Havij pro Patch Archives

Havij Pro 1.16.exe

This report is generated from a file or URL submitted to this webservice on September 24th 2017 18:53:09 (UTC)
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v6.91 © Hybrid Analysis

Remote Access

Reads terminal service related keys (often RDP related)

Persistence

Writes data to a remote process

Fingerprint

Reads the active computer name
Reads the cryptographic machine GUID

Spreading

Opens the MountPointManager (often used to detect additional infection locations)

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 8

• External Systems
• General
  • The analysis extracted a file that was identified as malicious

    details

    49/87 Antivirus vendors marked dropped file "Havij.exe" as malicious (classified as "Application.Hacktool" with 56% detection rate)
    2/86 Antivirus vendors marked dropped file "Resgistrator.OCX.exe" as malicious (classified as "W32.Shelma" with 2% detection rate)
    57/86 Antivirus vendors marked dropped file "Havij_Load by iraq_att.EXE" as malicious (classified as "Trojan.Generic" with 66% detection rate)

    source

    Extracted File

    relevance

    10/10

  • The analysis spawned a process that was identified as malicious

    details

    57/86 Antivirus vendors marked spawned process "Havij_Load by iraq_att.EXE" (PID: 2952) as malicious (classified as "Trojan.Generic" with 66% detection rate)
    49/87 Antivirus vendors marked spawned process "Havij.exe" (PID: 2896) as malicious (classified as "Application.Hacktool" with 56% detection rate)

    source

    Monitored Target

    relevance

    10/10

• Installation/Persistance
  • Writes data to a remote process

    details

    "<Input Sample>" wrote 1500 bytes to a remote process "%TEMP%\RarSFX0\Havij_Load by iraq_att.EXE" (Handle: 584)
    "<Input Sample>" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij_Load by iraq_att.EXE" (Handle: 584)
    "<Input Sample>" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij_Load by iraq_att.EXE" (Handle: 584)
    "<Input Sample>" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij_Load by iraq_att.EXE" (Handle: 584)
    "Havij_Load by iraq_att.EXE" wrote 1500 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij.exe" (Handle: 284)
    "Havij_Load by iraq_att.EXE" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij.exe" (Handle: 284)
    "Havij_Load by iraq_att.EXE" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij.exe" (Handle: 284)
    "Havij_Load by iraq_att.EXE" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\RarSFX0\Havij.exe" (Handle: 284)

    source

    API Call

    relevance

    6/10

• Hiding 3 Malicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Suspicious Indicators 28

• Anti-Reverse Engineering
  • PE file has unusual entropy sections

    details

    UPX1 with unusual entropies 7.89611270805

    source

    Static Parser

    relevance

    10/10

  • PE file is packed with UPX

    details

    "Havij_Load by iraq_att.EXE" has a section named "UPX0"
    "Havij_Load by iraq_att.EXE" has a section named "UPX1"

    source

    Static Parser

    relevance

    10/10

• Cryptographic Related
• Environment Awareness
• External Systems
• General
• Installation/Persistance
  • Drops executable files

    details

    "msvbvm60.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "olepro32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "Havij.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "Resgistrator.OCX.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
    "oleaut32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "asycfilt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "comcat.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "Havij_Load by iraq_att.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"
    "RICHTX32.ocx" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "tabctl32.ocx" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "Mswinsck.ocx" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "MSInet.ocx" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"
    "Mscomctl.ocx" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"

    source

    Extracted File

    relevance

    10/10

• Network Related
• Remote Access Related
  • Reads terminal service related keys (often RDP related)

    details

    "Havij_Load by iraq_att.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED")
    "Havij.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED")

    source

    Registry Access

    relevance

    10/10

• Spyware/Information Retrieval
  • Contains ability to retrieve keyboard strokes

    details

    GetAsyncKeyState@USER32.dll at 48225-2604-27616F4C
    GetAsyncKeyState@USER32.dll at 48225-2726-275893A2
    GetAsyncKeyState@USER32.dll at 48225-2922-27583578
    GetKeyboardState@USER32.dll at 48225-3460-2759C09B
    GetKeyboardState@USER32.dll at 43595-5026-660849E9

    source

    Hybrid Analysis Technology

    relevance

    8/10

• System Security
  • Hooks API calls

    details

    "LdrAccessResource@NTDLL.DLL" in "Havij.exe"
    "LdrFindResource_U@NTDLL.DLL" in "Havij.exe"

    source

    Hook Detection

    relevance

    10/10

  • Modifies proxy settings

    details

    "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
    "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")

    source

    Registry Access

    relevance

    10/10

  • Queries sensitive IE security settings

    details

    "<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")

    source

    Registry Access

    relevance

    8/10

  • Queries the display settings of system associated file extensions

    details

    "<Input Sample>" (Access type: "QUERYVAL"; Path: "HKCR\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\SYSTEM"; Key: "ALWAYSSHOWEXT"; Value: "0000000001000000020000000000")

    source

    Registry Access

    relevance

    7/10

• Unusual Characteristics
  • CRC value set in PE header does not match actual value

