hawkeye | e7765ed8df9ebc5a0132c49856ae1219b390069886042ee0b7265f090b85463b | Triage

Sharing

General

Target

3fecb296c3d186fe69f9476863a1aa5f_JaffaCakes118
Size

386KB
Sample

240713-dgjzvasfpl
MD5

3fecb296c3d186fe69f9476863a1aa5f
SHA1

76f97ccd5f68cb11acc7a1191a3f6076403fb1f6
SHA256

e7765ed8df9ebc5a0132c49856ae1219b390069886042ee0b7265f090b85463b
SHA512

2b1330b23e1a7c587f86054a32f2342e0c4ebc0faac578c49f260a46e43c7e99a7a62e08be6d906b69bf13b0a42c7cf82c42a3dd759417ffdedf8f1d3893baee
SSDEEP

6144:wNrEHrktbqIKN4VAOig/xmrpQBfsvOVPJu7qVTXs/tpupqJ+OoaL1ZRGv:rrGzK4dmr6/VPqqhXsF8g4v

Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  3fecb296c3d186fe69f9476863a1aa5f_JaffaCakes118
- Size
  
  386KB
- MD5
  
  3fecb296c3d186fe69f9476863a1aa5f
- SHA1
  
  76f97ccd5f68cb11acc7a1191a3f6076403fb1f6
- SHA256
  
  e7765ed8df9ebc5a0132c49856ae1219b390069886042ee0b7265f090b85463b
- SHA512
  
  2b1330b23e1a7c587f86054a32f2342e0c4ebc0faac578c49f260a46e43c7e99a7a62e08be6d906b69bf13b0a42c7cf82c42a3dd759417ffdedf8f1d3893baee
- SSDEEP
  
  6144:wNrEHrktbqIKN4VAOig/xmrpQBfsvOVPJu7qVTXs/tpupqJ+OoaL1ZRGv:rrGzK4dmr6/VPqqhXsF8g4v
Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyeevasionkeyloggerpersistencespywarestealertrojan

behavioral2

hawkeyeevasionkeyloggerpersistencespywarestealertrojan