File name:

Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip

Full analysis: https://app.any.run/tasks/37759c03-b10f-4f4a-847f-7670e5a38783
Verdict: Malicious activity
Threats:

Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 16:21:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
hawkeye
keylogger
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8EF8C1D845F491C586F72B9241030DD7

SHA1:

C017C7C0FC77432CBCFDB35E8C5E9AB2244EE7DE

SHA256:

B51923AA89C9631FACCA48B106458C3D5E66A8A2BDAB9B1F305913AE4D89A6ED

SSDEEP:

12288:ZzkdwAqn/O9TMFoc++A/XBrA6O/jQNk3/tziNBZM9e05RhnigC:Jk90KMFoJ+kxA/jrzwwVxi9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3132)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)
      • Windows Update.exe (PID: 3984)
      • Windows Update.exe (PID: 2632)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3444)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)
      • Windows Update.exe (PID: 1452)

    • Detected Hawkeye Keylogger

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Changes settings of System certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 3044)

  • SUSPICIOUS

    • Application launched itself

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3132)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3444)
      • Windows Update.exe (PID: 2632)

    • Executable content was dropped or overwritten

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)

    • Creates files in the user directory

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)
      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Starts itself from another location

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 3616)

    • Connects to SMTP port

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Checks for external IP

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Adds / modifies Windows certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Executes scripts

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

  • INFO

    • Application was crashed

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)

    • Reads settings of System Certificates

      • Ref[G81987993157] Customer Ref[20130819T001T].exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2018:11:15 03:54:12
ZipCRC: 0x1229c9b0
ZipCompressedSize: 553709
ZipUncompressedSize: 571392
ZipFileName: Ref[G81987993157] Customer Ref[20130819T001T].exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs ref[g81987993157] customer ref[20130819t001t].exe no specs ref[g81987993157] customer ref[20130819t001t].exe windows update.exe no specs windows update.exe ref[g81987993157] customer ref[20130819t001t].exe no specs #HAWKEYE ref[g81987993157] customer ref[20130819t001t].exe windows update.exe dw20.exe no specs vbc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Windows Update.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
2092dw20.exe -x -s 1652C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2632"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
3044C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3132"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ref[g81987993157] customer ref[20130819t001t].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
3216"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3444"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ref[g81987993157] customer ref[20130819t001t].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
3616"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ref[g81987993157] customer ref[20130819t001t].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
3984"C:\Users\admin\AppData\Roaming\Windows Update.exe" C:\Users\admin\AppData\Roaming\Windows Update.exe—Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\windows update.exe
c:\systemroot\system32\ntdll.dll
4092"C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe" C:\Users\admin\Desktop\Ref[G81987993157] Customer Ref[20130819T001T].exe
Ref[G81987993157] Customer Ref[20130819T001T].exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\ref[g81987993157] customer ref[20130819t001t].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
Total events
936
Read events
887
Write events
48
Delete events
1

Modification events

(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3216) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3216) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3616) Ref[G81987993157] Customer Ref[20130819T001T].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3616) Ref[G81987993157] Customer Ref[20130819T001T].exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
1
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3216WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3216.42569\Ref[G81987993157] Customer Ref[20130819T001T].exe —
MD5:—
SHA256:—
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:—
SHA256:—
3616Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Local\Temp\SysInfo.txttext
MD5:—
SHA256:—
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\pidloc.txttext
MD5:—
SHA256:—
3616Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\Windows Update.exeexecutable
MD5:—
SHA256:—
4092Ref[G81987993157] Customer Ref[20130819T001T].exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:77340C2E00E9E6AD1B2784DAD06291EA
SHA256:BE87FCC57797F6239F88630A7817111D7750B36F662B95B7D094A3B98692CDAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
GET
403
104.16.20.96:80
http://whatismyipaddress.com/
US
text
100 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
104.16.20.96:80
whatismyipaddress.com
Cloudflare Inc
US
shared
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
213.180.193.38:587
smtp.yandex.com
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
whatismyipaddress.com
  • 104.16.20.96
  • 104.16.16.96
  • 104.16.17.96
  • 104.16.18.96
  • 104.16.19.96
shared
smtp.yandex.com
  • 213.180.193.38
  • 213.180.204.38
  • 87.250.250.38
  • 93.158.134.38
  • 77.88.21.38
malicious

Threats

PID
Process
Class
Message
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
A Network Trojan was detected
MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck)
4092
Ref[G81987993157] Customer Ref[20130819T001T].exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ref[G81987993157] Customer Ref[20130819T001T]_pdf.zip