    details

    "msvbvm60.dll" claimed CRC 1396251 while the actual is CRC 5921228
    "olepro32.dll" claimed CRC 182078 while the actual is CRC 1396251
    "Resgistrator.OCX.exe" claimed CRC 104193 while the actual is CRC 182078
    "oleaut32.dll" claimed CRC 623915 while the actual is CRC 104193
    "asycfilt.dll" claimed CRC 160094 while the actual is CRC 623915
    "comcat.dll" claimed CRC 63765 while the actual is CRC 160094
    "RICHTX32.ocx" claimed CRC 256174 while the actual is CRC 58842
    "tabctl32.ocx" claimed CRC 223735 while the actual is CRC 312294
    "Mswinsck.ocx" claimed CRC 153366 while the actual is CRC 223735
    "MSInet.ocx" claimed CRC 174279 while the actual is CRC 153366
    "Mscomctl.ocx" claimed CRC 1130856 while the actual is CRC 174279

    source

    Static Parser

    relevance

    10/10

  • Entrypoint in PE header is within an uncommon section

    details

    "Havij_Load by iraq_att.EXE" has an entrypoint in section "UPX1"

    source

    Static Parser

    relevance

    10/10

  • Imports suspicious APIs

    details

    RegCreateKeyExW
    RegCloseKey
    OpenProcessToken
    RegOpenKeyExW
    GetFileAttributesA
    GetVersionExW
    FindNextFileA
    GetFileAttributesW
    GetCommandLineW
    CreateDirectoryA
    DeleteFileA
    MapViewOfFile
    CreateDirectoryW
    DeleteFileW
    GetProcAddress
    CreateFileMappingW
    WriteFile
    GetModuleFileNameW
    FindNextFileW
    GetTempPathW
    FindFirstFileA
    FindFirstFileW
    GetModuleHandleW
    LoadLibraryW
    OpenFileMappingW
    FindResourceW
    CreateFileW
    Sleep
    CreateFileA
    GetTickCount
    ShellExecuteExW
    FindWindowExW
    RegDeleteKeyA
    RegCreateKeyW
    RegDeleteKeyW
    RegCreateKeyA
    SetSecurityDescriptorDacl
    RegOpenKeyA
    RegEnumKeyW
    RegOpenKeyW
    RegOpenKeyExA
    RegDeleteValueA
    RegEnumKeyA
    RegEnumKeyExA
    RegDeleteValueW
    GetDriveTypeA
    UnhandledExceptionFilter
    GetTempPathA
    GetModuleFileNameA
    LoadLibraryExA
    CreateThread
    TerminateProcess
    VirtualProtect
    GetVersionExA
    LoadLibraryA
    ExitThread
    GetStartupInfoA
    WinExec
    GetTempFileNameA
    GetComputerNameA
    FindResourceExA
    LockResource
    GetCommandLineA
    GetModuleHandleA
    CreateProcessA
    CreateProcessW
    FindResourceA
    VirtualAlloc
    GetUpdateRgn
    GetLastActivePopup
    SetKeyboardState
    SetWindowsHookExA
    SetWindowsHookExW
    FindWindowW
    FindWindowA
    GetWindowThreadProcessId
    GetUpdateRect
    ShellExecuteA
    GetDriveTypeW
    GetFileSize
    CreateFileMappingA
    RegCreateKeyExA
    sendto (Ordinal #20)
    accept (Ordinal #1)
    WSAStartup (Ordinal #115)
    bind (Ordinal #2)
    recv (Ordinal #16)
    socket (Ordinal #23)
    connect (Ordinal #4)
    recvfrom (Ordinal #17)
    send (Ordinal #19)
    closesocket (Ordinal #3)
    listen (Ordinal #13)
    InternetCloseHandle
    InternetConnectA
    InternetReadFile
    InternetOpenUrlA
    HttpQueryInfoA
    FtpGetFileA
    HttpSendRequestA
    InternetOpenA
    InternetCrackUrlA

    source

    Static Parser

    relevance

    1/10

  • Installs hooks/patches the running process

    details

    "Havij_Load by iraq_att.EXE" wrote bytes "f6ff1775" to virtual address "0x004189A4" (part of module "HAVIJ_LOAD BY IRAQ_ATT.EXE")
    "Havij.exe" wrote bytes "e9746fac89" to virtual address "0x76B066A7" (part of module "USER32.DLL")
    "Havij.exe" wrote bytes "e9f1f6ab89" to virtual address "0x76B0DFBA" (part of module "USER32.DLL")
    "Havij.exe" wrote bytes "e9179a4489" to virtual address "0x77183D84" ("LdrAccessResource@NTDLL.DLL")
    "Havij.exe" wrote bytes "e90af54389" to virtual address "0x7718E201" ("LdrFindResource_U@NTDLL.DLL")
    "Havij.exe" wrote bytes "be4b0e66000000004c7eb97500000000d5ebb17600000000263cb8750000000041cfb7755c39b8756333b87564cab775f633b8754f21b87500000000" to virtual address "0x00C0D000" (part of module "HAVIJ.EXE")
    "Havij.exe" wrote bytes "e9fce1f2ff" to virtual address "0x77260005"
    "Havij.exe" wrote bytes "e9a6dfdbff" to virtual address "0x76D50014"
    "Havij.exe" wrote bytes "e9a266dbff" to virtual address "0x76D50005"
    "Havij.exe" wrote bytes "e9703df2ff" to virtual address "0x77260017"

    source

    Hook Detection

    relevance

    10/10

  • Reads information about supported languages

    details

    "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
    "Havij_Load by iraq_att.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
    "Havij.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")

    source

    Registry Access

    relevance

    3/10

  • Timestamp in PE header is very old or in the future

    details

    "olepro32.dll" claims program is from Mon Mar 8 19:15:46 1999
    "oleaut32.dll" claims program is from Mon Mar 8 19:22:59 1999
    "asycfilt.dll" claims program is from Mon Mar 8 19:15:29 1999
    "comcat.dll" claims program is from Thu Dec 5 21:53:54 1996
    "MSInet.ocx" claims program is from Thu Jun 18 17:49:23 1998

    source

    Static Parser

    relevance

    10/10

• Hiding 4 Suspicious Indicators
  • All indicators are available only in the private webservice or standalone version

• Informative 19

• Anti-Reverse Engineering
• Environment Awareness
  • Contains ability to query machine time

    details

    GetSystemTime@KERNEL32.dll (Show Stream)
    GetLocalTime@KERNEL32.dll at 48225-3777-275B62BA
    GetSystemTime@KERNEL32.dll at 43595-4144-660750BB

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Contains ability to query the machine version

    details

    GetVersion@KERNEL32.dll at 28843-35-22171308
    GetVersionExA@KERNEL32.dll at 48225-2819-275A954C
    GetVersionExA@KERNEL32.dll at 48225-2519-27585F4D
    GetVersionExA@KERNEL32.dll at 48225-3216-2758CFC6
    GetVersionExA@KERNEL32.dll at 43595-5086-66033098

    source

    Hybrid Analysis Technology

    relevance

    1/10

  • Makes a code branch decision directly after an API that is environment aware

    details

    Found API call GetVersion@KERNEL32.dll (Target: "Mswinsck.ocx.2529001742"; Stream UID: "28843-35-22171308")
    which is directly followed by "cmp eax, 80000000h" and "jnc 22175F02h". See related instructions: "...
    +23 call dword ptr [2217108Ch] ;GetVersion
    +29 xor ecx, ecx
    +31 push 00000001h
    +33 mov cl, ah
    +35 cmp eax, 80000000h
    +40 mov ch, al
    +42 mov dword ptr [2218200Ch], edi
    +48 mov dword ptr [22182010h], edi
    +54 mov dword ptr [22182014h], edi
    +60 pop esi
    +61 jnc 22175F02h" ... at 28843-35-22171308
    Found API call GetVersionExA@KERNEL32.dll (Target: "Mscomctl.ocx.2944672046"; Stream UID: "48225-2819-275A954C")
    which is directly followed by "cmp dword ptr [ebp-000000A8h], 02h" and "jmp 275A9586h". See related instructions: "...
    +206 lea eax, dword ptr [ebp-000000B8h]
    +212 mov dword ptr [ebp-000000B8h], 00000094h
    +222 push eax
    +223 call dword ptr [27581144h] ;GetVersionExA
    +229 xor eax, eax
    +231 cmp dword ptr [ebp-000000A8h], 02h
    +238 sete al
    +241 mov word ptr [27633E88h], ax
    +247 jmp 275A9586h" ... at 48225-2819-275A954C
    Found API call GetVersionExA@KERNEL32.dll (Target: "Mscomctl.ocx.2944672046"; Stream UID: "48225-2519-27585F4D")
    which is directly followed by "cmp dword ptr [ebp-00000084h], 02h" and "jne 27585FABh". See related instructions: "...
    +25 lea eax, dword ptr [ebp-00000094h]
    +31 mov dword ptr [ebp-00000094h], 00000094h
    +41 push eax
    +42 call dword ptr [27581144h] ;GetVersionExA
    +48 cmp dword ptr [ebp-00000084h], 02h
    +55 push 00000001h
    +57 pop eax
    +58 jne 27585FABh" ... at 48225-2519-27585F4D
    Found API call GetLocalTime@KERNEL32.dll (Target: "Mscomctl.ocx.2944672046"; Stream UID: "48225-3777-275B62BA")
    which is directly followed by "cmp dword ptr [ebp+08h], 02h" and "jne 275D0383h". See related instructions: "...
    +30 lea eax, dword ptr [ebp-1Ch]
    +33 push eax
    +34 call dword ptr [2758112Ch] ;GetLocalTime
    +40 cmp dword ptr [ebp+08h], 02h
    +44 jne 275D0383h" ... at 48225-3777-275B62BA

    source

    Hybrid Analysis Technology

    relevance

    10/10