File name: | SAMPLE 1.xlsx |
Full analysis: | https://app.any.run/tasks/2f3d228e-c7f7-4df5-87fc-4d47974ee210 |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | May 15, 2019, 12:28:28 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | 838EA98BEE62D88EF637DCA379199FC9 |
SHA1: | CAFC420B7C46DAECF4253F5DED512935E0386B2C |
SHA256: | 482343BF86E2A311F3F4D2E7B7E88D03D24CD74F3B80B619642B98EB654AA7E8 |
SSDEEP: | 768:crb9iyYBvycVY+H+/k6FNOuvSNNxqmSnYa1iI7Crx6P:cr74tV9HaFnNBYabe0P |
.xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (31.5) |
.zip | | | ZIP compressed archive (7.2) |
AppVersion: | 12 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2018:09:22 03:48:48Z |
CreateDate: | 2010:02:14 08:32:05Z |
LastPrinted: | 2017:04:29 14:02:28Z |
LastModifiedBy: | COMPAQ |
Creator: | COMPAQ |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2041 |
ZipCompressedSize: | 425 |
ZipCRC: | 0x7782a3b5 |
ZipModifyDate: | 2019:05:15 11:01:12 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0002 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2356 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.4756.1000 Modules
| |||||||||||||||
2560 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
2508 | C:\Users\admin\AppData\Roaming\regasms.exe | C:\Users\admin\AppData\Roaming\regasms.exe | EQNEDT32.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 Modules
| |||||||||||||||
972 | "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\AppData\Roaming\regasms.exe:Zone.Identifier" | C:\Windows\SysWOW64\cmd.exe | — | regasms.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
304 | "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\admin\AppData\Roaming\regasms.exe:Zone.Identifier" | C:\Windows\SysWOW64\cmd.exe | — | regasms.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3016 | "C:\Users\admin\AppData\Roaming\regasms.exe" | C:\Users\admin\AppData\Roaming\regasms.exe | regasms.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Version: 0.0.0.0 Modules
| |||||||||||||||
2836 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | regasms.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 Modules
| |||||||||||||||
2888 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | — | regasms.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5483 Modules
|
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | `n |
Value: 606E7F0034090000010000000000000000000000 | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 2057 |
Value: On | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: 34090000340732BF190BD50100000000 | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | `n |
Value: 606E7F0034090000010000000000000000000000 | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | EXCELFiles |
Value: 1320091671 | |||
(PID) Process: | (2356) EXCEL.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1320091782 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2356 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRE2E0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2836 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holdermail.txt | — | |
MD5:— | SHA256:— | |||
2888 | vbc.exe | C:\Users\admin\AppData\Local\Temp\bhvD7EE.tmp | — | |
MD5:— | SHA256:— | |||
2888 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holderwb.txt | — | |
MD5:— | SHA256:— | |||
3016 | regasms.exe | C:\Users\admin\AppData\Roaming\pid.txt | text | |
MD5:53A1320CB5D2F56130AD5222F93DA374 | SHA256:DEE71B933E851F0080386652C75645778D2804D4C595ADB9978355A73461AABC | |||
2356 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:9DBE65FD73EF2A462B5818E1262BEC13 | SHA256:457492B179F1E097E6D897FAFFBB847B92BAADA27160CCC25CCC1108F36BDEFF | |||
2560 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\regasms.exe | executable | |
MD5:026FF703DCB28D5371B6E3A97DB308C1 | SHA256:3FF1A3A058F07321DA57AA12D5D522656DBB72AA93E3DE605FF296B36F1DEB8D | |||
3016 | regasms.exe | C:\Users\admin\AppData\Roaming\pidloc.txt | text | |
MD5:88C1B15B3CD917CE51D1A452FB2B9248 | SHA256:C64CC16E8D97D374763B4C440AE350D3EA714ED2519E1C8E615B16694D843DCD | |||
2356 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\SAMPLE 1.LNK | lnk | |
MD5:F59330FE92D363A69D9892910B9011EE | SHA256:4E129368567830126BDBAB6C3B00C859B29CA45F196F75F746470C2AA2D101F5 | |||
2560 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\my%20boy[1].exe | executable | |
MD5:026FF703DCB28D5371B6E3A97DB308C1 | SHA256:3FF1A3A058F07321DA57AA12D5D522656DBB72AA93E3DE605FF296B36F1DEB8D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3016 | regasms.exe | GET | 403 | 104.16.154.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
2560 | EQNEDT32.EXE | GET | 200 | 153.92.6.11:80 | http://resisterma.com.br/proforma/my%20boy.exe | US | executable | 890 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3016 | regasms.exe | 104.16.154.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
2560 | EQNEDT32.EXE | 153.92.6.11:80 | resisterma.com.br | Hostinger International Limited | US | suspicious |
3016 | regasms.exe | 166.62.28.91:587 | webmail.ststyle.me | GoDaddy.com, LLC | US | malicious |
Domain | IP | Reputation |
---|---|---|
resisterma.com.br |
| malicious |
whatismyipaddress.com |
| shared |
webmail.ststyle.me |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2560 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3016 | regasms.exe | A Network Trojan was detected | MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck) |
3016 | regasms.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
3016 | regasms.exe | A Network Trojan was detected | MALWARE [PTsecurity] MSIL/Golroted.B/Hawkeye Keylogger Sending Data via SMTP |
3016 | regasms.exe | A Network Trojan was detected | MALWARE [PTsecurity] MSIL/Golroted.B/Hawkeye Keylogger Sending Data via SMTP |