Analysis
-
max time kernel
126s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe
-
Size
678KB
-
MD5
80b608f8dc479742af88700cdf15e5f2
-
SHA1
492c965587df9dbb10476507830be72d89971707
-
SHA256
4d020195285828592414a4f32ee5d1967ecb7432e4a66e3baad19b3eec907190
-
SHA512
8c6d0511b7b6e1ac186c49712733d7218d477c73315cd2c12bf7fefa6aebe6be62fadb56ae311542484203c129a75c58dc1ecc59e3e7750189a8e821a7e1bb76
-
SSDEEP
12288:KMpNU5q3r3hxVso+LZYlYI039Ii3E4NTgGiq4QJjbmfa4:zpCq3txcLuF03vtgGx4QFb2
Malware Config
Extracted
hawkeye_reborn
10.0.0.0
Protocol: smtp- Host:
mail.floordecor.in - Port:
25 - Username:
[email protected] - Password:
Fantabulous0!
db9aeb2f-51cd-4c51-810c-a0d53ca41f68
-
fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:Fantabulous0! _EmailPort:25 _EmailSSL:false _EmailServer:mail.floordecor.in _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:5 _MeltFile:false _Mutex:db9aeb2f-51cd-4c51-810c-a0d53ca41f68 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
-
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2840-25-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2840-27-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2840-28-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView behavioral2/memory/2840-31-0x0000000000400000-0x000000000041C000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4572-15-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/4572-12-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/4572-16-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView behavioral2/memory/4572-23-0x0000000000400000-0x000000000045C000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-15-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/4572-12-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/4572-16-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/4572-23-0x0000000000400000-0x000000000045C000-memory.dmp Nirsoft behavioral2/memory/2840-25-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2840-27-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2840-28-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/2840-31-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 38 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 4320 set thread context of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 2536 set thread context of 4572 2536 RegSvcs.exe vbc.exe PID 2536 set thread context of 2840 2536 RegSvcs.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exeRegSvcs.exepid process 4572 vbc.exe 4572 vbc.exe 4572 vbc.exe 4572 vbc.exe 2536 RegSvcs.exe 2536 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2536 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2536 RegSvcs.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exeRegSvcs.exedescription pid process target process PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 4320 wrote to memory of 2536 4320 80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe RegSvcs.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 4572 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe PID 2536 wrote to memory of 2840 2536 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80b608f8dc479742af88700cdf15e5f2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2AB5.tmp"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2EBD.tmp"3⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2AB5.tmpFilesize
4KB
MD5a13985d129d8bf808cec12f9fe7b4ed3
SHA13981490aa1ce9401c4470f0277fda627d9236356
SHA256d3a2b4e44262cfbfb97652de5f54b36bfc525396d1d70dea03ab24c902dab8ef
SHA5125c990ca4e978b874e0863ad4bf1ccbe04499960d5c17fb16776297d22db5f168aa3a5a9863ec5a9f8286dda2f9fd96852f2dc2ef029c13ba659e33694c344887
-
memory/2536-14-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2536-10-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2536-32-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2536-9-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2536-5-0x0000000000400000-0x0000000000490000-memory.dmpFilesize
576KB
-
memory/2536-33-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2536-8-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/2840-25-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2840-27-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2840-31-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2840-28-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4320-3-0x0000000074B12000-0x0000000074B13000-memory.dmpFilesize
4KB
-
memory/4320-4-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/4320-1-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/4320-2-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/4320-7-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/4320-0-0x0000000074B12000-0x0000000074B13000-memory.dmpFilesize
4KB
-
memory/4572-21-0x0000000000460000-0x0000000000529000-memory.dmpFilesize
804KB
-
memory/4572-23-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4572-16-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4572-12-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4572-15-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB