Overview

overview

10

Static

static

3

9066bf885c...18.exe

windows7-x64

10

9066bf885c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9066bf885cd72e46771654d0d8be15d3_JaffaCakes118

  • Size

    201KB

  • Sample

    240812-1kjjtawcpc

  • MD5

    9066bf885cd72e46771654d0d8be15d3

  • SHA1

    13afce866b59c99fa0319b7f204e6b6828d4b22c

  • SHA256

    ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

  • SHA512

    ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec

  • SSDEEP

    6144:Cz+glrx25snmJr/TqRd4y/Nns9ImK+BqIbsJHo57:Cz+glrxcsnor/mRGmsCt+BqFxod

Score
10/10
hawkeyediscoveryevasionkeyloggerpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      9066bf885cd72e46771654d0d8be15d3_JaffaCakes118

    • Size

      201KB

    • MD5

      9066bf885cd72e46771654d0d8be15d3

    • SHA1

      13afce866b59c99fa0319b7f204e6b6828d4b22c

    • SHA256

      ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

    • SHA512

      ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec

    • SSDEEP

      6144:Cz+glrx25snmJr/TqRd4y/Nns9ImK+BqIbsJHo57:Cz+glrxcsnor/mRGmsCt+BqFxod

    Score
    10/10
    hawkeyediscoveryevasionkeyloggerpersistencespywarestealertrojanupx

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks