analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

TT_PAYMENT_COPY_JPG.rar

Full analysis: https://app.any.run/tasks/3d4813a3-810d-44df-a789-c5e52e665b59
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Analysis date: November 15, 2018, 18:12:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

99031C1136BFECE8D19A8D96EBE8FAF1

SHA1:

040BEE40675AC261FE52EB50373027919AC1A5F6

SHA256:

57C1A0F78ECFB59DAAC9F7369657684845E32C4BC79DDEAF3CB470AB1E051A7E

SSDEEP:

12288:tnzHIxIBNCtN5viYdxBze+T85SxigCG0qmXNTdyNoLknnDyxNfxEI:tHwUEtBM+wEA00vXNTd/knnk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TT_PAYMENT_COPY_JPG.exe (PID: 2956)
      • TT_PAYMENT_COPY_JPG.exe (PID: 564)
      • TT_PAYMENT_COPY_JPG.exe (PID: 3984)
      • TT_PAYMENT_COPY_JPG.exe (PID: 2692)
      • TT_PAYMENT_COPY_JPG.exe (PID: 1904)
      • TT_PAYMENT_COPY_JPG.exe (PID: 3604)
    • Detected Hawkeye Keylogger

      • TT_PAYMENT_COPY_JPG.exe (PID: 564)
      • TT_PAYMENT_COPY_JPG.exe (PID: 3604)
    • Stealing of credential data

      • vbc.exe (PID: 3260)
      • vbc.exe (PID: 3552)
      • vbc.exe (PID: 3140)
      • vbc.exe (PID: 3412)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3260)
      • vbc.exe (PID: 3552)
      • vbc.exe (PID: 3140)
      • vbc.exe (PID: 3412)
  • SUSPICIOUS

    • Application launched itself

      • TT_PAYMENT_COPY_JPG.exe (PID: 3984)
      • TT_PAYMENT_COPY_JPG.exe (PID: 2956)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2788)
    • Executes scripts

      • TT_PAYMENT_COPY_JPG.exe (PID: 564)
      • TT_PAYMENT_COPY_JPG.exe (PID: 3604)
    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 3260)
      • vbc.exe (PID: 3412)
    • Connects to SMTP port

      • TT_PAYMENT_COPY_JPG.exe (PID: 564)
      • TT_PAYMENT_COPY_JPG.exe (PID: 3604)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 643273
UncompressedSize: 1148416
OperatingSystem: Win32
ModifyDate: 2018:10:14 17:59:22
PackingMethod: Normal
ArchivedFileName: TT_PAYMENT_COPY_JPG.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
11
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe tt_payment_copy_jpg.exe no specs tt_payment_copy_jpg.exe #HAWKEYE tt_payment_copy_jpg.exe tt_payment_copy_jpg.exe no specs vbc.exe vbc.exe #HAWKEYE tt_payment_copy_jpg.exe tt_payment_copy_jpg.exe no specs vbc.exe vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
2788"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\TT_PAYMENT_COPY_JPG.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3984"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2956"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
564"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe
TT_PAYMENT_COPY_JPG.exe
User:
admin
Integrity Level:
MEDIUM
2692"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" 2 564 6252281C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exeTT_PAYMENT_COPY_JPG.exe
User:
admin
Integrity Level:
MEDIUM
3260"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmp9210.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
TT_PAYMENT_COPY_JPG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3552"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpA81A.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
TT_PAYMENT_COPY_JPG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3604"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe
TT_PAYMENT_COPY_JPG.exe
User:
admin
Integrity Level:
HIGH
1904"C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exe" 2 3604 6328671C:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exeTT_PAYMENT_COPY_JPG.exe
User:
admin
Integrity Level:
HIGH
3412"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpBBFA.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
TT_PAYMENT_COPY_JPG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
563
Read events
522
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
564TT_PAYMENT_COPY_JPG.exeC:\Users\admin\AppData\Local\Temp\5c3f14c3-35ed-56cf-c498-6edeaf57da4dtext
MD5:7095FE110E5B0EE91CBF8A334D10848B
SHA256:96A81C233E9C5875ED15FD2DF1599ECA486CFDD55C1059FAE0FA39DD0FE1165C
564TT_PAYMENT_COPY_JPG.exeC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70binary
MD5:DA6C793FB0533AF0139A6D76C9956547
SHA256:BCEC4BFFD8EE03E0FDF1C1577EF4635AC08DB1F94CF07B0C406A6B3A171E9E1D
3260vbc.exeC:\Users\admin\AppData\Local\Temp\tmp9210.tmptext
MD5:C48992AAE0E8FD5463A7B1617B2E0B88
SHA256:04802C51A3EE5E9F7D48462C50B17ABC0E84D54F5525D70E4C904BCC0634C3CE
3412vbc.exeC:\Users\admin\AppData\Local\Temp\tmpBBFA.tmptext
MD5:C48992AAE0E8FD5463A7B1617B2E0B88
SHA256:04802C51A3EE5E9F7D48462C50B17ABC0E84D54F5525D70E4C904BCC0634C3CE
2788WinRAR.exeC:\Users\admin\Desktop\TT_PAYMENT_COPY_JPG.exeexecutable
MD5:55EDBA666A072E061B54255EFAB77F70
SHA256:99E3376AF2ADE91A79CEB8AED9E74BEDB33B69FC48DA73B3B3F93D8C7E85830C
3140vbc.exeC:\Users\admin\AppData\Local\Temp\tmpBFF2.tmptext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
3552vbc.exeC:\Users\admin\AppData\Local\Temp\tmpA81A.tmptext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
564
TT_PAYMENT_COPY_JPG.exe
66.23.237.186:587
mail.britesurgical.com
NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC
US
suspicious
3604
TT_PAYMENT_COPY_JPG.exe
66.23.237.186:587
mail.britesurgical.com
NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC
US
suspicious

DNS requests

Domain
IP
Reputation
mail.britesurgical.com
  • 66.23.237.186
unknown

Threats

No threats detected
No debug info