hawkeye | 890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Size

64KB
MD5

cbd580a72e33066ca1b613a1119af858
SHA1

489de2a877ba995ba485bd07d7f1a1675ed4b6ba
SHA256

890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410
SHA512

8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29
SSDEEP

1536:cEUQjlDAMOcnNFCEcK3gGrvCv7OqcjoG:cVulMMlXE+g4Y7go

Score

10^/10

hawkeye xtremerat discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Signatures

Detect XtremeRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3036-25-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3036-24-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/3516-35-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4748-50-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral2/memory/4748-52-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exemvscavAP.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	mvscavAP.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid	Process
264	explorer.exe

Executes dropped EXE 3 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	Process
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3036-21-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3036-23-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3036-25-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3036-24-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/3516-35-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4748-50-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral2/memory/4748-52-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mvscavAP.exesvchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\mvscavAP.exe"	mvscavAP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

explorer.exeSiaPort.exe

description	pid	Process	procid_target
PID 264 set thread context of 3036	264	explorer.exe	88
PID 4868 set thread context of 2504	4868	SiaPort.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exeAppLaunch.exesvchost.exemvscavAP.exeSiaPort.exeAppLaunch.exesvchost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvscavAP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SiaPort.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	Process
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
4868	SiaPort.exe
264	explorer.exe
264	explorer.exe
3396	mvscavAP.exe
3396	mvscavAP.exe
4868	SiaPort.exe
4868	SiaPort.exe
264	explorer.exe
264	explorer.exe
3396	mvscavAP.exe
3396	mvscavAP.exe
4868	SiaPort.exe
4868	SiaPort.exe
264	explorer.exe
264	explorer.exe
3396	mvscavAP.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe
3396	mvscavAP.exe
4868	SiaPort.exe
264	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exemvscavAP.exeSiaPort.exe

description	pid	Process
Token: SeDebugPrivilege	4392	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
Token: SeDebugPrivilege	264	explorer.exe
Token: SeDebugPrivilege	3396	mvscavAP.exe
Token: SeDebugPrivilege	4868	SiaPort.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid	Process
4748	svchost.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exeexplorer.exeAppLaunch.exemvscavAP.exeSiaPort.exeAppLaunch.exe

description	pid	Process	procid_target
PID 4392 wrote to memory of 264	4392	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	87
PID 4392 wrote to memory of 264	4392	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	87
PID 4392 wrote to memory of 264	4392	cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe	87
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 264 wrote to memory of 3036	264	explorer.exe	88
PID 3036 wrote to memory of 3516	3036	AppLaunch.exe	89
PID 3036 wrote to memory of 3516	3036	AppLaunch.exe	89
PID 3036 wrote to memory of 3516	3036	AppLaunch.exe	89
PID 3036 wrote to memory of 3516	3036	AppLaunch.exe	89
PID 3036 wrote to memory of 4636	3036	AppLaunch.exe	90
PID 3036 wrote to memory of 4636	3036	AppLaunch.exe	90
PID 3036 wrote to memory of 4636	3036	AppLaunch.exe	90
PID 264 wrote to memory of 3396	264	explorer.exe	91
PID 264 wrote to memory of 3396	264	explorer.exe	91
PID 264 wrote to memory of 3396	264	explorer.exe	91
PID 3396 wrote to memory of 4868	3396	mvscavAP.exe	94
PID 3396 wrote to memory of 4868	3396	mvscavAP.exe	94
PID 3396 wrote to memory of 4868	3396	mvscavAP.exe	94
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 4868 wrote to memory of 2504	4868	SiaPort.exe	95
PID 2504 wrote to memory of 4748	2504	AppLaunch.exe	96
PID 2504 wrote to memory of 4748	2504	AppLaunch.exe	96
PID 2504 wrote to memory of 4748	2504	AppLaunch.exe	96
PID 2504 wrote to memory of 4748	2504	AppLaunch.exe	96
PID 3036 wrote to memory of 768	3036	AppLaunch.exe	97
PID 3036 wrote to memory of 768	3036	AppLaunch.exe	97
PID 3036 wrote to memory of 768	3036	AppLaunch.exe	97

C:\Users\Admin\AppData\Local\Temp\cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cbd580a72e33066ca1b613a1119af858_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3516
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:4636
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:768
- - C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe
    "C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
      "C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2504
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
8dc82fed16fd02c41ba95b2773fbdd12

SHA1
84d26f842385c47e537986f550b030372b2ce96d

SHA256
fd601162c3be910e0463ed9002276cb491308a30bb1a618d559f238e8607773b

SHA512
375837893e357bd09568859b9b1a631f7682292bbb7f7c8bcdb1dad50948e24b590a0ef196490ae76026ea04a39874c6119c0898dcbc0386cb99a73efd27ab4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe

Filesize
7KB

MD5
1e065c8186d7d23b9fad718e030ad963

SHA1
ed1f41e4d34ed3321eb9dfbc6ac82b322de0c904

SHA256
45c1f790d9b856ccc02aa6be9f1102734fd9df534f6cea3b905de0698caedfdb

SHA512
feef86acf449371102d4bf7a3b6aa50ebafff01d4f23c9bf24f69e35faf92956f205d8c8ea082d615e62b680ed1038dfda6e4e099707be45c2b7bdf32bffbc23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\P3dGcZj.cfg

Filesize
1KB

MD5
96fedf32ba724566d57ca71a594ccc66

SHA1
e8c70c8fbc6d82815bc17e89e79d24debc9adcec

SHA256
c2858d50d4ec9e7314f9f657db3d7b462cce14ad89eb504b14d4e5effc100f9a

SHA512
3097b0a0ec32be4709f0b63c4bc4ab6d90aa4805ceb927e72c31000deb9a533a345e46330a5e9b9b947d549d803caa945438ceb175b3c382c818c552ad6f0de1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
64KB

MD5
cbd580a72e33066ca1b613a1119af858

SHA1
489de2a877ba995ba485bd07d7f1a1675ed4b6ba

SHA256
890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

SHA512
8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29

Download Submit
memory/264-13-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/264-53-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/264-15-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3036-24-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3036-21-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3036-23-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3036-25-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/3516-35-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/4392-14-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/4392-2-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/4392-1-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/4392-0-0x00000000753C2000-0x00000000753C3000-memory.dmp

Filesize
4KB

Download
memory/4748-50-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/4748-52-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download