hawkeye | bd3844aca4658bc26c5e1f8cdbe680e1be2d5ad9cb632e26ac016f1db353ddbe

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe
Size

56KB
MD5

5bbdc3c3a415be2a687e0917852a6741
SHA1

b2ab9df71047cd06e59b5bbb75dd4457122ceb25
SHA256

bd3844aca4658bc26c5e1f8cdbe680e1be2d5ad9cb632e26ac016f1db353ddbe
SHA512

f8354584ddd0ae442a9313d5dd27a7e790a88479dd70faa31cab69be933bbb6995812048b0e434285a82671783eb2685268ab67e658c809a2db86de1e835c07f
SSDEEP

1536:ChaVbgQk6DqbjQBrZV8mLuFsLxFpYFvTUE:CDQk6DojQBtVisL3pYFbUE

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	vbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	vbc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1788-4-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/1788-7-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/1788-8-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral2/memory/1788-14-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winni.exe = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe"	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3O9WCWVEA1K5 = "C:\\Users\\Admin\\AppData\\Roaming\\8CF7IRKT.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3468 set thread context of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1788	vbc.exe
1788	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83
PID 3468 wrote to memory of 1788	3468	5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5bbdc3c3a415be2a687e0917852a6741_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3468-0-0x00000000745E2000-0x00000000745E3000-memory.dmp

Filesize
4KB

Download
memory/3468-1-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/3468-2-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/3468-13-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads