hawkeye | f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-03-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe
Size

33KB
MD5

6a6f179c2d41154e56a19a64ffd9822f
SHA1

49ff007eab77c59f86b38c8e588331090c2679cc
SHA256

f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768
SHA512

a807892a65681126dbcca94e8a13aa486f6402d5a96afda2197abb7427124f9f691cf8009b3afc9c01c445b65b033e21e021acc0706d40b0dfa92f65dd5cf16d
SSDEEP

384:ZHLu2x1/pk4yXGjgbUTOg1ni1Ujd3Jwb8mnatAEwXOsbTedtLT9npzl+1PKqn5EV:ZrucFvyXGol1Ywans6fpMCO9uf/d

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012251-7.dat	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Executes dropped EXE 1 IoCs

pid	Process
3000	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	WindowsUpdate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3000	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3000	2112	f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe	28
PID 2112 wrote to memory of 3000	2112	f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe	28
PID 2112 wrote to memory of 3000	2112	f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe	28

C:\Users\Admin\AppData\Local\Temp\f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe
"C:\Users\Admin\AppData\Local\Temp\f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe

Filesize
33KB

MD5
6a6f179c2d41154e56a19a64ffd9822f

SHA1
49ff007eab77c59f86b38c8e588331090c2679cc

SHA256
f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768

SHA512
a807892a65681126dbcca94e8a13aa486f6402d5a96afda2197abb7427124f9f691cf8009b3afc9c01c445b65b033e21e021acc0706d40b0dfa92f65dd5cf16d

Download Submit
memory/2112-1-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-2-0x0000000001F60000-0x0000000001FE0000-memory.dmp

Filesize
512KB

Download
memory/2112-9-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-11-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-10-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-12-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/3000-13-0x0000000000AE0000-0x0000000000B60000-memory.dmp

Filesize
512KB

Download
memory/3000-14-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads