Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 09:09

General

  • Target

    6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe

  • Size

    900KB

  • MD5

    6dff832f07ea61ef0fa90d148cf09509

  • SHA1

    6831f7896e97c992593474731cbfa6fb1a45e698

  • SHA256

    314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42

  • SHA512

    7cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047

  • SSDEEP

    24576:KKOQZ1K7cdUIV4+M3EaRfUP6KbHkLYzCcpYsK5LExBMS:KKOQG7cVM3r1iHFzCMYskIw

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • M00nD3v Logger payload 3 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"
      2⤵
        PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\AppData\Local\app.exe
          "C:\Users\Admin\AppData\Local\app.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1688
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1620
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpBFF5.tmp"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpBFF5.tmp

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Admin\AppData\Local\app.exe

      Filesize

      900KB

      MD5

      6dff832f07ea61ef0fa90d148cf09509

      SHA1

      6831f7896e97c992593474731cbfa6fb1a45e698

      SHA256

      314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42

      SHA512

      7cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047

    • memory/1620-17-0x0000000007210000-0x0000000007286000-memory.dmp

      Filesize

      472KB

    • memory/1620-15-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1620-16-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1620-14-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/1688-13-0x0000000000820000-0x000000000090A000-memory.dmp

      Filesize

      936KB

    • memory/1896-8-0x0000000074230000-0x000000007491E000-memory.dmp

      Filesize

      6.9MB

    • memory/1896-11-0x0000000074230000-0x000000007491E000-memory.dmp

      Filesize

      6.9MB

    • memory/1896-0-0x000000007423E000-0x000000007423F000-memory.dmp

      Filesize

      4KB

    • memory/1896-7-0x000000007423E000-0x000000007423F000-memory.dmp

      Filesize

      4KB

    • memory/1896-4-0x0000000074230000-0x000000007491E000-memory.dmp

      Filesize

      6.9MB

    • memory/1896-3-0x00000000003F0000-0x000000000040E000-memory.dmp

      Filesize

      120KB

    • memory/1896-2-0x0000000006F30000-0x0000000007010000-memory.dmp

      Filesize

      896KB

    • memory/1896-1-0x00000000002C0000-0x00000000003AA000-memory.dmp

      Filesize

      936KB

    • memory/2912-30-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-31-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2912-27-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-25-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-23-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-21-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-34-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2912-19-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB