hawkeye | 3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5 | Triage

Sharing

General

Target

643daec49804b49751bd0a33c6ab4107_JaffaCakes118
Size

646KB
Sample

240722-wr98wszene
MD5

643daec49804b49751bd0a33c6ab4107
SHA1

7a0df7d13959291039a5c355aaf346b801822bbc
SHA256

3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5
SHA512

421857dc6ff4e0ea18a6499c0895e7b8ea299e85d0f1ddaa816e1a48381aa2924e259171e8397d0f62e5b27c7b184cde4746a13f2171f682c6c7994b385c6b64
SSDEEP

12288:W9hD4I9UbehTB0m2b+4bofIP0I07zcAQ4/ejsYmBN66tfPQG5iKICqmFXgiFYBTJ:tIybe9B0m2RbofIP0I07zcAQ4/ejsYmV

Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  643daec49804b49751bd0a33c6ab4107_JaffaCakes118
- Size
  
  646KB
- MD5
  
  643daec49804b49751bd0a33c6ab4107
- SHA1
  
  7a0df7d13959291039a5c355aaf346b801822bbc
- SHA256
  
  3be96fae73eee287dee7a806e61278695afdb340b3d1efea2f68df960e71d5a5
- SHA512
  
  421857dc6ff4e0ea18a6499c0895e7b8ea299e85d0f1ddaa816e1a48381aa2924e259171e8397d0f62e5b27c7b184cde4746a13f2171f682c6c7994b385c6b64
- SSDEEP
  
  12288:W9hD4I9UbehTB0m2b+4bofIP0I07zcAQ4/ejsYmBN66tfPQG5iKICqmFXgiFYBTJ:tIybe9B0m2RbofIP0I07zcAQ4/ejsYmV
Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Modifies firewall policy service
  evasion
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyeevasionkeyloggerpersistencespywarestealertrojan

behavioral2

hawkeyeevasionkeyloggerpersistencespywarestealertrojan