Analysis

  • max time kernel
    135s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 12:14

General

  • Target

    9aa0e25762c386e5c7f2a18da39183f7_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    9aa0e25762c386e5c7f2a18da39183f7

  • SHA1

    5cfac6a4655d4deccaabd0aa8659d21b6a66a41b

  • SHA256

    a3d665070c66cd0a5121c90f79f070c382de620a3e1f600dceccfee7481e3dee

  • SHA512

    0b0d1943d701c03c76e6b45992fc0ca5f72a12ae41d6c0a112a4254e89b2a882ca0a6e9dde7a4c0fe9b7fa3d51d8c916ab220a8ac648f618161104c17fb66b96

  • SSDEEP

    12288:corJdadAJkO1TgvfwymWmaWq/b11ysXuD6dtSkKl38FjcY4V6St6UfX:co7JV1TmfkWmSLzUkKl38lcF7t5/

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.lycos.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    subjected1
Mutex

c0598697-7482-4f6c-84b0-384a27d361b0

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:subjected1 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.lycos.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:c0598697-7482-4f6c-84b0-384a27d361b0 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • M00nD3v Logger payload 1 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9aa0e25762c386e5c7f2a18da39183f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9aa0e25762c386e5c7f2a18da39183f7_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WNFbBnq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp970B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1452
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC157.tmp"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2692
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpC55F.tmp"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:988
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
    1⤵
      PID:1204

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp970B.tmp

      Filesize

      1KB

      MD5

      816e613a893aa305f635d4bd23609a8f

      SHA1

      2cecde8b7023bf63e3d91e27707a26e56e94ba4f

      SHA256

      c9eaa510717495a46fcbb8103c230ee20ba87f6282343b237d123640b3ce4d57

      SHA512

      83f2deabc0314d80c4aa6e1f9a52fb7eaa014e3f00236d816262742656d3972e9deaec76a3ca707ed32947fec10d448dca1fa323e0f11f0aad1d916010ca7dbd

    • C:\Users\Admin\AppData\Local\Temp\tmpC157.tmp

      Filesize

      4KB

      MD5

      91227a2f05c7f74f6ebd1535a3f05b7b

      SHA1

      1ce317a272d67e3ac284948e49e6bc0acaee2e6d

      SHA256

      2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2

      SHA512

      9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40

    • memory/396-11-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/396-31-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/396-8-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

    • memory/396-9-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/396-10-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/988-30-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/988-28-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/988-27-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/2692-23-0x0000000000460000-0x0000000000529000-memory.dmp

      Filesize

      804KB

    • memory/2692-15-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2692-17-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2692-18-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2692-25-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3500-13-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-0-0x0000000075402000-0x0000000075403000-memory.dmp

      Filesize

      4KB

    • memory/3500-5-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-4-0x0000000075402000-0x0000000075403000-memory.dmp

      Filesize

      4KB

    • memory/3500-3-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-2-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB

    • memory/3500-1-0x0000000075400000-0x00000000759B1000-memory.dmp

      Filesize

      5.7MB