hawkeye | 961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1 | Triage

Sharing

General

Target

7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118
Size

492KB
Sample

240731-1hhjqszamg
MD5

7e0a79cad98add88070148fb9ddb12aa
SHA1

75effc9d69686bf3a5937ffe48e2711b8d2828e3
SHA256

961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
SHA512

ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad
SSDEEP

12288:UrrkmWeRqPx0tCgJGP66jcrcfAD0UUzViH:eOecPx0tCp66AQ4D0UUzsH

Score

10^/10

hawkeye discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118
- Size
  
  492KB
- MD5
  
  7e0a79cad98add88070148fb9ddb12aa
- SHA1
  
  75effc9d69686bf3a5937ffe48e2711b8d2828e3
- SHA256
  
  961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
- SHA512
  
  ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad
- SSDEEP
  
  12288:UrrkmWeRqPx0tCgJGP66jcrcfAD0UUzViH:eOecPx0tCp66AQ4D0UUzsH
Score

10^/10

hawkeye discovery evasion keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Modifies firewall policy service
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyediscoveryevasionkeyloggerpersistencespywarestealertrojan

behavioral2

hawkeyediscoveryevasionkeyloggerpersistencespywarestealertrojan