8BD4438D24B6142220FDE9D7C4D9A1763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Engine/$R1/arm64/windhawk.dll
- Size 1.7MB
- SHA256 60c72a84289f333704c8e35d21e7b1362d0481c426041daac0e5eb7af7d13c1c
- MD5 6b285136c41ed5d042ac4d7c153e933a
- SHA1 fefe4bcd935eb2f33502c9d96ed5366b6c575e4c
- SHA512 477ed9ff44d10284d83c7616966397e57f3bed4356ac0a29f62ebc8cd6f76a3b410e832eb6e9b531f59ee61d552eb642aab878170357d7809f90c0f31c2fb663
- SSDEEP 12288:CeQuh4pjNWiwruly0WkVYuLYIL1IBR7KzlWStymDyUEdOZvvATM30ZwRrlDuhsy:rubWiwrul/YJVmDyUEdO1vjrJgsy
- TLSH
  T1C285C5F85F0844EBE1E5E73CBE614D39603D2C76D6A919C600229F07D85AE9872E1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  UI/resources/app/extensions/clangd/out/bundle.js
- Size 797KB
- SHA256 4537d7e62ce3fd248775b44a8df926d183417767d83510f3ec96193d2bdc8400
- MD5 2a1e30271097955b02d3d2e68f0a16b0
- SHA1 5620916ca1cfb36e23bbd9ffa91f7fae0a13993f
- SHA512 0398c9be10070deedec92572241b7687293c865262970734bc0b8e17d63100e727ec28231afab89a2a5bc4de7c4012d1fc13c9c68ce6ed5f610290ebba78fd9e
- SSDEEP 6144:rZGO52dyh05f+g5jw1oMoZdjduXI5WzzRCy0tCL5qSyUQ5/usqY03XEI4elgPyef:dGO5sgWVTIUTnBhLOo7P6K
- TLSH
  T18C05E6D5F2A122AE229E938CDCA6006EA5B710F8600DB434F5C4ECDD149DECD5267A7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  UI/resources/app/extensions/windhawk/assets/main-icon.svg
- Size 2KB
- SHA256 084a27f3ced9a7527d7fc453e0d94f3e3d668b14f30aff6b3ad0af8a5ff69509
- MD5 e644197c4f128b379c68a3f5b573568c
- SHA1 1f70edd30ef7fe22ca0c872c3f359a9d03c85d62
- SHA512 aab9e4b5b1415773bfdc647113fabfd5edeadd7342c7d2f9aca610474d83290a2bf7f0a59984ad80918dc7cec38a6651f77bb8f4b8c73ea744640172317d3962
- TLSH
  T1D841B828830803F4F21E170CC5C578FA32D878DBB248F69890193DA5E5EAD580C2B0DE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  UI/resources/app/extensions/windhawk/assets/tab-icon-black.svg
- Size 1KB
- SHA256 40424e2915a4790058b86b8c855748b73e977ab2a9b18ca0359819eb55f6d18f
- MD5 a8100c7b4c31ae9d93696a9794e3cd9e
- SHA1 384c6c3946897ced5ff759b9bb03a333b5969681
- SHA512 80f20509ecf5f513ada305ec158ebc9084a67c1f1c02e5dec045df150897a762ef5f6a8fb6e7ed66941d74b895176b52dd843f640c8ae1c2bf3aaec27a0d1f94
- TLSH
  T1C521B12AC2600B74AA4E123C55F449F139C8EDDCE198FABD689B5011F02C6A5A461BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32