hawkeye | f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe
Size

33KB
MD5

6a6f179c2d41154e56a19a64ffd9822f
SHA1

49ff007eab77c59f86b38c8e588331090c2679cc
SHA256

f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768
SHA512

a807892a65681126dbcca94e8a13aa486f6402d5a96afda2197abb7427124f9f691cf8009b3afc9c01c445b65b033e21e021acc0706d40b0dfa92f65dd5cf16d
SSDEEP

384:ZHLu2x1/pk4yXGjgbUTOg1ni1Ujd3Jwb8mnatAEwXOsbTedtLT9npzl+1PKqn5EV:ZrucFvyXGol1Ywans6fpMCO9uf/d

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid process

2592 WindowsUpdate.exe

pid	process
2592	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WindowsUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WindowsUpdate.exe

description pid process

Token: SeDebugPrivilege 2592 WindowsUpdate.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WindowsUpdate.exe

pid process

2592 WindowsUpdate.exe

description	pid	process
Token: SeDebugPrivilege	2592	WindowsUpdate.exe

pid	process
2592	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe

description	pid	process	target process
PID 2236 wrote to memory of 2592	2236	6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe	WindowsUpdate.exe
PID 2236 wrote to memory of 2592	2236	6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe	WindowsUpdate.exe
PID 2236 wrote to memory of 2592	2236	6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a6f179c2d41154e56a19a64ffd9822f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe

Filesize
33KB

MD5
6a6f179c2d41154e56a19a64ffd9822f

SHA1
49ff007eab77c59f86b38c8e588331090c2679cc

SHA256
f46fec123ab76ac40f4f9dc0c6f89e19d2800dcc399bbc3c2d8906492bbf5768

SHA512
a807892a65681126dbcca94e8a13aa486f6402d5a96afda2197abb7427124f9f691cf8009b3afc9c01c445b65b033e21e021acc0706d40b0dfa92f65dd5cf16d

Download Submit
memory/2236-10-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2236-9-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2236-2-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2236-0-0x000007FEF67BE000-0x000007FEF67BF000-memory.dmp

Filesize
4KB

Download
memory/2592-13-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2592-12-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2592-11-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2592-14-0x000007FEF6500000-0x000007FEF6E9D000-memory.dmp

Filesize
9.6MB

Download