Analysis
-
max time kernel
133s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe
-
Size
768KB
-
MD5
7f202658dcb777cf61e8e315e8bddfcd
-
SHA1
1b173c702742d7c1b749223f4728520c5506f38a
-
SHA256
651652c6eb59a36cd2fe91699344641d1a28bff18f8d4cbe2437a5970904ee4a
-
SHA512
27cfb4dd0893646cfa01a39133d294f1b66721d6916382b9b710d062c487bf332c3d43669e8ca2268879b33ce46caf519581e271beea7d2e704a14582129a3ab
-
SSDEEP
12288:391tp0vTsEDUAIokIh2GqvGDC0oqZWEM4DHkuOWbfGq764yHAYXHw25/7:3PtSgEQrXKURqZWExdlbfGq7Fr0D5D
Malware Config
Extracted
hawkeye_reborn
9.0.1.6
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Princeboy1
123f6b8d-bd46-482b-bbfe-b5cde1cc0d04
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:false _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Princeboy1 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:300 _MeltFile:false _Mutex:123f6b8d-bd46-482b-bbfe-b5cde1cc0d04 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral2/memory/4516-11-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4516-13-0x0000000005040000-0x00000000050B6000-memory.dmp MailPassView behavioral2/memory/2016-30-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2016-32-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2016-34-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/4516-13-0x0000000005040000-0x00000000050B6000-memory.dmp WebBrowserPassView behavioral2/memory/3320-18-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3320-20-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3320-21-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView behavioral2/memory/3320-28-0x0000000000400000-0x000000000045B000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
resource yara_rule behavioral2/memory/4516-13-0x0000000005040000-0x00000000050B6000-memory.dmp Nirsoft behavioral2/memory/3320-18-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3320-20-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3320-21-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/3320-28-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/2016-30-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2016-32-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2016-34-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 428 set thread context of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 4516 set thread context of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 set thread context of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 -
Program crash 1 IoCs
pid pid_target Process procid_target 3876 428 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe 3320 vbc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe Token: 33 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe Token: SeDebugPrivilege 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 428 wrote to memory of 4516 428 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 95 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 3320 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 99 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100 PID 4516 wrote to memory of 2016 4516 7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7f202658dcb777cf61e8e315e8bddfcd_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpED0.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp12D8.tmp"3⤵
- Accesses Microsoft Outlook accounts
PID:2016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 10362⤵
- Program crash
PID:3876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 428 -ip 4281⤵PID:60
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5788d7419b32411807cc6753cbbccecbe
SHA1761b99a1e5bc168f525181d78cff3f6ed82daa14
SHA25676150e857b36f1f070422d2ad4df17f87454466348e4bfc158b028977378140b
SHA5123003f104b0b07870015ff4e9e0d254c2e537d4c68ef664a772d7018827b0ccbeb5481a2ce587b88e6ab1d71d6ce523a620c11c00c676857d5fd5ab949fa617b4