File name: | Payment Copy.doc |
Full analysis: | https://app.any.run/tasks/2a81ae56-3f14-4857-9612-f93b029a9420 |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | November 08, 2018, 10:35:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with CRLF line terminators, with escape sequences |
MD5: | 74B41CE60AC261168236174C35D7AEF3 |
SHA1: | 6F470008C428CF3421DE23BE3E3DB676C25ED2DC |
SHA256: | C24ACC9775753A93AE2015318D1037FF6FCEC39C483D538E5D996430C2B3CB1D |
SSDEEP: | 3072:tr6rgrxrxrmrmrmrmrmrmrmrdr6r6r6r+S:2S |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1480 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Payment Copy.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2296 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2972 | C:\Users\admin\AppData\Local\Temp\1.com | C:\Users\admin\AppData\Local\Temp\1.com | — | EQNEDT32.EXE |
User: admin Company: COLORATIONAL2 Integrity Level: MEDIUM Description: Trichodontidae0 Exit code: 0 Version: 2.09.0008 | ||||
3084 | :\Users\admin\AppData\Local\Temp\1.com | C:\Users\admin\AppData\Local\Temp\1.com | 1.com | |
User: admin Company: COLORATIONAL2 Integrity Level: MEDIUM Description: Trichodontidae0 Version: 2.09.0008 | ||||
3276 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | 1.com | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
3092 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | — | 1.com |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 |
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | 9zg |
Value: 397A6700C8050000010000000000000000000000 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: On | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | WORDFiles |
Value: 1298661391 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1298661504 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | ProductFiles |
Value: 1298661505 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word |
Operation: | write | Name: | MTTT |
Value: C8050000A8A12EDC4E77D40100000000 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | !{g |
Value: 217B6700C805000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | delete value | Name: | !{g |
Value: 217B6700C805000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
(PID) Process: | (1480) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1480 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR9239.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3276 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holdermail.txt | — | |
MD5:— | SHA256:— | |||
3092 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holderwb.txt | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Cab8450.tmp | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Tar8451.tmp | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Cab8461.tmp | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Tar8462.tmp | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Cab8DD9.tmp | — | |
MD5:— | SHA256:— | |||
3084 | 1.com | C:\Users\admin\AppData\Local\Temp\Tar8DDA.tmp | — | |
MD5:— | SHA256:— | |||
2296 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70 | binary | |
MD5:DA6C793FB0533AF0139A6D76C9956547 | SHA256:BCEC4BFFD8EE03E0FDF1C1577EF4635AC08DB1F94CF07B0C406A6B3A171E9E1D |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3084 | 1.com | GET | — | 104.16.17.96:80 | http://whatismyipaddress.com/ | US | — | — | shared |
2296 | EQNEDT32.EXE | GET | 301 | 67.199.248.10:80 | http://bit.ly/2JPI9IQ | US | html | 115 b | shared |
3084 | 1.com | GET | 200 | 13.107.4.50:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 54.4 Kb | whitelisted |
3084 | 1.com | GET | 200 | 13.107.4.50:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt | US | der | 969 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2296 | EQNEDT32.EXE | 67.199.248.10:80 | bit.ly | Bitly Inc | US | shared |
3084 | 1.com | 104.16.17.96:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
3084 | 1.com | 217.66.226.116:587 | ns7.hadara.ps | Hadara | PS | malicious |
2296 | EQNEDT32.EXE | 163.172.215.76:443 | e.coka.la | Online S.a.s. | NL | malicious |
3084 | 1.com | 13.107.4.50:80 | www.download.windowsupdate.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
bit.ly |
| shared |
e.coka.la |
| malicious |
whatismyipaddress.com |
| shared |
ns7.hadara.ps |
| shared |
www.download.windowsupdate.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3084 | 1.com | A Network Trojan was detected | MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck) |