Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
20ff5927d308640388a6e252a6066a2e
-
SHA1
212ed4df30ad278d89a93e7e08b00c8b21ee4891
-
SHA256
4009d69cf8684f905d1ebb5f4232ccb32a712f5475d8b8e64b3a9a9601ccd9bc
-
SHA512
81fe4eb0bb457c667f063a7255740a34d884949a9ea8b3bc8337b1dd29915205c2de640e88fc3541257895d1016e057e7ce6fc78c03c0bd334835f6b688868c7
-
SSDEEP
49152:1XkWgQct1Y85jtoenfyZKf5d4/e3d3P/oGeBklohMq3HS7fprkHieQjJ3i7bfm3H:1XZ7czY85hliUf
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
nj-s5.dedicatedpanel.net - Port:
587 - Username:
[email protected] - Password:
Zaher@56070
Protocol: ftp- Host:
ftp.cnvester.com - Port:
21 - Username:
[email protected] - Password:
dionis@56070
4f5381a5-9637-4dd4-9b49-40ee58a8df8c
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Zaher@56070 _EmailPort:587 _EmailSSL:true _EmailServer:nj-s5.dedicatedpanel.net _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPassword:dionis@56070 _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.cnvester.com _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:180 _MeltFile:false _Mutex:4f5381a5-9637-4dd4-9b49-40ee58a8df8c _PanelSecret:67b6ee75-2800-354b-75e7-981c629e3001 _PanelURL:vanneil.ru/ _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/1956-61-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral2/memory/2052-59-0x0000000005070000-0x0000000005100000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3692-82-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3692-80-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/3692-84-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3952-68-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3952-70-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3952-71-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3952-78-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/3952-68-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3952-70-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3952-71-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3952-78-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3692-82-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3692-80-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3692-84-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbc.url 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2052 set thread context of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 1956 set thread context of 3952 1956 RegAsm.exe 97 PID 1956 set thread context of 3692 1956 RegAsm.exe 98 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 3952 vbc.exe 1956 RegAsm.exe 1956 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe Token: SeDebugPrivilege 1956 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 2052 wrote to memory of 1956 2052 20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe 85 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3952 1956 RegAsm.exe 97 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98 PID 1956 wrote to memory of 3692 1956 RegAsm.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20ff5927d308640388a6e252a6066a2e_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp58ED.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5CF6.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:3692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD52439e22611ee08ff8f7825bd1d2e32f3
SHA1e37100e2eda267ecc4c0250ebd8cd5f3685fef00
SHA2562c367b49bc63498c2f6e5a164d63a139757080f71e2a88bc6dcc32cb17e8adc7
SHA512e550a08277e0eead98509d20d0b8c133d997b4ca138c29cf4f369fcefc4b553bafaac0b529c7335289209e01e4bb4a250706585f1e6cb53976e3fd771234b4f3