Overview

overview

10

Static

static

Purchase O...EE.EXE

windows7_x64

10

Purchase O...EE.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order_23011008_PDF ________________________ iGSTEEEE1124EEEEEEXEEEE.EXE

  • Size

    1.8MB

  • Sample

    200624-gvj2cln59x

  • MD5

    cc5e307e68ccb5b363a1d8125e0edfb1

  • SHA1

    0937747b83e0624bec024daadeaf5c7effdbcb36

  • SHA256

    82ffa88d2b058317fcbc1af1c6fe06d7927be41ee28c7473a397f3db42670ca5

  • SHA512

    ac464272963a2208cf7061e22c75d2ae5b9c76ade74cd1c21aeb28690d2d2ccee45c2cfafe09ad588a56a802f438dfc9a56e60792f87e483db727b8286968815

Score
10/10
hawkeyeevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Purchase Order_23011008_PDF ________________________ iGSTEEEE1124EEEEEEXEEEE.EXE

    • Size

      1.8MB

    • MD5

      cc5e307e68ccb5b363a1d8125e0edfb1

    • SHA1

      0937747b83e0624bec024daadeaf5c7effdbcb36

    • SHA256

      82ffa88d2b058317fcbc1af1c6fe06d7927be41ee28c7473a397f3db42670ca5

    • SHA512

      ac464272963a2208cf7061e22c75d2ae5b9c76ade74cd1c21aeb28690d2d2ccee45c2cfafe09ad588a56a802f438dfc9a56e60792f87e483db727b8286968815

    Score
    10/10
    keyloggertrojanstealerspywarehawkeyepersistenceevasion

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Uses the VBS compiler for execution

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies system certificate store

      evasionspywaretrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks