hawkeye | 7c4bf29e8ed9f775fb2420ca56883196935cd0b6f4ccee62058818034caf8c96

General

Target

3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe
Size

262KB
MD5

3993696c0cc918c566ad9c89b5be2593
SHA1

c119e09a1ab2a2d5aeccc588d0406a4ee5f16f7a
SHA256

7c4bf29e8ed9f775fb2420ca56883196935cd0b6f4ccee62058818034caf8c96
SHA512

9b0d289c69c9d4e93779d1b82e9442f851e1ca2f2fd73e25192c6944cf5f52321509fe9f07553808a59bef5a2c851c384057d3b206045090ffef6b632d129ca5
SSDEEP

6144:tJXQh6uTjQ4rVmh3k4cSbgzsdrVRRetrEpsKHAK3g3UHYTvLRUQSOObAIASgrtH0:fOJcsgHoRIDCzc

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
themomentoftruth

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

audiodgi.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	audiodgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2648 svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	svchost.exe
File created	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	svchost.exe

Executes dropped EXE 5 IoCs

Processes:

svchost.exesvchost.exeaudiodgi.exewmpmetwk.exewmpmetwk.exe

pid process

2648 svchost.exe
2756 svchost.exe
2640 audiodgi.exe
2556 wmpmetwk.exe
832 wmpmetwk.exe

Loads dropped DLL 7 IoCs

Processes:

3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exesvchost.exeaudiodgi.exewmpmetwk.exe

pid	process
2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe
2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe
2648	svchost.exe
2648	svchost.exe
2640	audiodgi.exe
2640	audiodgi.exe
2556	wmpmetwk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

audiodgi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

svchost.exewmpmetwk.exe

description	pid	process	target process
PID 2648 set thread context of 2756	2648	svchost.exe	svchost.exe
PID 2556 set thread context of 832	2556	wmpmetwk.exe	wmpmetwk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exeaudiodgi.exewmpmetwk.exesvchost.exe

pid	process
2648	svchost.exe
2640	audiodgi.exe
2648	svchost.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2756	svchost.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2648	svchost.exe
2640	audiodgi.exe
2556	wmpmetwk.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2648	svchost.exe
2640	audiodgi.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2556	wmpmetwk.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe
2756	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exesvchost.exeaudiodgi.exewmpmetwk.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe
Token: SeDebugPrivilege	2648	svchost.exe
Token: SeDebugPrivilege	2640	audiodgi.exe
Token: SeDebugPrivilege	2556	wmpmetwk.exe
Token: SeDebugPrivilege	2756	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

2756 svchost.exe

pid	process
2756	svchost.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exesvchost.exeaudiodgi.exewmpmetwk.exe

description	pid	process	target process
PID 2072 wrote to memory of 2648	2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe	svchost.exe
PID 2072 wrote to memory of 2648	2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe	svchost.exe
PID 2072 wrote to memory of 2648	2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe	svchost.exe
PID 2072 wrote to memory of 2648	2072	3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2756	2648	svchost.exe	svchost.exe
PID 2648 wrote to memory of 2640	2648	svchost.exe	audiodgi.exe
PID 2648 wrote to memory of 2640	2648	svchost.exe	audiodgi.exe
PID 2648 wrote to memory of 2640	2648	svchost.exe	audiodgi.exe
PID 2648 wrote to memory of 2640	2648	svchost.exe	audiodgi.exe
PID 2640 wrote to memory of 2556	2640	audiodgi.exe	wmpmetwk.exe
PID 2640 wrote to memory of 2556	2640	audiodgi.exe	wmpmetwk.exe
PID 2640 wrote to memory of 2556	2640	audiodgi.exe	wmpmetwk.exe
PID 2640 wrote to memory of 2556	2640	audiodgi.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe
PID 2556 wrote to memory of 832	2556	wmpmetwk.exe	wmpmetwk.exe

C:\Users\Admin\AppData\Local\Temp\3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3993696c0cc918c566ad9c89b5be2593_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2756

C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
"C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
"C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
5⤵
- Executes dropped EXE
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
87B

MD5
c5ddc70af709b8c36260a10e9d37be9e

SHA1
4494984a1968a6053068d73d27de75a66c17f7cf

SHA256
39e1cea64f487ab34ed56c9164c90330d224dbd0ddc314beb657909420eb96ff

SHA512
3da0de610e81b05a7245851848e961326095b962ef1d37e212b37edf70256a526fbe8d58abedb2ada3141f858936a1fecba35f4909c1c98bc03dbe9e54736ec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

Filesize
7KB

MD5
2e18e07194565987ef816f36c4a2134e

SHA1
5278b14dc0704abd700264bb9f8610caf5d007eb

SHA256
44c927820ec11111ab620bfa75b71986b9e675770a782e3c740040d484e5dbd7

SHA512
7160e14ec359e738e77afed6341890a8084605543e7deb8720457825ff013b907e7233cc890a8c63614b4d481bc73fb72cf15378d8f3534dfb9c8064fed6f930

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
262KB

MD5
3993696c0cc918c566ad9c89b5be2593

SHA1
c119e09a1ab2a2d5aeccc588d0406a4ee5f16f7a

SHA256
7c4bf29e8ed9f775fb2420ca56883196935cd0b6f4ccee62058818034caf8c96

SHA512
9b0d289c69c9d4e93779d1b82e9442f851e1ca2f2fd73e25192c6944cf5f52321509fe9f07553808a59bef5a2c851c384057d3b206045090ffef6b632d129ca5

Download Submit
memory/832-54-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-3-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-18-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2072-0-0x0000000074491000-0x0000000074492000-memory.dmp

Filesize
4KB

Download
memory/2648-19-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-23-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-22-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2648-64-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-44-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-65-0x0000000074490000-0x0000000074A3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads