Malware Analysis Report

2025-01-22 23:10

Sample ID 241129-xbvzps1kcs
Target 2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff
SHA256 2427944ef51d4c628073b5db91d897ef4e42595603784a600e95041afb11582a
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2427944ef51d4c628073b5db91d897ef4e42595603784a600e95041afb11582a

Threat Level: Known bad

The file 2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (219) files with added filename extension

Renames multiple (177) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-29 18:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-29 18:41

Reported

2024-11-29 18:44

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Renames multiple (177) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ToolboxBitmap32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE,5511" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Typelib C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Typelib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Outlook Date Control" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Office.Interop.Outlook, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Interop.Outlook.OlkDateControlClass" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Outlook, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ToolboxBitmap32 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Control C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "9.4" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "Outlook.OlkDateControl" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "Outlook.OlkDateControl.1" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\OUTLOOK.EXE\"" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Outlook.OlkDateControlClass" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe"

Network

N/A

Files

memory/3068-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3068-8-0x0000000002F70000-0x000000000317C000-memory.dmp

memory/3068-1-0x0000000002F70000-0x000000000317C000-memory.dmp

memory/3068-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3068-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3068-13-0x0000000002F70000-0x000000000317C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

MD5 73f3e723d83230f3b96c27ccd2669842
SHA1 8b42dd9b8b9e06431bd1a8d142ede79426d25797
SHA256 f7e3eda43abf9f698284b177813e67ef3fe090e0ee00d36ecde1b947ea5bec2e
SHA512 c9b8a8475098e3eb139d01b199f82763741eaff18d9b7c963e431096708cca2993a89c2c99bdccb4c5d857e9e3dab1426252f184598911a08ecfad7ba87adda9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 ddbb9dc9e9423603da01b99003f819ab
SHA1 2689eb478c5f689e99960e2cc796c887db618ada
SHA256 48a40d0527f216253552dec7b0ab29b9be26aedeef14c2fa9f43b81ccceb6f05
SHA512 606ebab659a5d5adce7f717ff4a56810fa7709790c08280f8db7cb64e7a4197fe0b6e7a220ac4423875f8900f9e3469ef3c08ca8c3bbcedf305bea47836037be

memory/3068-22-0x0000000002F70000-0x000000000317C000-memory.dmp

memory/3068-21-0x0000000002F70000-0x000000000317C000-memory.dmp

memory/3068-31-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3068-35-0x0000000002F70000-0x000000000317C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-29 18:41

Reported

2024-11-29 18:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Renames multiple (219) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\AddPush.ADTS.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\readme.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "ADODB.Error.6.0" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "ADODB.Error" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ADODB.Error" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 82.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1032-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1032-2-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1032-9-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1032-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1032-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1032-14-0x0000000004950000-0x0000000004B5C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 cfeb1bceef8a25efdfe675fd526cda0d
SHA1 88bc1f8d4c82f7a40036c67e3357f49d88255e4a
SHA256 8c61d081bc24642dc914cfd8bf702313637c50c44e05db928892a85eedbb4d33
SHA512 a75eebff6592a3fef96c3bcbbf3072ae12dc3db8630fea15243df1b3119ce2c00c424b0d5e349d8db130fc3a2a66cad3cfb2b1eb1614e6a7c58266fd17265954

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 7385afa35af034cf42a51dd65c606c02
SHA1 0f3b8bbb67096ac0785a897ab3624ec0e8fa80f5
SHA256 d6c5b2e9fa4d87a385477d618c72cfbeb47e265d8a8e131f18f80416485325ac
SHA512 1d5e250d1d40e998994d95b2ea5ea8424f06def8854e2b05b4e24743b786f6fb59a25ad95a0740e65b1ea259b068d77e6b37d9e09448dc1ef75514ce4683403e

memory/1032-24-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1032-25-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1032-44-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1032-50-0x0000000004950000-0x0000000004B5C000-memory.dmp