Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 20:29
General
-
Target
JaffaCakes118_10da92002327ad6a43757698a6e56197.exe
-
Size
524KB
-
MD5
10da92002327ad6a43757698a6e56197
-
SHA1
526d543999ff9672be8db91933a0f0947cd0c628
-
SHA256
20a7268f2f15cad9e938de16f11beabef087f42aa09ea94682dbde710ada5403
-
SHA512
370a70d6e475e4b0709ecfc0c8ec729dca66b904b5c285b56b952f29bd407ce958eb51076cc36f5b05d3d402523f0a71e965b6fa6c3b92d4e758349269f3af1c
-
SSDEEP
12288:xR7zxL/PSUS2Mtdxz2XFB/bjbZi3S5EKLSsnuIgejNSQ1S:vzxLnS7LiXt5EKLSsnJgeJSQ1
Score
10/10
Malware Config
Signatures
-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Hawkeye family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_10da92002327ad6a43757698a6e56197.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_10da92002327ad6a43757698a6e56197.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 15522⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
512KB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB