hawkeye | 065d9b1dd188b626515ce09b19cd24d7e16a160ac5319136e65aa3c561657426

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe
Size

356KB
MD5

d958277b511acf4f8dae3d75c594db6c
SHA1

b9a2113f62e2f559d51d70a35c77dff7e39294ed
SHA256

065d9b1dd188b626515ce09b19cd24d7e16a160ac5319136e65aa3c561657426
SHA512

21f5bfd2e04283a8d32f79cb10c823a66ebebc9d7ca9fc9a14d8fc3e4b31de1d0232141336c5816b098598f0ec2f4f2db5cbe44e4ebfffc792f01f55c96c4441
SSDEEP

6144:0tkXQh+fOZTb4rVfYn33rVRRF5GPXpkHg0Sme9k4GgzsdHXTvLRUQSOObAIAWgcu:8VxQap5KDox3lWnk

Score

10^/10

hawkeye credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
rudas199300

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	audiodgi.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	audiodgi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1356	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	wmpmetwk.exe
File opened for modification	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	wmpmetwk.exe

Executes dropped EXE 7 IoCs

pid	Process
1356	svchost.exe
460	svchost.exe
824	audiodgi.exe
4156	Windows Update.exe
624	Windows Update.exe
3276	wmpmetwk.exe
2392	wmpmetwk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\audiodgi.exe"	audiodgi.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 460	1356	svchost.exe	86
PID 4156 set thread context of 624	4156	Windows Update.exe	89
PID 3276 set thread context of 2392	3276	wmpmetwk.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4788	624	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiodgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpmetwk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1356	svchost.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
4156	Windows Update.exe
824	audiodgi.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
2392	wmpmetwk.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe
4156	Windows Update.exe
1356	svchost.exe
824	audiodgi.exe
3276	wmpmetwk.exe
824	audiodgi.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe
Token: SeDebugPrivilege	1356	svchost.exe
Token: SeDebugPrivilege	824	audiodgi.exe
Token: SeDebugPrivilege	4156	Windows Update.exe
Token: SeDebugPrivilege	3276	wmpmetwk.exe
Token: SeDebugPrivilege	2392	wmpmetwk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	wmpmetwk.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1356	3024	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe	85
PID 3024 wrote to memory of 1356	3024	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe	85
PID 3024 wrote to memory of 1356	3024	d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe	85
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 460	1356	svchost.exe	86
PID 1356 wrote to memory of 824	1356	svchost.exe	87
PID 1356 wrote to memory of 824	1356	svchost.exe	87
PID 1356 wrote to memory of 824	1356	svchost.exe	87
PID 460 wrote to memory of 4156	460	svchost.exe	88
PID 460 wrote to memory of 4156	460	svchost.exe	88
PID 460 wrote to memory of 4156	460	svchost.exe	88
PID 4156 wrote to memory of 624	4156	Windows Update.exe	89
PID 4156 wrote to memory of 624	4156	Windows Update.exe	89
PID 4156 wrote to memory of 624	4156	Windows Update.exe	89
PID 4156 wrote to memory of 624	4156	Windows Update.exe	89
PID 824 wrote to memory of 3276	824	audiodgi.exe	94
PID 824 wrote to memory of 3276	824	audiodgi.exe	94
PID 824 wrote to memory of 3276	824	audiodgi.exe	94
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95
PID 3276 wrote to memory of 2392	3276	wmpmetwk.exe	95

C:\Users\Admin\AppData\Local\Temp\d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d958277b511acf4f8dae3d75c594db6c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        5⤵
        Executes dropped EXE
        
        PID:624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 80
        6⤵
        Program crash
        
        PID:4788
- - C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe
    "C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe"
    3⤵
    - Adds policy Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
      "C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\wmpmetwk.exe
        5⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
87B

MD5
909440ee37365c16bce21f93c287657c

SHA1
ec9f4e0f22fb0a59eb25184710d88453c2625811

SHA256
ec114016c3e8076661039cd4961b741206101a705f26ff385cb881e80e500b68

SHA512
f1432029fb627695c48cd3c1ea037be39b153d31cdfa9efc37e86a3e28ae88693bc5bdb11bb11e75569c5071a1de13256b90b95b49459cb2b755df4bc4664784

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
45B

MD5
a6b2cbc038274921154dcbf64cc076cb

SHA1
240e674d5ecc80a2c671ca1a3edac03dba302eeb

SHA256
428fd3690080062b26a970f5adec10b6da06cefabd8d42b21ab736f874ace2db

SHA512
7c1cb2fb48a99e923484eed5ffd8ddcca06f395bc61b071d3c98d44e349a2e374fe94ed98c8e70a30967d7e1eda1c84fc9749067f0598e47af778a6707870043

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
52B

MD5
859068e6bb10eef680e57e092e94f7e3

SHA1
0348fea984e0a737b08e53f32bf9a61fe9bc8ab2

SHA256
172a84a1a1efe32b4c2d1e7e1525a0fa7c4c66b230a7019b9e9ff0df241b433b

SHA512
9ea648ff21b2605ca46112501d3741730d63e3237a58f7e40d959197688d4d62211d966fd99057f95aaad0f8158b6ff39773e93deeb8df5ea716bee89c7659bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
56B

MD5
3ef045d517db664d7f64d66b65eb2ef4

SHA1
1e54c90ab24a161c307ca74e7bfbab23ca4795a2

SHA256
9ae5ccde3335d02f3b0a5795652cb7e706121f9a8bc1a721e2d6ffb1847a5a7b

SHA512
ec6b0f85cda02de19eff6094506c093395f6d45e521b2a3985f348ac71414c51b42464723dc7ab95e95c7e8f17fc4199435614cedfeca22630c23868d2377990

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\audiodgi.exe

Filesize
7KB

MD5
d9f8d8a30db8fb5daebe3d30f7fb8409

SHA1
11920679d52db7c304a9d7687ab5ee41c3cae8d4

SHA256
2ac171ff0ad23ad0b2e2766383e3569e7b5f6ced05abfcdff344986f1ad6df4f

SHA512
c4e0ac2a4a37199ed4d61e3ce0e2dd7d91542f2c3b490d0c8fe4ae1c9cda174348b463aa63bd704a47938853ebb429dfcca07fb3cffc430449dcb5474e96be81

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
356KB

MD5
d958277b511acf4f8dae3d75c594db6c

SHA1
b9a2113f62e2f559d51d70a35c77dff7e39294ed

SHA256
065d9b1dd188b626515ce09b19cd24d7e16a160ac5319136e65aa3c561657426

SHA512
21f5bfd2e04283a8d32f79cb10c823a66ebebc9d7ca9fc9a14d8fc3e4b31de1d0232141336c5816b098598f0ec2f4f2db5cbe44e4ebfffc792f01f55c96c4441

Download Submit
memory/460-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/460-24-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/460-25-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/460-37-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1356-20-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/1356-50-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3024-0-0x0000000074B12000-0x0000000074B13000-memory.dmp

Filesize
4KB

Download
memory/3024-17-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3024-2-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download
memory/3024-1-0x0000000074B10000-0x00000000750C1000-memory.dmp

Filesize
5.7MB

Download