hawkeye | f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Size

413KB
MD5

2be18c63f8cf951237c2474c2084db28
SHA1

334f29b3d4fdc4b87c186faa0445e23517a1bbe3
SHA256

f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a
SHA512

1c042e4717b187a5914059132ce7bd4e620a6ee184a6ba39411bbd693f7d9dd11685751a2c62d1cae25b116674d43e0e5b27f1521ecf354cf6513c19c075b120
SSDEEP

12288:EOQmUOtktob2K5eO/dhQXGAdEMoUUec4nHrZr:amUOtkSa4ecQNdEMx

Score

10^/10

hawkeye discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Deletes itself 1 IoCs

pid	Process
1780	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe

Loads dropped DLL 6 IoCs

pid	Process
2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
1780	explorer.exe
1780	explorer.exe
2652	lsam.exe
2652	lsam.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\lsam.exe"	lsam.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 3032	1780	explorer.exe	31
PID 2720 set thread context of 2988	2720	spolsv.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe
2652	lsam.exe
2720	spolsv.exe
1780	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Token: SeDebugPrivilege	1780	explorer.exe
Token: SeDebugPrivilege	2652	lsam.exe
Token: SeDebugPrivilege	2720	spolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1780	2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	30
PID 2464 wrote to memory of 1780	2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	30
PID 2464 wrote to memory of 1780	2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	30
PID 2464 wrote to memory of 1780	2464	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	30
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 3032	1780	explorer.exe	31
PID 1780 wrote to memory of 2652	1780	explorer.exe	32
PID 1780 wrote to memory of 2652	1780	explorer.exe	32
PID 1780 wrote to memory of 2652	1780	explorer.exe	32
PID 1780 wrote to memory of 2652	1780	explorer.exe	32
PID 2652 wrote to memory of 2720	2652	lsam.exe	33
PID 2652 wrote to memory of 2720	2652	lsam.exe	33
PID 2652 wrote to memory of 2720	2652	lsam.exe	33
PID 2652 wrote to memory of 2720	2652	lsam.exe	33
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34
PID 2720 wrote to memory of 2988	2720	spolsv.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\System\lsam.exe
    "C:\Users\Admin\AppData\Local\Temp\System\lsam.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe
      "C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
5212ba787b052ee91338ab9a8cc8f174

SHA1
9a2c721f0bd0e42619ffd323ffb76e375cf5e06d

SHA256
4d9dedd7fbbacc4d314f6cd803f718720d505c904ad23642d12fc6d208ea51aa

SHA512
150bae73c2f3b3da080b712f74dca53da2f669362026d86b7c2eca662c34be396402890b0f5e8a414695c28f4ed1e8b5d8fa0b6b47e3358740e123df1e6e71df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
413KB

MD5
2be18c63f8cf951237c2474c2084db28

SHA1
334f29b3d4fdc4b87c186faa0445e23517a1bbe3

SHA256
f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a

SHA512
1c042e4717b187a5914059132ce7bd4e620a6ee184a6ba39411bbd693f7d9dd11685751a2c62d1cae25b116674d43e0e5b27f1521ecf354cf6513c19c075b120

Download Submit
\Users\Admin\AppData\Local\Temp\System\lsam.exe

Filesize
25KB

MD5
39b9e0ce01f0a0b715241051b26f765b

SHA1
e64bef34105060532a57ad4d1bc0a91e0f1413d1

SHA256
8a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4

SHA512
3c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4

Download Submit
memory/1780-16-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-15-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-69-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2464-0-0x0000000074331000-0x0000000074332000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2464-2-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2464-14-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/3032-40-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3032-38-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-36-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-34-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-33-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-32-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-39-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-29-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-28-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-27-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-26-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-22-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-24-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-70-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download