hawkeye | 890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Size

64KB
MD5

cbd580a72e33066ca1b613a1119af858
SHA1

489de2a877ba995ba485bd07d7f1a1675ed4b6ba
SHA256

890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410
SHA512

8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29
SSDEEP

1536:cEUQjlDAMOcnNFCEcK3gGrvCv7OqcjoG:cVulMMlXE+g4Y7go

Score

10^/10

hawkeye xtremerat discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Signatures

Detect XtremeRAT payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-37-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2820-36-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2820-38-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2304-52-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2608-66-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2820-75-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2608-77-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid	Process
2124	explorer.exe

Executes dropped EXE 3 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	Process
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe

Loads dropped DLL 6 IoCs

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exemvscavAP.exe

pid	Process
2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
2124	explorer.exe
2124	explorer.exe
2792	mvscavAP.exe
2792	mvscavAP.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2820-31-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-33-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-27-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-25-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-37-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-36-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-35-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-38-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2304-52-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2608-66-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2820-75-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2608-77-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mvscavAP.exesvchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\mvscavAP.exe"	mvscavAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

explorer.exeSiaPort.exe

description	pid	Process	procid_target
PID 2124 set thread context of 2820	2124	explorer.exe	31
PID 2620 set thread context of 1660	2620	SiaPort.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AppLaunch.exemvscavAP.exesvchost.exeSiaPort.exeAppLaunch.exesvchost.execbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvscavAP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SiaPort.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	Process
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe
2792	mvscavAP.exe
2620	SiaPort.exe
2124	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exemvscavAP.exeSiaPort.exe

description	pid	Process
Token: SeDebugPrivilege	2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Token: SeDebugPrivilege	2124	explorer.exe
Token: SeDebugPrivilege	2792	mvscavAP.exe
Token: SeDebugPrivilege	2620	SiaPort.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid	Process
2608	svchost.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exeAppLaunch.exemvscavAP.exeSiaPort.exe

description	pid	Process	procid_target
PID 2488 wrote to memory of 2124	2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2124	2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2124	2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	30
PID 2488 wrote to memory of 2124	2488	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	30
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2124 wrote to memory of 2820	2124	explorer.exe	31
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2124 wrote to memory of 2792	2124	explorer.exe	33
PID 2124 wrote to memory of 2792	2124	explorer.exe	33
PID 2124 wrote to memory of 2792	2124	explorer.exe	33
PID 2124 wrote to memory of 2792	2124	explorer.exe	33
PID 2820 wrote to memory of 2304	2820	AppLaunch.exe	32
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34
PID 2792 wrote to memory of 2620	2792	mvscavAP.exe	35
PID 2792 wrote to memory of 2620	2792	mvscavAP.exe	35
PID 2792 wrote to memory of 2620	2792	mvscavAP.exe	35
PID 2792 wrote to memory of 2620	2792	mvscavAP.exe	35
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2620 wrote to memory of 1660	2620	SiaPort.exe	36
PID 2820 wrote to memory of 2608	2820	AppLaunch.exe	34

C:\Users\Admin\AppData\Local\Temp\cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2304
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2608
- - C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe
    "C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
      "C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
8dc82fed16fd02c41ba95b2773fbdd12

SHA1
84d26f842385c47e537986f550b030372b2ce96d

SHA256
fd601162c3be910e0463ed9002276cb491308a30bb1a618d559f238e8607773b

SHA512
375837893e357bd09568859b9b1a631f7682292bbb7f7c8bcdb1dad50948e24b590a0ef196490ae76026ea04a39874c6119c0898dcbc0386cb99a73efd27ab4f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\P3dGcZj.cfg

Filesize
1KB

MD5
96fedf32ba724566d57ca71a594ccc66

SHA1
e8c70c8fbc6d82815bc17e89e79d24debc9adcec

SHA256
c2858d50d4ec9e7314f9f657db3d7b462cce14ad89eb504b14d4e5effc100f9a

SHA512
3097b0a0ec32be4709f0b63c4bc4ab6d90aa4805ceb927e72c31000deb9a533a345e46330a5e9b9b947d549d803caa945438ceb175b3c382c818c552ad6f0de1

Download Submit
\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe

Filesize
7KB

MD5
1e065c8186d7d23b9fad718e030ad963

SHA1
ed1f41e4d34ed3321eb9dfbc6ac82b322de0c904

SHA256
45c1f790d9b856ccc02aa6be9f1102734fd9df534f6cea3b905de0698caedfdb

SHA512
feef86acf449371102d4bf7a3b6aa50ebafff01d4f23c9bf24f69e35faf92956f205d8c8ea082d615e62b680ed1038dfda6e4e099707be45c2b7bdf32bffbc23

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
64KB

MD5
cbd580a72e33066ca1b613a1119af858

SHA1
489de2a877ba995ba485bd07d7f1a1675ed4b6ba

SHA256
890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

SHA512
8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29

Download Submit
memory/2124-16-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-17-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-15-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-78-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2304-52-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2488-14-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-2-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-1-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2488-0-0x0000000074181000-0x0000000074182000-memory.dmp

Filesize
4KB

Download
memory/2608-77-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2608-66-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-27-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-36-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-35-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-38-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-37-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-23-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-25-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-75-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-33-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2820-31-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download