analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PI190520.ace

Full analysis: https://app.any.run/tasks/486bd974-af79-487c-acc1-d5d494b1b77a
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Analysis date: May 20, 2019, 15:04:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
hawkeye
stealer
evasion
trojan
Indicators:
MIME: application/octet-stream
File info: ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid
MD5:

C37FEDF3C54AB1743986769D2FBA4555

SHA1:

773E721F9BD8EE3B4C1DA3BB755F20157D88F1C9

SHA256:

B23D486C7D5B37A77A1460D049B1359430E3F1C54F8EB5EDBF9C83EE55687EE6

SSDEEP:

24576:goV/YSiIuLq91+utm2QHMHYsIZBRfKtbt5D5Yk:g+3ir+9Y2Q7ZXfKN/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PI190520.exe (PID: 2084)
      • PI190520.exe (PID: 1652)
    • Known privilege escalation attack

      • PI190520.exe (PID: 1652)
    • Writes to a start menu file

      • PI190520.exe (PID: 2084)
    • Detected Hawkeye Keylogger

      • RegSvcs.exe (PID: 852)
    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3484)
      • vbc.exe (PID: 3012)
    • Stealing of credential data

      • vbc.exe (PID: 3012)
      • vbc.exe (PID: 3484)
    • Changes settings of System certificates

      • RegSvcs.exe (PID: 852)
  • SUSPICIOUS

    • Modifies the open verb of a shell class

      • PI190520.exe (PID: 1652)
    • Executable content was dropped or overwritten

      • PI190520.exe (PID: 2084)
    • Creates files in the user directory

      • PI190520.exe (PID: 2084)
    • Executes scripts

      • RegSvcs.exe (PID: 852)
    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 3484)
    • Adds / modifies Windows certificates

      • RegSvcs.exe (PID: 852)
  • INFO

    • Manual execution by user

      • PI190520.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ace | ACE compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs pi190520.exe no specs eventvwr.exe no specs eventvwr.exe pi190520.exe #HAWKEYE regsvcs.exe vbc.exe vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3084"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PI190520.ace"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1652"C:\Users\admin\Desktop\PI190520.exe" C:\Users\admin\Desktop\PI190520.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2472"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exePI190520.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Event Viewer Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
948"C:\Windows\System32\eventvwr.exe" C:\Windows\System32\eventvwr.exe
PI190520.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2084"C:\Users\admin\Desktop\PI190520.exe" C:\Users\admin\Desktop\PI190520.exe
eventvwr.exe
User:
admin
Integrity Level:
HIGH
852"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
PI190520.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
3484"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmp771C.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3012"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\admin\AppData\Local\Temp\tmpA477.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Total events
628
Read events
577
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3084.20345\PI190520.exe
MD5:
SHA256:
852RegSvcs.exeC:\Users\admin\AppData\Local\Temp\25291068-43af-3e16-50f6-5889d9ce7904text
MD5:5991253EE81690E6E5A59EEF592751AF
SHA256:9DA3EC1338AAD7A97870C113970011403EAC8730DEC3D34519C856D30E580EF3
2084PI190520.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FileHistory.vbstext
MD5:B8924BD9B017457F15E970D5302F8222
SHA256:B20CC06E77C70A3433ECD0A6DD34D8A728F601345CF3C7543A7028FEACDAA987
2084PI190520.exeC:\Users\admin\RdpSaProxy\tzsync.exeexecutable
MD5:A3A70ADA23863E95AB866C5D4A814254
SHA256:8A6C2DF475EE87F39541255320D7D1C84FFF52FD94D9AA3830B9619537866355
3012vbc.exeC:\Users\admin\AppData\Local\Temp\tmpA477.tmptext
MD5:7FB9A9AD0FD9B1E0108ED71FBB276048
SHA256:7D63C301317E144B0133A72250AE2D8E09AF65A92E6A807EC58A71939FE530A9
3484vbc.exeC:\Users\admin\AppData\Local\Temp\tmp771C.tmptext
MD5:3E1E093DCCE32C716267A28292E0EE27
SHA256:56285445424AD06DC043154819B5BDABAA7C26F5779CA3E37E08424ED9926CB8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
852
RegSvcs.exe
GET
200
66.171.248.178:80
http://bot.whatismyipaddress.com/
US
text
12 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
852
RegSvcs.exe
198.27.115.53:587
mail.fuse42.com
OVH SAS
CA
malicious
852
RegSvcs.exe
66.171.248.178:80
bot.whatismyipaddress.com
Alchemy Communications, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
bot.whatismyipaddress.com
  • 66.171.248.178
shared
mail.fuse42.com
  • 198.27.115.53
suspicious

Threats

PID
Process
Class
Message
852
RegSvcs.exe
A Network Trojan was detected
MALWARE [PTsecurity] Spy.HawkEye IP Check
852
RegSvcs.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2 ETPRO signatures available at the full report
No debug info