Overview

overview

10

Static

static

3

74e5ed5269...18.exe

windows7-x64

10

74e5ed5269...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118

  • Size

    169KB

  • Sample

    240726-vb54kateqb

  • MD5

    74e5ed5269a7436d2c634d718dd0a36a

  • SHA1

    9f96d79d44fd3d5e62345bb112c35b5653775379

  • SHA256

    9f1f28be4c21032cba96c553adf0b3b0874020bbc3caf7da31be41df464aa5cf

  • SHA512

    cd2f3ff28b49a0faded600390f03ec61845f943cfb2b1b231e3dbab441107a34bd8a824de2a080e9249c609a653268c4c057f084ba63273cd439e89e9d3e69b0

  • SSDEEP

    3072:FXKqLsn1Qbx8JQiKpZHekPD0qBxc9XOLWEqtaYGnPxENBbealADWCUgC61:F2SbxmQiuH7PD0qBxuXOCiYOPxENBK5D

Score
10/10
hawkeyediscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      74e5ed5269a7436d2c634d718dd0a36a_JaffaCakes118

    • Size

      169KB

    • MD5

      74e5ed5269a7436d2c634d718dd0a36a

    • SHA1

      9f96d79d44fd3d5e62345bb112c35b5653775379

    • SHA256

      9f1f28be4c21032cba96c553adf0b3b0874020bbc3caf7da31be41df464aa5cf

    • SHA512

      cd2f3ff28b49a0faded600390f03ec61845f943cfb2b1b231e3dbab441107a34bd8a824de2a080e9249c609a653268c4c057f084ba63273cd439e89e9d3e69b0

    • SSDEEP

      3072:FXKqLsn1Qbx8JQiKpZHekPD0qBxc9XOLWEqtaYGnPxENBbealADWCUgC61:F2SbxmQiuH7PD0qBxuXOCiYOPxENBK5D

    Score
    10/10
    hawkeyediscoverykeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks