hawkeye_reborn | a3bfdd98f65f02ba196383e6fae84207354b0d77caa8eeebe7297ee616be078e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe
Size

913KB
MD5

df0b5abf528e0925d0cf90ccc159c567
SHA1

dd7f4db19020579e4a9b762d3f882b173c8cf402
SHA256

a3bfdd98f65f02ba196383e6fae84207354b0d77caa8eeebe7297ee616be078e
SHA512

689a068ef47b5fff11a9a1ae0fedec6983a88bec6469ad26626a01f358d534f59d288aebc0b727f1ba556598ccb550b81c9c6c731f0968c9564275c69d18773e
SSDEEP

12288:s4CkZcRCL0jfWsMIQyrFd44UxWf31zvAD/Fnm1sKQiXv1GLx+DYUvW8sRLK:sxM0jfGyb4lAfl7mmjQNwDY4S

Score

10^/10

hawkeye_reborn m00nd3v_logger collection discovery infostealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Hawkeye_reborn family
hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
M00nd3v_logger family
m00nd3v_logger

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/5096-26-0x0000000004BB0000-0x0000000004C26000-memory.dmp	Nirsoft
behavioral2/memory/4848-29-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4848-30-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4848-36-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4408-38-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4408-39-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/4408-41-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/5096-24-0x0000000000700000-0x0000000000790000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5096-26-0x0000000004BB0000-0x0000000004C26000-memory.dmp	MailPassView
behavioral2/memory/4408-38-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4408-39-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/4408-41-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5096-26-0x0000000004BB0000-0x0000000004C26000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-29-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-30-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-36-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
64	app.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Local\\app.exe -boot"	app.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 64 set thread context of 5096	64	app.exe	96
PID 5096 set thread context of 4848	5096	RegAsm.exe	98
PID 5096 set thread context of 4408	5096	RegAsm.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe
4848	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe
Token: SeDebugPrivilege	64	app.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 712	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	89
PID 3100 wrote to memory of 712	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	89
PID 3100 wrote to memory of 712	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	89
PID 3100 wrote to memory of 1196	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	93
PID 3100 wrote to memory of 1196	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	93
PID 3100 wrote to memory of 1196	3100	df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe	93
PID 1196 wrote to memory of 64	1196	cmd.exe	95
PID 1196 wrote to memory of 64	1196	cmd.exe	95
PID 1196 wrote to memory of 64	1196	cmd.exe	95
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 64 wrote to memory of 5096	64	app.exe	96
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4848	5096	RegAsm.exe	98
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99
PID 5096 wrote to memory of 4408	5096	RegAsm.exe	99

C:\Users\Admin\AppData\Local\Temp\df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\df0b5abf528e0925d0cf90ccc159c567_JaffaCakes118.exe" "C:\Users\Admin\AppData\Local\app.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\app.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\app.exe
    "C:\Users\Admin\AppData\Local\app.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp3E09.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4848
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp4211.tmp"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E09.tmp

Filesize
4KB

MD5
bc25ccf39db8626dc249529bcc8c5639

SHA1
3e9cbdb20a0970a3c13719a2f289d210cdcc9e1d

SHA256
b333f8c736c701bc826886f395d928731850cbce6db77be752b3cf7979114904

SHA512
9a546127bddc1d187e674cda82e6c5046cac7f3e6f9515aed68d5bff2264b9d679d857dd97270e10826cd11ce2d92d82dd7f9801e19027e346b60bcc814cca1a

Download Submit
C:\Users\Admin\AppData\Local\app.exe

Filesize
913KB

MD5
df0b5abf528e0925d0cf90ccc159c567

SHA1
dd7f4db19020579e4a9b762d3f882b173c8cf402

SHA256
a3bfdd98f65f02ba196383e6fae84207354b0d77caa8eeebe7297ee616be078e

SHA512
689a068ef47b5fff11a9a1ae0fedec6983a88bec6469ad26626a01f358d534f59d288aebc0b727f1ba556598ccb550b81c9c6c731f0968c9564275c69d18773e

Download Submit
memory/64-25-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/64-21-0x0000000009920000-0x00000000099BC000-memory.dmp

Filesize
624KB

Download
memory/64-20-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/64-19-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/64-18-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/64-17-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3100-7-0x0000000003310000-0x000000000331A000-memory.dmp

Filesize
40KB

Download
memory/3100-4-0x00000000085D0000-0x0000000008B74000-memory.dmp

Filesize
5.6MB

Download
memory/3100-13-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3100-8-0x00000000750CE000-0x00000000750CF000-memory.dmp

Filesize
4KB

Download
memory/3100-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

Filesize
4KB

Download
memory/3100-6-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3100-5-0x0000000008060000-0x000000000807E000-memory.dmp

Filesize
120KB

Download
memory/3100-9-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3100-3-0x0000000005BB0000-0x0000000005C90000-memory.dmp

Filesize
896KB

Download
memory/3100-1-0x0000000000F80000-0x000000000106E000-memory.dmp

Filesize
952KB

Download
memory/3100-2-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Filesize
584KB

Download
memory/4408-39-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4408-38-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4408-41-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4848-36-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4848-35-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/4848-30-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4848-29-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5096-27-0x0000000004DF0000-0x0000000004E56000-memory.dmp

Filesize
408KB

Download
memory/5096-26-0x0000000004BB0000-0x0000000004C26000-memory.dmp

Filesize
472KB

Download
memory/5096-24-0x0000000000700000-0x0000000000790000-memory.dmp

Filesize
576KB

Download