Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 23:20

General

  • Target

    504a43899542a8bd83295429dab03369JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    504a43899542a8bd83295429dab03369

  • SHA1

    6ae1bc147747aee1cbc9393df6bd423f58aab229

  • SHA256

    8d118c09e62311d027838c76495d6d299e94b802d35a2ff0670d17a743fa10d9

  • SHA512

    1bdafacb91136dbbcb3e5f492b7185ebdb7364874e2d9b4d674957f7702a13bd43e0ec0ae1ef3fff84f8ed835e141928f55095916230c97d7fb2adb34483d5d9

  • SSDEEP

    24576:ZkUskXgk1aLQMPZD6DjVhWJP2kC3jHwXyAlZMZfnUoAWK9oT:qkXF1uQM9UhSPFC3jK5HKUhWTT

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • M00nD3v Logger payload 4 IoCs

    Detects M00nD3v Logger payload in memory.

  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\504a43899542a8bd83295429dab03369JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\504a43899542a8bd83295429dab03369JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    PID:4920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1176
      2⤵
      • Program crash
      PID:2656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 4920
    1⤵
      PID:3700

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\win.ini

      Filesize

      111B

      MD5

      45fc085b156dff15d5472839a842a650

      SHA1

      70623f377b48c1a5a05866b675008851dc043c3b

      SHA256

      a38c356a0ad92fdfa96d20675c979528ffd39d0449d0965d8a5cb7dca753b718

      SHA512

      5e9b995e76800cbf5c3161d8d8c7fc81698ed90ffe3cf198c13e81b60b547e68493337f938e453cfb363b74e96e6615f8549bb6f1d826d02a62d2e2c992190aa

    • memory/4920-213-0x0000000077B81000-0x0000000077CA1000-memory.dmp

      Filesize

      1.1MB

    • memory/4920-214-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/4920-216-0x0000000000400000-0x000000000052D000-memory.dmp

      Filesize

      1.2MB

    • memory/4920-215-0x0000000000400000-0x000000000052D000-memory.dmp

      Filesize

      1.2MB

    • memory/4920-217-0x0000000000400000-0x000000000052D000-memory.dmp

      Filesize

      1.2MB