General

  • Target

    d815e19001ebfa5ca5d24aa83a26f33ae886e18ef663da095ed04d37c0d7ce33

  • Size

    37KB

  • Sample

    221204-r89apshg27

  • MD5

    ec2c3adc5d23220b641a492f40139185

  • SHA1

    139036b52b605733756a0cf04db7a007abd7c978

  • SHA256

    d815e19001ebfa5ca5d24aa83a26f33ae886e18ef663da095ed04d37c0d7ce33

  • SHA512

    12310959bc8a18aba59af845b98b02c66c1db19961794e65653ff46711d4df9418fb8815fcc27d59d7c9b389e36508025b6aa0b7af65778da483a25cbb538593

  • SSDEEP

    768:shDpcmvSmmlm/16RhJdcnfxxxxxFOTeS/ekU+QSta58bsap5wFn8iFJzul6rwZ:mKmmlm/cXJdcHkU+QS3/p5wFn8iF26rk

Malware Config

Targets

    • Target

      d815e19001ebfa5ca5d24aa83a26f33ae886e18ef663da095ed04d37c0d7ce33

    • Size

      37KB

    • MD5

      ec2c3adc5d23220b641a492f40139185

    • SHA1

      139036b52b605733756a0cf04db7a007abd7c978

    • SHA256

      d815e19001ebfa5ca5d24aa83a26f33ae886e18ef663da095ed04d37c0d7ce33

    • SHA512

      12310959bc8a18aba59af845b98b02c66c1db19961794e65653ff46711d4df9418fb8815fcc27d59d7c9b389e36508025b6aa0b7af65778da483a25cbb538593

    • SSDEEP

      768:shDpcmvSmmlm/16RhJdcnfxxxxxFOTeS/ekU+QSta58bsap5wFn8iFJzul6rwZ:mKmmlm/cXJdcHkU+QS3/p5wFn8iF26rk

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks