hawkeye_reborn | 8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe
Size

739KB
MD5

40d8409d81ecf1e7bef4b135a8eec054
SHA1

aceda599cc1666d7ad67ad4404275b59e1f49cda
SHA256

8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04
SHA512

bd48ceaf3c72836e93622afee9b73529475f7d7605187d727c279644dc7a3bb79922df5ecf8422df8ce2392bb3b3f26cd38d8c01a9622a4c9800a3ad13f36fd0
SSDEEP

12288:/6SJGKFYrwBD79S5RQGPDYTnnWe7hPtOiOGb5:/6SPXhIHQGPD+nnp7hVOijF

Score

10^/10

hawkeye_reborn m00nd3v_logger zgrat agilenet collection infostealer keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.zoho.com
Port:
587
Username:
[email protected]
Password:
internationallove147

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/448-3-0x00000000051C0000-0x00000000051E8000-memory.dmp	family_zgrat_v1

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral2/memory/3520-18-0x0000000000700000-0x0000000000790000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/3520-19-0x0000000004D10000-0x0000000004D86000-memory.dmp	MailPassView
behavioral2/memory/636-31-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/636-32-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/636-34-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/3520-19-0x0000000004D10000-0x0000000004D86000-memory.dmp	WebBrowserPassView
behavioral2/memory/1404-22-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1404-23-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/1404-29-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3520-19-0x0000000004D10000-0x0000000004D86000-memory.dmp	Nirsoft
behavioral2/memory/1404-22-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1404-23-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1404-29-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/636-31-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/636-32-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/636-34-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

start.exestart.exe

pid	Process
2556	start.exe
3520	start.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/448-3-0x00000000051C0000-0x00000000051E8000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

start.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\start.exe -boot"	start.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

start.exestart.exe

description	pid	Process	procid_target
PID 2556 set thread context of 3520	2556	start.exe	94
PID 3520 set thread context of 1404	3520	start.exe	95
PID 3520 set thread context of 636	3520	start.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exestart.exevbc.exestart.exe

pid	Process
448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe
2556	start.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
1404	vbc.exe
3520	start.exe
3520	start.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exestart.exestart.exe

description	pid	Process
Token: SeDebugPrivilege	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe
Token: SeDebugPrivilege	2556	start.exe
Token: SeDebugPrivilege	3520	start.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

start.exe

pid	Process
3520	start.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exeexplorer.exestart.exestart.exe

description	pid	Process	procid_target
PID 448 wrote to memory of 1176	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	84
PID 448 wrote to memory of 1176	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	84
PID 448 wrote to memory of 1176	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	84
PID 448 wrote to memory of 1796	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	86
PID 448 wrote to memory of 1796	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	86
PID 448 wrote to memory of 1796	448	40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe	86
PID 1680 wrote to memory of 2556	1680	explorer.exe	88
PID 1680 wrote to memory of 2556	1680	explorer.exe	88
PID 1680 wrote to memory of 2556	1680	explorer.exe	88
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 2556 wrote to memory of 3520	2556	start.exe	94
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 1404	3520	start.exe	95
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96
PID 3520 wrote to memory of 636	3520	start.exe	96

C:\Users\Admin\AppData\Local\Temp\40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\40d8409d81ecf1e7bef4b135a8eec054_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\start.exe"
  2⤵
  PID:1176
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c, "C:\Users\Admin\AppData\Local\start.exe"
  2⤵
  PID:1796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\start.exe
  "C:\Users\Admin\AppData\Local\start.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\start.exe
    "C:\Users\Admin\AppData\Local\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp37A5.tmp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1404
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3BAD.tmp"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log

Filesize
706B

MD5
f8bcaf312de8591707436c1dcebba8e4

SHA1
a1269828e5f644601622f4a7a611aec8f2eda0b2

SHA256
f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29

SHA512
3a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp37A5.tmp

Filesize
4KB

MD5
135c60fadfa99b241d9109417db8b53c

SHA1
b73785818a32e8d84bb55c02ccdc3d546a615526

SHA256
01fc52f877352f6252d3d9351993fc35d7b6b0051ac6d3146184e12f9bc6e704

SHA512
76812b91e51f1a206e3829b44cf13ee4cc4e5e90d88c0b0b3755b1e092eee26e6a4b18ef038a311a9443dab138761ff45fdd18145931207764c2355047611f51

Download Submit
C:\Users\Admin\AppData\Local\start.exe

Filesize
739KB

MD5
40d8409d81ecf1e7bef4b135a8eec054

SHA1
aceda599cc1666d7ad67ad4404275b59e1f49cda

SHA256
8250c4cba2061a09f1b67ef42738e80e488f1fd44dea12b35071c15acdee4f04

SHA512
bd48ceaf3c72836e93622afee9b73529475f7d7605187d727c279644dc7a3bb79922df5ecf8422df8ce2392bb3b3f26cd38d8c01a9622a4c9800a3ad13f36fd0

Download Submit
memory/448-5-0x0000000007CA0000-0x0000000008244000-memory.dmp

Filesize
5.6MB

Download
memory/448-4-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/448-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/448-6-0x00000000077E0000-0x0000000007872000-memory.dmp

Filesize
584KB

Download
memory/448-10-0x0000000074950000-0x0000000075100000-memory.dmp

Filesize
7.7MB

Download
memory/448-3-0x00000000051C0000-0x00000000051E8000-memory.dmp

Filesize
160KB

Download
memory/448-2-0x00000000075B0000-0x00000000076E8000-memory.dmp

Filesize
1.2MB

Download
memory/448-1-0x0000000000690000-0x0000000000752000-memory.dmp

Filesize
776KB

Download
memory/636-34-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/636-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/636-31-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1404-29-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1404-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1404-22-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2556-13-0x0000000008120000-0x00000000081BC000-memory.dmp

Filesize
624KB

Download
memory/3520-20-0x0000000004F70000-0x0000000004FD6000-memory.dmp

Filesize
408KB

Download
memory/3520-19-0x0000000004D10000-0x0000000004D86000-memory.dmp

Filesize
472KB

Download
memory/3520-18-0x0000000000700000-0x0000000000790000-memory.dmp

Filesize
576KB

Download
memory/3520-35-0x0000000005B40000-0x0000000005B4A000-memory.dmp

Filesize
40KB

Download