File name: | Invoice.doc |
Full analysis: | https://app.any.run/tasks/5c4cfbd2-3197-4374-9e1f-3589622c24b7 |
Verdict: | Malicious activity |
Threats: | Hawkeye often gets installed in a bundle with other malware. This is a Trojan and keylogger that is used to retrieve private information such as passwords and login credentials. This is an advanced malware that features strong anti-evasion functions. |
Analysis date: | April 23, 2019, 22:23:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, unknown version |
MD5: | DB48DEB53AA74B7F496C64F0B6B57376 |
SHA1: | 4CE470D928D82A62A92B730132DDA993ED4B0242 |
SHA256: | C98FA0A99DE5B9720E234F6AFE60940FAE10C8A010AB43BD6B68DD3398F2B870 |
SSDEEP: | 24576:cHqSe9lnP5Sbba9lDuS7TzbRsqNMEhLgEYpJY+tJZ1ai4QOwu4ldTO:7 |
.rtf | | | Rich Text Format (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3292 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Invoice.doc.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2932 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" -Embedding | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3332 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
3664 | cmd /c %tmp%\A.X | C:\Windows\system32\cmd.exe | — | EQNEDT32.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2780 | C:\Users\admin\AppData\Local\Temp\A.X | C:\Users\admin\AppData\Local\Temp\A.X | — | cmd.exe |
User: admin Company: TEXas INStruments INCorporated Integrity Level: MEDIUM Description: tOdO: <COMpany Name> Exit code: 0 Version: 1.00 | ||||
2232 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | svchost.exe | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
1012 | "C:\Program Files\Microsoft Office\Office14\excelcnv.exe" -Embedding | C:\Program Files\Microsoft Office\Office14\excelcnv.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 | ||||
3040 | C:\Users\admin\AppData\Local\Temp\A.X | C:\Users\admin\AppData\Local\Temp\A.X | A.X | |
User: admin Company: TEXas INStruments INCorporated Integrity Level: MEDIUM Description: tOdO: <COMpany Name> Version: 1.00 | ||||
3512 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holdermail.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | A.X | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 | ||||
3220 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\admin\AppData\Local\Temp\holderwb.txt" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | — | A.X |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR5A76.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2932 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR64C7.tmp.cvr | — | |
MD5:— | SHA256:— | |||
1012 | excelcnv.exe | C:\Users\admin\AppData\Local\Temp\CVR73CA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~DF7641F9DBBD907685.TMP | — | |
MD5:— | SHA256:— | |||
3512 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holdermail.txt | — | |
MD5:— | SHA256:— | |||
3220 | vbc.exe | C:\Users\admin\AppData\Local\Temp\holderwb.txt | — | |
MD5:— | SHA256:— | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:03F75A861CC10AD1C3318BEB891B725B | SHA256:7EBE4AE513B230A4E93B55D5C5B1A8281E935A6A42B38FA33B58EA5B73980E58 | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\A.X | executable | |
MD5:081A04B88B2B17FA0380320436F729FE | SHA256:23E0AD597B43BB01AADF92545EC653C89BC52788D4B1857720037ACE211A7E9C | |||
3292 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$voice.doc.rtf | pgc | |
MD5:1F29C91D9546F3B64A22A57E80DAC018 | SHA256:BBCA17E74D2993127CE8D19D2D29A1268D8D46B519529893D197F550901D59F4 | |||
3040 | A.X | C:\Users\admin\AppData\Roaming\pidloc.txt | text | |
MD5:992DAF9DE3673A7BEFB47E1F86CC5BE6 | SHA256:E6D05FDB94FBC4E720D7E017D24A7484A702B19E15836A18F56D7F63758458DE |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3040 | A.X | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3040 | A.X | 204.141.43.189:587 | smtp.zoho.com | ZOHO | US | unknown |
— | — | 104.16.155.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
whatismyipaddress.com |
| shared |
smtp.zoho.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3040 | A.X | A Network Trojan was detected | MALWARE [PTsecurity] Spyware.HawkEyeKeyLogger (IP Chck) |
3040 | A.X | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |