File name: | PO 4080350608.xlsx |
Full analysis: | https://app.any.run/tasks/1e83ffd4-4251-45fe-906b-b92564056f00 |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | May 15, 2019, 07:32:12 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
File info: | Microsoft Excel 2007+ |
MD5: | EC95BC3CD6CFEEAF9577837943A32612 |
SHA1: | DA442DFBF1E30B4AEB98FEEA2766C842C4CF4230 |
SHA256: | 4EDAEC6AA89540448D0DF4783D363A3117CA73944EF5976FDEE2D2250B996F74 |
SSDEEP: | 768:Wr1tL4yYBvycVK+H+/mEFNOuvSaxqmwnYSZQIUTO1:WrLz4tV3HeFnG/YS1UTO1 |
.xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
---|---|---|
.zip | | | Open Packaging Conventions container (31.5) |
.zip | | | ZIP compressed archive (7.2) |
AppVersion: | 12 |
---|---|
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
TitlesOfParts: |
|
HeadingPairs: |
|
ScaleCrop: | No |
DocSecurity: | None |
Application: | Microsoft Excel |
ModifyDate: | 2018:09:22 03:48:48Z |
CreateDate: | 2010:02:14 08:32:05Z |
LastPrinted: | 2017:04:29 14:02:28Z |
LastModifiedBy: | COMPAQ |
Creator: | COMPAQ |
---|
ZipFileName: | [Content_Types].xml |
---|---|
ZipUncompressedSize: | 2041 |
ZipCompressedSize: | 425 |
ZipCRC: | 0x7782a3b5 |
ZipModifyDate: | 2019:05:14 17:08:04 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0002 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
332 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 | ||||
3164 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2104 | C:\Users\admin\AppData\Roaming\regasms.exe | C:\Users\admin\AppData\Roaming\regasms.exe | EQNEDT32.EXE | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3700 | C:\Users\admin\AppData\Roaming\regasms.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | regasms.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3788 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpCF8D.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | RegAsm.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
1232 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpFC0C.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | RegAsm.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 |
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | write | Name: | 6~2 |
Value: 367E32004C010000010000000000000000000000 | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel |
Operation: | write | Name: | MTTT |
Value: 4C010000724BE75BF00AD50100000000 | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete value | Name: | 6~2 |
Value: 367E32004C010000010000000000000000000000 | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
Operation: | delete key | Name: | |
Value: | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (332) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\11F4BE |
Operation: | write | Name: | 11F4BE |
Value: 040000004C0100003500000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0050004F002000200034003000380030003300350030003600300038002E0078006C0073007800000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0001000000000000000036B85DF00AD501BEF41100BEF4110000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
332 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVREE16.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2104 | regasms.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pfhocnifekcwwqi.eu.url | ini | |
MD5:238A868FE1A49146712463160573568F | SHA256:A67011BF2C1BE5F5D03872BE532D24383CEBA6676483D194C9A450C252D27472 | |||
3164 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\tknew[1].exe | executable | |
MD5:2666C2282F63C7E07ED9AD52C46A5426 | SHA256:FE6E0F82A1F503D5D595691F6BFF426FD8381477D21B9D23C4EE103DE5E6A6A6 | |||
3164 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\regasms.exe | executable | |
MD5:2666C2282F63C7E07ED9AD52C46A5426 | SHA256:FE6E0F82A1F503D5D595691F6BFF426FD8381477D21B9D23C4EE103DE5E6A6A6 | |||
2104 | regasms.exe | C:\Users\admin\AppData\Roaming\fayicjocnn\pfhocnifekcwwqi.exe | executable | |
MD5:2666C2282F63C7E07ED9AD52C46A5426 | SHA256:FE6E0F82A1F503D5D595691F6BFF426FD8381477D21B9D23C4EE103DE5E6A6A6 | |||
3164 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat | dat | |
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862 | SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A | |||
3788 | vbc.exe | C:\Users\admin\AppData\Local\Temp\tmpCF8D.tmp | text | |
MD5:3E1E093DCCE32C716267A28292E0EE27 | SHA256:56285445424AD06DC043154819B5BDABAA7C26F5779CA3E37E08424ED9926CB8 | |||
1232 | vbc.exe | C:\Users\admin\AppData\Local\Temp\tmpFC0C.tmp | text | |
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048 | SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9 | |||
3700 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\25291068-43af-3e16-50f6-5889d9ce7904 | text | |
MD5:454353131947D1483FF5470107478978 | SHA256:2DF94DC1C58E952A1EBD1AE1185A291A8A573982CA90EC1BBB87B81126002668 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3700 | RegAsm.exe | GET | 200 | 66.171.248.178:80 | http://bot.whatismyipaddress.com/ | US | text | 15 b | shared |
3164 | EQNEDT32.EXE | GET | 200 | 173.254.126.115:80 | http://www.kemostarlogistics.co.ke/wpp-admin/tknew.exe | US | executable | 891 Kb | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3700 | RegAsm.exe | 66.171.248.178:80 | bot.whatismyipaddress.com | Alchemy Communications, Inc. | US | malicious |
3164 | EQNEDT32.EXE | 173.254.126.115:80 | www.kemostarlogistics.co.ke | Unified Layer | US | malicious |
3700 | RegAsm.exe | 145.239.39.168:587 | mail.pakarabshipping.com | OVH SAS | FR | unknown |
Domain | IP | Reputation |
---|---|---|
www.kemostarlogistics.co.ke |
| malicious |
bot.whatismyipaddress.com |
| shared |
mail.pakarabshipping.com |
| unknown |
PID | Process | Class | Message |
---|---|---|---|
3164 | EQNEDT32.EXE | Misc activity | ET INFO Packed Executable Download |
3164 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3700 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Spy.HawkEye IP Check |
Process | Message |
---|---|
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |
regasms.exe | User32.dll |