Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 09:09
Static task
static1
Behavioral task
behavioral1
Sample
6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe
-
Size
900KB
-
MD5
6dff832f07ea61ef0fa90d148cf09509
-
SHA1
6831f7896e97c992593474731cbfa6fb1a45e698
-
SHA256
314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42
-
SHA512
7cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047
-
SSDEEP
24576:KKOQZ1K7cdUIV4+M3EaRfUP6KbHkLYzCcpYsK5LExBMS:KKOQG7cVM3r1iHFzCMYskIw
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
Processes:
resource yara_rule behavioral1/memory/1620-14-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1620-16-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/1620-15-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1620-17-0x0000000007210000-0x0000000007286000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1620-17-0x0000000007210000-0x0000000007286000-memory.dmp WebBrowserPassView behavioral1/memory/2912-31-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral1/memory/2912-30-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral1/memory/2912-34-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-17-0x0000000007210000-0x0000000007286000-memory.dmp Nirsoft behavioral1/memory/2912-31-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/memory/2912-30-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/memory/2912-34-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
app.exepid process 1688 app.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2852 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
app.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot" app.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
app.exeRegAsm.exedescription pid process target process PID 1688 set thread context of 1620 1688 app.exe RegAsm.exe PID 1620 set thread context of 2912 1620 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
vbc.exepid process 2912 vbc.exe 2912 vbc.exe 2912 vbc.exe 2912 vbc.exe 2912 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exeapp.exedescription pid process Token: SeDebugPrivilege 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe Token: SeDebugPrivilege 1688 app.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.execmd.exeapp.exeRegAsm.exedescription pid process target process PID 1896 wrote to memory of 2612 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2612 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2612 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2612 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2852 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2852 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2852 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 1896 wrote to memory of 2852 1896 6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe cmd.exe PID 2852 wrote to memory of 1688 2852 cmd.exe app.exe PID 2852 wrote to memory of 1688 2852 cmd.exe app.exe PID 2852 wrote to memory of 1688 2852 cmd.exe app.exe PID 2852 wrote to memory of 1688 2852 cmd.exe app.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1688 wrote to memory of 1620 1688 app.exe RegAsm.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe PID 1620 wrote to memory of 2912 1620 RegAsm.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6dff832f07ea61ef0fa90d148cf09509_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"2⤵PID:2612
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\app.exe"C:\Users\Admin\AppData\Local\app.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpBFF5.tmp"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBFF5.tmpFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\app.exeFilesize
900KB
MD56dff832f07ea61ef0fa90d148cf09509
SHA16831f7896e97c992593474731cbfa6fb1a45e698
SHA256314aec84e8bc95e59b62e69580e6f0525a53e0914c50c89da8f81cc84f93cf42
SHA5127cf036e2238e280da5f2b2d3134f80ddd10cc90fdbba7115bed4dcd038cf61026db81757c3ba968cec0378334cada10ea7ae673be6d9bbb875c78798f6ed9047
-
memory/1620-17-0x0000000007210000-0x0000000007286000-memory.dmpFilesize
472KB
-
memory/1620-15-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1620-16-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1620-14-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/1688-13-0x0000000000820000-0x000000000090A000-memory.dmpFilesize
936KB
-
memory/1896-8-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1896-11-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1896-0-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/1896-7-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/1896-4-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1896-3-0x00000000003F0000-0x000000000040E000-memory.dmpFilesize
120KB
-
memory/1896-2-0x0000000006F30000-0x0000000007010000-memory.dmpFilesize
896KB
-
memory/1896-1-0x00000000002C0000-0x00000000003AA000-memory.dmpFilesize
936KB
-
memory/2912-30-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-31-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2912-27-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-25-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-23-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-21-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-34-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2912-19-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB