hawkeye | 072359d782aa0985d459ab4d1082babd289fce5621171ae610637a23790415b3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe
Size

1.1MB
MD5

f6464616fa6ee2ebcea4a17cf2730417
SHA1

7a8dfdde3b459d5c825509016f238a77eb091bb8
SHA256

072359d782aa0985d459ab4d1082babd289fce5621171ae610637a23790415b3
SHA512

1516b48c0087a3687974187db9d8d038ace19d55957721eacb11b480976286b4ba383b1c7e3a97bb2b5ef0de4ef429bd802d5dfd75ba5b4ddba5264365df9fe1
SSDEEP

24576:EQk4tlz3Vby3FtfnVNSperrOUj6k7ZqC30jzyZFdvugct8+SU2OJbmDGEc:EQk4tlz3Vby3FtfnVN+k7ZxYzUF5ugcd

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2656-19-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral2/memory/4996-31-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4996-33-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4996-35-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/2612-40-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/2612-39-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/2612-47-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2656-19-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral2/memory/4996-31-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4996-33-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4996-35-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2656-19-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral2/memory/2612-40-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/2612-39-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/2612-47-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Executes dropped EXE 1 IoCs

pid	Process
3972	FZRHHUMCdKQZONOYCOQAi.cmd

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	whatismyipaddress.com
15	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3972 set thread context of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 2656 set thread context of 4996	2656	RegAsm.exe	86
PID 2656 set thread context of 2612	2656	RegAsm.exe	87

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FZRHHUMCdKQZONOYCOQAi.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2612	vbc.exe
2612	vbc.exe
2656	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	RegAsm.exe
Token: SeRestorePrivilege	4412	dw20.exe
Token: SeBackupPrivilege	4412	dw20.exe
Token: SeBackupPrivilege	4412	dw20.exe
Token: SeBackupPrivilege	4412	dw20.exe
Token: SeBackupPrivilege	4412	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	RegAsm.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3972	2912	f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe	82
PID 2912 wrote to memory of 3972	2912	f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe	82
PID 2912 wrote to memory of 3972	2912	f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe	82
PID 3972 wrote to memory of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 3972 wrote to memory of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 3972 wrote to memory of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 3972 wrote to memory of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 3972 wrote to memory of 2656	3972	FZRHHUMCdKQZONOYCOQAi.cmd	83
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 4996	2656	RegAsm.exe	86
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 2612	2656	RegAsm.exe	87
PID 2656 wrote to memory of 4412	2656	RegAsm.exe	96
PID 2656 wrote to memory of 4412	2656	RegAsm.exe	96
PID 2656 wrote to memory of 4412	2656	RegAsm.exe	96

C:\Users\Admin\AppData\Local\Temp\f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6464616fa6ee2ebcea4a17cf2730417_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FZRHHUMCdKQZONOYCOQAi.cmd
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FZRHHUMCdKQZONOYCOQAi.cmd FZRHHUMCdKQZONOYCOQ
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    - CmdLine Args
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2612
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 1836
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FZRHHUMCdKQZONOYCOQ

Filesize
47KB

MD5
789ae363be6c65d084f97b2412ec2c98

SHA1
9ed860c3ea88181c9e8d66d328e68e0d2977d2bf

SHA256
5e113306675547ef82810b9b40d177d7e616e6a1ba20b48e0ad7ce1ea549f842

SHA512
5cb9c3f96e2e71a12c22f944b1f8fa141a25667f588fa40361f12c4c0df5f1567c5582f903f84a7d8cf8d027c1858b364496c4d993b5643f6e2610d8ff79fa7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FZRHHUMCdKQZONOYCOQAi.cmd

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NZCDiFgbeCEL

Filesize
520KB

MD5
59289a86a33446458601e349b363356f

SHA1
51610223cbd8d5bb03ca6d7625e6c0dc89d8560e

SHA256
3ea37a0c3f796227d3bdd060adac518a3c0762ddd4979227888677c4b7f2628b

SHA512
13bc1b9d7bf8c546baa65b5ff7037eb40e3bf7c27b362e3b402d7a1d54abd2ebd47b6c502c147f3012d4a31da2f754d9b967c528384bbfde5f543abfbae6bfa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
memory/2612-40-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2612-47-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2612-39-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2656-23-0x00000000731F2000-0x00000000731F3000-memory.dmp

Filesize
4KB

Download
memory/2656-28-0x00000000731F0000-0x00000000737A1000-memory.dmp

Filesize
5.7MB

Download
memory/2656-37-0x00000000731F0000-0x00000000737A1000-memory.dmp

Filesize
5.7MB

Download
memory/2656-38-0x00000000731F2000-0x00000000731F3000-memory.dmp

Filesize
4KB

Download
memory/2656-27-0x00000000731F0000-0x00000000737A1000-memory.dmp

Filesize
5.7MB

Download
memory/2656-24-0x00000000731F0000-0x00000000737A1000-memory.dmp

Filesize
5.7MB

Download
memory/2656-19-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2656-54-0x00000000731F0000-0x00000000737A1000-memory.dmp

Filesize
5.7MB

Download
memory/3972-17-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/4996-31-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4996-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4996-35-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4996-34-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download