Malware Analysis Report

2025-01-22 23:11

Sample ID 241203-vl7p5svkaw
Target 2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff
SHA256 fd4321374a63a1c7e3b38de206126fe029312da2c22e758a688c5dc1f6f6cf8d
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fd4321374a63a1c7e3b38de206126fe029312da2c22e758a688c5dc1f6f6cf8d

Threat Level: Known bad

The file 2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (176) files with added filename extension

Renames multiple (219) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-03 17:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-03 17:05

Reported

2024-12-03 17:08

Platform

win7-20240903-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Renames multiple (176) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%CommonProgramFiles(x86)%\\System\\wab32.dll" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "CLSID_ContactUserAccountChangeCallback" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe

"C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe"

Network

N/A

Files

memory/2724-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2724-1-0x0000000003000000-0x000000000320C000-memory.dmp

memory/2724-8-0x0000000003000000-0x000000000320C000-memory.dmp

memory/2724-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2724-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2724-13-0x0000000003000000-0x000000000320C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 293029dc3afc1fa71634706c5ba5ce09
SHA1 da780347b32a4d94e8b0013bfbc226eba0c0d86a
SHA256 a20e887a189e7cb743060187a81c480de34840f47672fe0bd8c868a7a3892c8d
SHA512 de4c01394b07f6967498ef80f0ee0d05b263e02361661ddba741cb7a07d172f19e0ac1c6e881f89ca1e4a5720969800ed6c80bbfff1ab6f0a4913f925215fe65

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 0461999e7f151f0a46dfbb66854712e1
SHA1 835efdcc0972cfab7704facb3ee7d765012f5a75
SHA256 a838ad2a80344d0e29642ca387ff507731c3867a8bbaf4318401290ba5ab51f9
SHA512 fa3f36c33b11b0b6f832d2917552d67139dc636ebef8febd0da64ec60012d23da2c2961bfd14e8203adbd78ed62f363912e854a335ce0290c0c1d28e3153591d

memory/2724-21-0x0000000003000000-0x000000000320C000-memory.dmp

memory/2724-22-0x0000000003000000-0x000000000320C000-memory.dmp

memory/2724-29-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2724-33-0x0000000003000000-0x000000000320C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-03 17:05

Reported

2024-12-03 17:08

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Renames multiple (219) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "New Shortcut Wizard Modal" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\appwiz.cpl" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe

"C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.208.201.84.in-addr.arpa udp

Files

memory/4852-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4852-2-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/4852-9-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/4852-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4852-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4852-14-0x0000000004970000-0x0000000004B7C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 6560e3407e40fe1e4f4b1e07beae583d
SHA1 ed67a4e410b8ee0473f6b10c2e101c15b2002b74
SHA256 d97a9e4271265e653097ac7a6dbe1c97e35136a073b404f895858b33ececc752
SHA512 b5732c820754c9fc3b05a47a616bfd2336d741e1e7ff34fb313ab8b6649028ea1e9a9fa14b69a52bf9384175f48939b3b650a6b90e9989ea13a817dc1b1f5dbf

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 5a638e7a934b03558de3e6dee0cb74ed
SHA1 3c9b4c8aa276a3155c566a61df6cca4202bd8f16
SHA256 02cc9fd724bd7c6cbd0f7a3920ec2414aa16a06a161bf1f176c1b5747e532ae8
SHA512 b042443e100172843dfbc2b4b8b366b2b1d808c82304bda2b4c4d1a19b8a4ed12f660318c236841652aaaf9f98429f9b05dfba896861b8cee078ef43c07f74d0

memory/4852-23-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/4852-22-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/4852-42-0x0000000000400000-0x0000000000616000-memory.dmp

memory/4852-48-0x0000000004970000-0x0000000004B7C000-memory.dmp