hawkeye | bd3844aca4658bc26c5e1f8cdbe680e1be2d5ad9cb632e26ac016f1db353ddbe

General

Target

5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe
Size

56KB
MD5

5bbdc3c3a415be2a687e0917852a6741
SHA1

b2ab9df71047cd06e59b5bbb75dd4457122ceb25
SHA256

bd3844aca4658bc26c5e1f8cdbe680e1be2d5ad9cb632e26ac016f1db353ddbe
SHA512

f8354584ddd0ae442a9313d5dd27a7e790a88479dd70faa31cab69be933bbb6995812048b0e434285a82671783eb2685268ab67e658c809a2db86de1e835c07f
SSDEEP

1536:ChaVbgQk6DqbjQBrZV8mLuFsLxFpYFvTUE:CDQk6DojQBtVisL3pYFbUE

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2536-2-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2536-4-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2536-6-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2536-7-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2536-10-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2536-11-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vbc.exe5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\winni.exe = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2524 set thread context of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vbc.exe

pid	Process
2536	vbc.exe
2536	vbc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30
PID 2524 wrote to memory of 2536	2524	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000074AE2000-0x0000000074AE4000-memory.dmp

Filesize
8KB

Download
memory/2536-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2536-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads