analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PO 181218.zip

Full analysis: https://app.any.run/tasks/dde2324b-a2ba-4094-99a3-be9a440d5603
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: December 18, 2018, 14:41:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
evasion
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

801ABFB857B9172AC48E7293A67ECBE2

SHA1:

A14A2CF3FF7AD06FD03CF0A4AC861D3AA6849F0B

SHA256:

B07C8FBED141993F3EAFE71859599F2B1FFC5AF88890EAD4217DA3359D74C5A4

SSDEEP:

12288:gm1tD4sP2jP47JZZ6Jw+MKNn5lgo7kezNRRVv3xDZlYCAE3iKDuAU5i9hf:j1ljIMK5goIebvh1lJ7yIU5i9N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PO 181218.com (PID: 2988)
      • PO 181218.com (PID: 1324)
      • Windows Update.exe (PID: 2648)
      • Windows Update.exe (PID: 4000)
      • Windows Update.exe (PID: 3304)

    • Changes the autorun value in the registry

      • Windows Update.exe (PID: 2648)

    • Detected Hawkeye Keylogger

      • Windows Update.exe (PID: 2648)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2408)

  • SUSPICIOUS

    • Application launched itself

      • PO 181218.com (PID: 2988)
      • Windows Update.exe (PID: 4000)

    • Starts application with an unusual extension

      • PO 181218.com (PID: 2988)

    • Executable content was dropped or overwritten

      • PO 181218.com (PID: 1324)
      • Windows Update.exe (PID: 2648)

    • Creates files in the user directory

      • PO 181218.com (PID: 1324)
      • Windows Update.exe (PID: 2648)

    • Starts itself from another location

      • PO 181218.com (PID: 1324)

    • Connects to SMTP port

      • Windows Update.exe (PID: 2648)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 3824)

    • Checks for external IP

      • Windows Update.exe (PID: 2648)

    • Executes scripts

      • Windows Update.exe (PID: 2648)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 1998:01:29 19:00:18
ZipCRC: 0xbec87f78
ZipCompressedSize: 672846
ZipUncompressedSize: 948072
ZipFileName: PO 181218.com
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs po 181218.com no specs po 181218.com windows update.exe no specs windows update.exe #HAWKEYE windows update.exe vbc.exe vbc.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2824"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PO 181218.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2988"C:\Users\admin\Desktop\PO 181218.com" C:\Users\admin\Desktop\PO 181218.com—explorer.exe
User:
admin
Company:
Thermy3
Integrity Level:
MEDIUM
Description:
SUBOXIDE
Exit code:
0
Version:
5.02.0004
1324C:\Users\admin\Desktop\PO 181218.com" C:\Users\admin\Desktop\PO 181218.com
PO 181218.com
User:
admin
Company:
Thermy3
Integrity Level:
MEDIUM
Description:
SUBOXIDE
Exit code:
0
Version:
5.02.0004
3304"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe—PO 181218.com
User:
admin
Company:
Thermy3
Integrity Level:
MEDIUM
Description:
SUBOXIDE
Exit code:
3221226540
Version:
5.02.0004
4000"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
PO 181218.com
User:
admin
Company:
Thermy3
Integrity Level:
HIGH
Description:
SUBOXIDE
Exit code:
0
Version:
5.02.0004
2648C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Windows Update.exe
User:
admin
Company:
Thermy3
Integrity Level:
HIGH
Description:
SUBOXIDE
Version:
5.02.0004
2408C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Windows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3824C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe—Windows Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
1864"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
915
Read events
875
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2824WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2824.13620\PO 181218.com —
MD5:—
SHA256:—
2408vbc.exeC:\Users\admin\AppData\Local\Temp\holdermail.txt —
MD5:—
SHA256:—
3824vbc.exeC:\Users\admin\AppData\Local\Temp\holderwb.txt —
MD5:—
SHA256:—
2988PO 181218.comC:\Users\admin\AppData\Local\Temp\~DF82501B7F14B67D3A.TMPbinary
MD5:2F3D25133FFE11927DA73637C9F22B11
SHA256:8CD8F1064977DFE5F735C1557D89916D2031FDEF5EDC01759E6FF7A066ED27EF
4000Windows Update.exeC:\Users\admin\AppData\Local\Temp\~DF31F538C17D72CBCD.TMPbinary
MD5:2F3D25133FFE11927DA73637C9F22B11
SHA256:8CD8F1064977DFE5F735C1557D89916D2031FDEF5EDC01759E6FF7A066ED27EF
2648Windows Update.exeC:\Users\admin\AppData\Roaming\WindowsUpdate.exeexecutable
MD5:693442EE86A81A91A273B0F46FE9C099
SHA256:4FC07CF08B59B6B392D18B65EC45A55D3DB6F8AB5AC6C09C6774CA525A2C49D9
1324PO 181218.comC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:2EBCBFC9DF19C5003E3DAAC8FE05C3F0
SHA256:DB48759C644F76957CF4B3D5D41FCACE203E91A143BCB7034EBEC220048E8A7B
1324PO 181218.comC:\Users\admin\AppData\Roaming\Windows Update.exeexecutable
MD5:693442EE86A81A91A273B0F46FE9C099
SHA256:4FC07CF08B59B6B392D18B65EC45A55D3DB6F8AB5AC6C09C6774CA525A2C49D9
2648Windows Update.exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:EB06B9DB06012A7A4179B8F3CB5384D3
SHA256:3A3A99897CABE3D52773C5DC0AAC8AAF0ED23ACF5FBEFC6ADDB399F934288A48
2648Windows Update.exeC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:E9FAEE87A060C806E7234779CFF7B480
SHA256:CE744D98EF602BA5FE207C4C064DA0075A1BB9BF303E53CA86AF1025AD3AFBF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2648
Windows Update.exe
GET
403
104.16.18.96:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2648
Windows Update.exe
104.16.18.96:80
whatismyipaddress.com
Cloudflare Inc
US
shared
2648
Windows Update.exe
198.54.122.60:587
mail.privateemail.com
Namecheap, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.18.96
  • 104.16.19.96
  • 104.16.17.96
  • 104.16.20.96
  • 104.16.16.96
shared
mail.privateemail.com
  • 198.54.122.60
shared

Threats

PID
Process
Class
Message
2648
Windows Update.exe
A Network Trojan was detected
MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PO 181218.zip