File name:	0e282256c760e9ae171f6156dd4af8aae40c21b5d03caebc373ef4f4921bd005.docx
Full analysis:	https://app.any.run/tasks/df87d827-59ac-405d-b553-81c8311de4db
Verdict:	Malicious activity
Threats:	Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	April 12, 2019, 06:39:50
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	generated-doc opendir exploit CVE-2017-11882 loader keylogger hawkeye stealer evasion trojan
Indicators:
MIME:	application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info:	Microsoft Word 2007+
MD5:	1BB40A1BFC34BE84EA0318D0E26CF677
SHA1:	D67DE3F1D8560FDD0F77E6CCA779774B863C37AE
SHA256:	0E282256C760E9AE171F6156DD4AF8AAE40C21B5D03CAEBC373EF4F4921BD005
SSDEEP:	768:hHxrrV0QqkQulc29lMavkj7KRuMw1kb4mTWFJot3qfmeLiLc145PY2Hb3MR/Hns5:/N0QfQuzfkj7KR1Mkb4mOM3eLFgYab8E

.docx	\|	Word Microsoft Office Open XML Format document (52.2)
.zip	\|	Open Packaging Conventions container (38.8)
.zip	\|	ZIP compressed archive (8.8)

ModifyDate:	2019:02:11 21:50:00Z
CreateDate:	2019:02:11 21:50:00Z
RevisionNumber:	1
LastModifiedBy:	ggg
AppVersion:	12
HyperlinksChanged:	No
SharedDoc:	No
CharactersWithSpaces:	-
LinksUpToDate:	No
Company:	-
ScaleCrop:	No
Paragraphs:	1
Lines:	1
DocSecurity:	None
Application:	Microsoft Office Word
Characters:	-
Words:	-
Pages:	1
TotalEditTime:	-
Template:	Normal

ZipFileName:	[Content_Types].xml
ZipUncompressedSize:	1584
ZipCompressedSize:	377
ZipCRC:	0x2284e0ff
ZipModifyDate:	2019:04:08 05:44:24
ZipCompression:	Deflated
ZipBitFlag:	0x0002
ZipRequiredVersion:	20

PID	CMD	Path	Indicators	Parent process
2304	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\0e282256c760e9ae171f6156dd4af8aae40c21b5d03caebc373ef4f4921bd005.docx"	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000
3280	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE		svchost.exe
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900
2360	C:\Users\admin\AppData\Roaming\mentor.exe	C:\Users\admin\AppData\Roaming\mentor.exe	—	EQNEDT32.EXE
User: admin Integrity Level: MEDIUM Exit code: 0
3892	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe		mentor.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400)
2640	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpB794.tmp"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe		RegAsm.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420
2124	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpE106.tmp"	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe		RegAsm.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420


(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	i}6
Value: 697D360000090000010000000000000000000000
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: Off
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:	write	Name:	1033
Value: On
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	WORDFiles
Value: 1317797918
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1317798032
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
Operation:	write	Name:	ProductFiles
Value: 1317798033
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Operation:	write	Name:	MTTT
Value: 0009000010113F97FAF0D40100000000
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	write	Name:	\|6
Value: 7C7F36000009000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:	delete value	Name:	\|6
Value: 7C7F36000009000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:	(2304) WINWORD.EXE	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 0

PID	Process	Filename		Type
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\CVR6DB9.tmp.cvr		—
		MD5:—	SHA256:—
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\28577C25.jpg		—
		MD5:—	SHA256:—
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{890C995F-74F3-4ED0-B0D7-5F1F9924A7C2}.tmp		—
		MD5:—	SHA256:—
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{070FC94A-289A-424D-BEBD-77DDE72FDFEF}.tmp		—
		MD5:—	SHA256:—
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B77EB048-ED10-49D1-9D8F-BC1F6352C185}.tmp		binary
		MD5:94BD9C65EFBE1B3FB57E08AF2410902D	SHA256:0E703AC08A23633BB0FEF8266B46323E7B869FD6BF195A3B97F58E4982027966
2304	WINWORD.EXE	C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm		pgc
		MD5:AC3AD3663829B12E3213EEBBC68AF292	SHA256:7B65A68581F2D5D653CF0DDC1248E16BB211337C723B7BD0CE6E27881013E8DC
2304	WINWORD.EXE	C:\Users\admin\AppData\Local\Temp\~$282256c760e9ae171f6156dd4af8aae40c21b5d03caebc373ef4f4921bd005.docx		pgc
		MD5:7C99770E923CD52D65DCE20DF13DEF2D	SHA256:B1B4DFE841076CF4A2CD8BF04A54D1E5B3180390A7CAEC518DFD1DBA11E86EF5
3280	EQNEDT32.EXE	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\dev[1].exe		executable
		MD5:9E87EE35880C6FA4BB13D09DC5FA9573	SHA256:84469EF8F1C589CA9EBD6A0A9864D16825129C38426B8746C06BB8A82073D54A
3280	EQNEDT32.EXE	C:\Users\admin\AppData\Roaming\mentor.exe		executable
		MD5:9E87EE35880C6FA4BB13D09DC5FA9573	SHA256:84469EF8F1C589CA9EBD6A0A9864D16825129C38426B8746C06BB8A82073D54A
2640	vbc.exe	C:\Users\admin\AppData\Local\Temp\tmpB794.tmp		text
		MD5:3E1E093DCCE32C716267A28292E0EE27	SHA256:56285445424AD06DC043154819B5BDABAA7C26F5779CA3E37E08424ED9926CB8

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3892	RegAsm.exe	GET	200	66.171.248.178:80	http://bot.whatismyipaddress.com/	US	text	13 b	shared
3280	EQNEDT32.EXE	GET	200	188.165.89.65:80	http://188.165.89.65/dev.exe	FR	executable	1.95 Mb	suspicious

Domain	IP	Reputation
bot.whatismyipaddress.com	66.171.248.178	shared
mail.privateemail.com	198.54.122.60	shared

PID	Process	Class	Message
3280	EQNEDT32.EXE	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
3280	EQNEDT32.EXE	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
3280	EQNEDT32.EXE	A Network Trojan was detected	ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3280	EQNEDT32.EXE	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3280	EQNEDT32.EXE	A Network Trojan was detected	ET CURRENT_EVENTS Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
3280	EQNEDT32.EXE	Potentially Bad Traffic	ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3892	RegAsm.exe	A Network Trojan was detected	MALWARE [PTsecurity] Spy.HawkEye IP Check

General Info

0e282256c760e9ae171f6156dd4af8aae40c21b5d03caebc373ef4f4921bd005.docx

1BB40A1BFC34BE84EA0318D0E26CF677

D67DE3F1D8560FDD0F77E6CCA779774B863C37AE

0E282256C760E9AE171F6156DD4AF8AAE40C21B5D03CAEBC373EF4F4921BD005

768:hHxrrV0QqkQulc29lMavkj7KRuMw1kb4mTWFJot3qfmeLiLc145PY2Hb3MR/Hns5:/N0QfQuzfkj7KR1Mkb4mOM3eLFgYab8E

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Equation Editor starts application (CVE-2017-11882)

Downloads executable files from the Internet

Downloads executable files from IP

Detected Hawkeye Keylogger

Actions looks like stealing of personal data

Stealing of credential data

SUSPICIOUS

Executable content was dropped or overwritten

Creates files in the user directory

Executes scripts

Loads DLL from Mozilla Firefox

INFO

Creates files in the user directory

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

XMP

XML

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings