hawkeye | 934fa3c723ef0371168b39cec66e9f23297d9cd1d6eeae9db2b602044bfdfff1

System Information Discovery

Processes:

2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 whatismyipaddress.com
18 whatismyipaddress.com

flow	ioc
20	whatismyipaddress.com
18	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

description	pid	process	target process
PID 1372 set thread context of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 3512 set thread context of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 set thread context of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4688 schtasks.exe

pid	process
4688	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

vbc.exe2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

pid process

640 vbc.exe
640 vbc.exe
3512 2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

pid	process
640	vbc.exe
640	vbc.exe
3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
Token: SeBackupPrivilege	3120	dw20.exe
Token: SeBackupPrivilege	3120	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

pid process

3512 2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

pid	process
3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe

description	pid	process	target process
PID 1372 wrote to memory of 4688	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	schtasks.exe
PID 1372 wrote to memory of 4688	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	schtasks.exe
PID 1372 wrote to memory of 4688	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	schtasks.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 1372 wrote to memory of 3512	1372	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 4408	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 640	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	vbc.exe
PID 3512 wrote to memory of 3120	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	dw20.exe
PID 3512 wrote to memory of 3120	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	dw20.exe
PID 3512 wrote to memory of 3120	3512	2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Update\VDFFSHBXCTFGHDNMBGKZXDDXNVMNCCXBGBNXJNCJM" /XML "C:\Users\Admin\AppData\Local\Temp\z169"
2⤵
- Creates scheduled task(s)
PID:4688

C:\Users\Admin\AppData\Local\Temp\2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b478db2af56153a2cee33f71213cc2f_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:4408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1364
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

3

System Information Discovery

4

Lateral Movement

Collection

Email Collection