hawkeye | a053832628bd2226d75f6d4b5f99e9f7d75b3ed11f87b1562a9abff296b56299

General

Target
15102026_2344_09012026_Windows Defander Install-Windows Defander Install.lnk.zip
Size 3KB
Sample261015-3rmk6aex9k
SHA256 a053832628bd2226d75f6d4b5f99e9f7d75b3ed11f87b1562a9abff296b56299
MD5 fc804bbc0211b49e3816331683375f9e
SHA1 bbeb41cf358dfe69c496cfaee1ea4959a09c2c07
SHA512 f5f17e2db2212bd71c275535b1f02a88a457543d5dfd18e2c0c365a21d76325555ae889c9e14df1878c3622f80c6a0f28d07d4e97699a398f4b283a38db404c7
TLSH
T12E71FB18BF65E8BBC73B6679779FF91BC608D1068902D20B64CF1800DC89742B92A793
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  Windows Defander Install/Windows Defander Install.lnk
- Size 2KB
- SHA256 6d197100d92fb741aa58e553aff5df807eceabd7b0e5c68897e302028004d42b
- MD5 47fa84cc4c750a553cbf416b1207d3d7
- SHA1 e87c786fd21e7bcaed7ec0a7f20b8066bd708368
- SHA512 9ca5ec9c06f129dbeea2932dcbfae6206781ca089cac470896ac0c0ca920d140470c0b90738ef78ec5e917256c2b176b07a8fdc4c28193f2df73a717161750d2
- TLSH
  T1D0419B6376E17B2DE6370BFAAAF162C28728BDB17C15D94C4150C14E3C32B24D831326
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution hawkeye keylogger persistence privilege_escalation spyware stealer trojan
- Family: HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Windows Defander Install/_appdata_/appdata.bat
- Size 2KB
- SHA256 40f02ed04ad49cb207d3dadf71a677cef625687fea135058ac8c2dc368652d45
- MD5 bcf7c54f526364e45323b30d7a372d81
- SHA1 e6209c993f69d79c2f119ea46abb384ea29be1c8
- SHA512 01b1399eb1f093862d4ead67fc203fa413af829e02997bac784c5ab8dbea13b2f73e626ec15ff799baa80405fa53cf777746d8b3f27c857041482dcdb5b35fe6
- TLSH
  T16151614B21A41C2A8EE267B6EEBE5301F7C59303ED043BC2B2E80522F912E55D3674C6
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution hawkeye keylogger persistence privilege_escalation spyware stealer trojan
- Family: HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4