Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 05:51
Static task
static1
Behavioral task
behavioral1
Sample
4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe
-
Size
577KB
-
MD5
4625e41f7ccbd1ab169d665121034752
-
SHA1
06a854a453a6bb5d64df476044140d1428fd35f9
-
SHA256
ff573280232ed2fb078b7ac91b816d2d847e6955f321a9afc8ad4e0cc6bd7793
-
SHA512
9556bf88284b9fa6fd00ec168303fec197a9ff2ff1981cd008f2f0ea7e70f13ee9f61959e82fd5a428753b3f6affa9de0b98df9bc93f428d1f55836c2574bbaf
-
SSDEEP
12288:IAhIUe6GgzZ9mlpJHMaxqh1w4KiHWq/79mgPADXApwGq:IAhIHPoZ9EJsaxaRHvHlwGq
Malware Config
Extracted
hawkeye_reborn
- fields
- name
Signatures
-
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral1/memory/288-18-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/288-16-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/288-27-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/288-25-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger behavioral1/memory/288-22-0x0000000000400000-0x0000000000490000-memory.dmp m00nd3v_logger -
Executes dropped EXE 1 IoCs
pid Process 288 svhost.exe -
Loads dropped DLL 2 IoCs
pid Process 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 bot.whatismyipaddress.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2232 set thread context of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\hmmm\hmmm.exe:Zone.Identifier cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\hmmm\hmmm.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2364 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2364 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2364 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2364 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2956 2364 cmd.exe 33 PID 2364 wrote to memory of 2956 2364 cmd.exe 33 PID 2364 wrote to memory of 2956 2364 cmd.exe 33 PID 2364 wrote to memory of 2956 2364 cmd.exe 33 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34 PID 2232 wrote to memory of 288 2232 4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4625e41f7ccbd1ab169d665121034752_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\hmmm\hmmm.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
PID:2956
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577KB
MD54625e41f7ccbd1ab169d665121034752
SHA106a854a453a6bb5d64df476044140d1428fd35f9
SHA256ff573280232ed2fb078b7ac91b816d2d847e6955f321a9afc8ad4e0cc6bd7793
SHA5129556bf88284b9fa6fd00ec168303fec197a9ff2ff1981cd008f2f0ea7e70f13ee9f61959e82fd5a428753b3f6affa9de0b98df9bc93f428d1f55836c2574bbaf
-
Filesize
85KB
MD52e5f1cf69f92392f8829fc9c9263ae9b
SHA197b9ca766bbbdaa8c9ec960dc41b598f7fad82a5
SHA25651985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b
SHA512f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883