Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 04:01
General
-
Target
91884f1ac121d9e5ded8bdef85da6052_JaffaCakes118.exe
-
Size
192KB
-
MD5
91884f1ac121d9e5ded8bdef85da6052
-
SHA1
e92c5ef867200ce2afe6d2ef3d2515375c25a8f7
-
SHA256
86a825dc2b72314a5db4885e495db0ed61044e3ed8e00cbe7dc05c706b66be5b
-
SHA512
62c19263d2dcd265610957176bb0794e071837b6b1c2e6922afd29c097fcfe210657627739b3e3e1c8409b0a8afb6b647e6d246eb276c10e0d1531293551311d
-
SSDEEP
3072:gej6QTDgiEIDL5ntDnj/rlIudpB8gkgqXEoqGxT5AH:g8hvg8DL5ntb7hBkgXoZxT5K
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
78951asd
Signatures
-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91884f1ac121d9e5ded8bdef85da6052_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\91884f1ac121d9e5ded8bdef85da6052_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD5007f02e79bb52ccf5f6fdf35a0daeeb3
SHA1ab4948bf44ebbe20a5b6b1aceaec10e770b4b75a
SHA25690c00b8890e07b8c0018615d071054177566933769fcebb2c267870f710cc6c1
SHA512e666780b772935b54a6707eede2d97f6008d2653c1c105e654ae268417679108c02b755354577bab9b40377fd5e61af25796ab0f81cafd2af5556bb256d28f6d
-
Filesize
192KB
MD591884f1ac121d9e5ded8bdef85da6052
SHA1e92c5ef867200ce2afe6d2ef3d2515375c25a8f7
SHA25686a825dc2b72314a5db4885e495db0ed61044e3ed8e00cbe7dc05c706b66be5b
SHA51262c19263d2dcd265610957176bb0794e071837b6b1c2e6922afd29c097fcfe210657627739b3e3e1c8409b0a8afb6b647e6d246eb276c10e0d1531293551311d
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
136KB
-
Filesize
392KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
3.1MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB