hawkeye_reborn | 92d894bb1ccc3042b151e0882c27497c10090c0b566f1aa3dc2d82a62bd50d6b

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
Size

542KB
MD5

73a584c692116a954ff93fca2e1723f9
SHA1

21821db40ccb5ec4190d663d5917389e22eebcd5
SHA256

92d894bb1ccc3042b151e0882c27497c10090c0b566f1aa3dc2d82a62bd50d6b
SHA512

7acd1bb5cceda276cd4e963b82c050ed186c2d73a83f1c8b6934c8dfa9015b8200bf60a25387aa263e0ee289c19dcc5d72e4091910d60d072845900dbc2bd9b9
SSDEEP

12288:CujfhwNvn9iMa3ATlNyPgwetYN1bKS71JZ9ijWT3nNYBe:zfhwbc3QuILtq11NMWaB

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.thecencoa.com
Port:
587
Username:
[email protected]
Password:
1FE],nt0RnrJFV]q@p

Mutex

a12e46b2-f8d6-47ef-af16-63f83baf31b8

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:1FE],nt0RnrJFV]q@p _EmailPort:587 _EmailSSL:true _EmailServer:mail.thecencoa.com _EmailUsername:[email protected] _ExecutionDelay:20 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:20 _MeltFile:false _Mutex:a12e46b2-f8d6-47ef-af16-63f83baf31b8 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\s2U0fZEg93uhf3Z1\\LJkbedFW7gfG.exe\",explorer.exe"	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 bot.whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

description pid process target process

PID 2932 set thread context of 2968 2932 73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe 73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

pid process

2932 73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2932 73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
Token: SeDebugPrivilege 2932 73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

flow	ioc
4	bot.whatismyipaddress.com

description	pid	process	target process
PID 2932 set thread context of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

pid	process
2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
Token: SeDebugPrivilege	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

description	pid	process	target process
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
PID 2932 wrote to memory of 2968	2932	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe	73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73a584c692116a954ff93fca2e1723f9_JaffaCakes118.exe"
2⤵
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x0000000074611000-0x0000000074612000-memory.dmp

Filesize
4KB

Download
memory/2932-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2932-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2932-21-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2968-13-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-15-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-17-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2968-10-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-9-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-7-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-18-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2968-20-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2968-6-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2968-23-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download