hawkeye | acd94d6b3021ebdd56e395a37644d6765bd0012d4571714d6d418feeb626d000

General

Target

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Size

686KB
MD5

ef30953cbaaa700a085e3cfe29aaff9e
SHA1

8d2b2aea2daa5f43426e0b300b57d86bf20cacb3
SHA256

acd94d6b3021ebdd56e395a37644d6765bd0012d4571714d6d418feeb626d000
SHA512

b21b1a654a7bfe8bc0f3b9995822ab9fc60dca431f231ecccb32ceb40bc478bed315301a2c58f78fab831351d1e4ca1ee2e88dd2d4bafa4eb140f2c6891dd2eb
SSDEEP

12288:ZOFxsG29O71cvz3XMR4tTw9l2177oEKE8wEKLq3R5oKzkU5xgKZkgMUe0WSa:USG2UJcvz3JtTw3E8/B5oESKs0WF

Score

10^/10

hawkeye collection credential_access discovery keylogger spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 13 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/2540-53-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2540-50-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2540-44-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2540-42-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2540-48-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/800-77-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/800-79-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/800-80-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/800-86-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2468-88-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2468-91-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2468-90-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2468-99-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 9 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2540-53-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2540-50-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2540-44-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2540-42-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2540-48-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/800-77-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/800-79-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/800-80-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/800-86-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 9 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2540-53-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2540-50-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2540-44-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2540-42-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2540-48-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2468-88-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2468-91-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2468-90-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2468-99-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\tmp4F4F.tmp	acprotect

Loads dropped DLL 2 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exedw20.exe

pid process

3004 ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
1012 dw20.exe

pid	process
3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
1012	dw20.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\tmp4F4F.tmp	upx
behavioral1/memory/3004-66-0x0000000073F00000-0x0000000073F2E000-memory.dmp	upx
behavioral1/memory/3004-72-0x0000000073F00000-0x0000000073F2E000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 whatismyipaddress.com
10 whatismyipaddress.com
11 whatismyipaddress.com

flow	ioc
8	whatismyipaddress.com
10	whatismyipaddress.com
11	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exeef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

description	pid	process	target process
PID 3004 set thread context of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 2540 set thread context of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 set thread context of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exeef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exevbc.exevbc.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\CA\Certificates\92C1588E85AF2201CE7915E8538B492F605B80C6	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\CA\Certificates\92C1588E85AF2201CE7915E8538B492F605B80C6\Blob = 03000000010000001400000092c1588e85af2201ce7915e8538b492f605b80c61400000001000000140000005ac4b97b2a0aa3a5ea7103c060f92df665750e58040000000100000010000000b656376c3d2acebba18849d604361bd50f0000000100000020000000e767799478f64a34b3f53ff3bb9057fe1768f4ab178041b0dcc0ff1e210cba65190000000100000010000000021dfb9b16b1303a97b0bf78cda68e46180000000100000010000000749966cecc95c1874194ca7203f9b6204b0000000100000044000000340032004200390041003400370033004200340044004100460030003100320038003500410033003600420034004400330043003700420031003600360032005f0000002000000001000000340500003082053030820418a00302010202100409181b5fd5bb66755343b56f955008300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3133313032323132303030305a170d3238313032323132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f0603550403132844696769436572742053484132204173737572656420494420436f6465205369676e696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100f8d3b31c7f0e11af677707d30b314919cfd0fb4599b13adb44f57fe5a89ddb32d771ea769d052eb78ffa9243c0a5f989d43719d7b6aaf09c86a5d825ac0e79283a7ee9d167d3c6fb2927c7d37b2394e4912396907782f9a18423661254335074b12826bb2469c2c252f214678a8945d42da1a3e9882c2095ae1c4a8708df0cf5e24d6018beaac4b2ae70316633713eac70a2abce7fe97ccb92a1e53b311ccfeaf20ae457bb4ab5e974e62bfe6ccb7e7439360d90efe4b54ea4a9ea6a0aab84f3ac674eb5c4f78cd1202523eb08643e5296c1f20f12f4c58e0fc1a2e82c51f773bcbd85b1628373418207e4388b6a7320d00f64733c9e9fa633a9fd19df2593d10203010001a38201cd308201c930120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c304f0603551d20044830463038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300a06086086480186fd6c03301d0603551d0e041604145ac4b97b2a0aa3a5ea7103c060f92df665750e58301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010b050003820101003eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exevbc.exeef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

pid process

3004 ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
2468 vbc.exe
2540 ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

pid	process
3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
2468	vbc.exe
2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exeef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
Token: SeDebugPrivilege	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

pid process

2540 ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

pid	process
2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exeef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

description	pid	process	target process
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 2540	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
PID 3004 wrote to memory of 1668	3004	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	sppsvc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 800	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 2468	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	vbc.exe
PID 2540 wrote to memory of 1012	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	dw20.exe
PID 2540 wrote to memory of 1012	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	dw20.exe
PID 2540 wrote to memory of 1012	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	dw20.exe
PID 2540 wrote to memory of 1012	2540	ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe	dw20.exe

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:800
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 448
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab4DD4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E73.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\ef30953cbaaa700a085e3cfe29aaff9e_JaffaCakes118.exe

Filesize
686KB

MD5
ef30953cbaaa700a085e3cfe29aaff9e

SHA1
8d2b2aea2daa5f43426e0b300b57d86bf20cacb3

SHA256
acd94d6b3021ebdd56e395a37644d6765bd0012d4571714d6d418feeb626d000

SHA512
b21b1a654a7bfe8bc0f3b9995822ab9fc60dca431f231ecccb32ceb40bc478bed315301a2c58f78fab831351d1e4ca1ee2e88dd2d4bafa4eb140f2c6891dd2eb

Download Submit
\Users\Admin\AppData\Local\Temp\tmp4F4F.tmp

Filesize
66KB

MD5
aaa698721f488b181bc0f0afc5da126a

SHA1
76536a73f16ffd643ea24f8725cebfff9d49852f

SHA256
e71ba7ce01d10e60a4feac7fc5e04f34756ba621c7d88583d0f96bd3b2655647

SHA512
67d8b05678fbdc1678515c341fa8c1e26f3d1b15f2cc390bb9b1a26589a346fd57697dd3366e72d46ab265570929f1be89b8aec81112a2a98194c5886c89261d

Download Submit
memory/800-79-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/800-77-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/800-80-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/800-86-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1668-55-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2468-90-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2468-88-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2468-91-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2468-99-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2540-42-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-81-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-39-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-41-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-53-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-48-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2540-76-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-50-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-61-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-62-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-44-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2540-83-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-82-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-63-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-87-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/3004-66-0x0000000073F00000-0x0000000073F2E000-memory.dmp

Filesize
184KB

Download
memory/3004-0-0x0000000074931000-0x0000000074932000-memory.dmp

Filesize
4KB

Download
memory/3004-73-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/3004-72-0x0000000073F00000-0x0000000073F2E000-memory.dmp

Filesize
184KB

Download
memory/3004-1-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download
memory/3004-2-0x0000000074930000-0x0000000074EDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads