hawkeye | f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2025, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Size

413KB
MD5

2be18c63f8cf951237c2474c2084db28
SHA1

334f29b3d4fdc4b87c186faa0445e23517a1bbe3
SHA256

f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a
SHA512

1c042e4717b187a5914059132ce7bd4e620a6ee184a6ba39411bbd693f7d9dd11685751a2c62d1cae25b116674d43e0e5b27f1521ecf354cf6513c19c075b120
SSDEEP

12288:EOQmUOtktob2K5eO/dhQXGAdEMoUUec4nHrZr:amUOtkSa4ecQNdEMx

Score

10^/10

hawkeye discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	lsam.exe

Deletes itself 1 IoCs

pid	Process
4112	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\lsam.exe"	lsam.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4112 set thread context of 3664	4112	explorer.exe	90
PID 3316 set thread context of 4824	3316	spolsv.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe
3948	lsam.exe
3316	spolsv.exe
4112	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
Token: SeDebugPrivilege	4112	explorer.exe
Token: SeDebugPrivilege	3948	lsam.exe
Token: SeDebugPrivilege	3316	spolsv.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4112	2044	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	89
PID 2044 wrote to memory of 4112	2044	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	89
PID 2044 wrote to memory of 4112	2044	JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe	89
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3664	4112	explorer.exe	90
PID 4112 wrote to memory of 3948	4112	explorer.exe	91
PID 4112 wrote to memory of 3948	4112	explorer.exe	91
PID 4112 wrote to memory of 3948	4112	explorer.exe	91
PID 3948 wrote to memory of 3316	3948	lsam.exe	92
PID 3948 wrote to memory of 3316	3948	lsam.exe	92
PID 3948 wrote to memory of 3316	3948	lsam.exe	92
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93
PID 3316 wrote to memory of 4824	3316	spolsv.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2be18c63f8cf951237c2474c2084db28.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\System\lsam.exe
    "C:\Users\Admin\AppData\Local\Temp\System\lsam.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe
      "C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        
        PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
5212ba787b052ee91338ab9a8cc8f174

SHA1
9a2c721f0bd0e42619ffd323ffb76e375cf5e06d

SHA256
4d9dedd7fbbacc4d314f6cd803f718720d505c904ad23642d12fc6d208ea51aa

SHA512
150bae73c2f3b3da080b712f74dca53da2f669362026d86b7c2eca662c34be396402890b0f5e8a414695c28f4ed1e8b5d8fa0b6b47e3358740e123df1e6e71df

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\lsam.exe

Filesize
25KB

MD5
39b9e0ce01f0a0b715241051b26f765b

SHA1
e64bef34105060532a57ad4d1bc0a91e0f1413d1

SHA256
8a1774770a9d2d651e01c38cff95cbe2014cf0fa09fc7c8d69bd96b9e2e443a4

SHA512
3c79f33e9ac36d6911320929ea591387ba532ad872667bc2d76551cc5260772d8e7db6528ac11fbfa013c3cd8c3c1506c3cb35402122ebbcbd34a2ee726261e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
413KB

MD5
2be18c63f8cf951237c2474c2084db28

SHA1
334f29b3d4fdc4b87c186faa0445e23517a1bbe3

SHA256
f2b01932430280b7069c7ceaf5d1307acacea3694f78f87a83762ef7c30b1b6a

SHA512
1c042e4717b187a5914059132ce7bd4e620a6ee184a6ba39411bbd693f7d9dd11685751a2c62d1cae25b116674d43e0e5b27f1521ecf354cf6513c19c075b120

Download Submit
memory/2044-1-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2044-2-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2044-13-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/2044-0-0x0000000074E22000-0x0000000074E23000-memory.dmp

Filesize
4KB

Download
memory/3664-21-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3664-22-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3664-23-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3664-24-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3948-35-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/3948-44-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4112-15-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4112-14-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4112-42-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download
memory/4112-43-0x0000000074E20000-0x00000000753D1000-memory.dmp

Filesize
5.7MB

Download