MalwareExploits 2 CVEs

HAWKBALL

HAWKBALL is a Windows backdoor associated with targeted intrusion activity. It has been delivered through malicious Microsoft Office documents that exploit Equation Editor vulnerabilities including CVE-2017-11882 and CVE-2018-0802, using an OLE object to drop embedded shellcode. Once executed, it performs host reconnaissance by collecting the current username and gathering disk and other system information. It uses Windows API calls for process creation and anti-analysis checks, including debugger detection. HAWKBALL supports remote command execution, including creation of a cmd.exe-based reverse shell, execution of attacker-supplied commands, and return of command output. It also supports file deletion and can exfiltrate system information and files over its command-and-control channel. Its observed functionality is consistent with a compact espionage-oriented backdoor used for post-compromise control, collection, and operator tasking on Windows hosts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2017-11882Microsoft Equation Editor Stack Buffer Overflow RCEExploited in the wild

...has exploited Office vulnerabilities such as CVE-2017-11882...

via mitre attackattack.mitre.org

CVE-2018-0802Remote Code Execution in Microsoft Office Equation EditorExploited in the wild

...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059.003Windows Command ShellEvidence4

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

T1203Exploitation for Client ExecutionEvidence3

"...leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website." / "...has exploited client software vulnerabilities for execution..." / "...has used multiple software exploits for common client software...to gain code execution."

T1559.002Dynamic Data ExchangeEvidence1

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence1

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1622Debugger EvasionEvidence2

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence5

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1082System Information DiscoveryEvidence11

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.

T1622Debugger EvasionEvidence2

Collection

1 technique

T1560.003Archive via Custom MethodEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1219Remote Access ToolsEvidence1

4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

ADVSTORESHELL exfiltrates data over the same channel used for C2.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that can collect the system username.

mitre attack websiteNews

Oct 21, 2021

Exfiltration Over C2 Channel, Technique T1041 - Enterprise | MITRE ATT&CK®

Malware that exfiltrates system information and files over its C2 channel.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses Windows APIs for process creation, disk reconnaissance, and anti-debugging.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Collects the system username.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

HAWKBALL