hawkeye_reborn | 212863825347d7ca40ece1790be931dbb9f511f81696ea498d92c550929a476f

General

Target

ktrazuaohhbo7kc.msi
Size

1.0MB
MD5

516b891e8e0dd965e27d87552070deaf
SHA1

45d53c2fe685c953cf1a18e4fb9b96ab0d480682
SHA256

74f05574ba23c3e43d28a4d1adec713cfada1bdd01648bcbd16418a87ad91a37
SHA512

4a7f16a5032acc6df9e241b53c1c43798dff0b04f1e5eb8d4fb78d57ccf6916d108c903b0e9634555c1dc6cec8b947d64b27d98c28b225ae81847474037418a9

Score

10^/10

hawkeye_reborn m00nd3v_logger evasion infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.patrogabon.com
Port:
587
Username:
[email protected]
Password:
PyAF1VMa~s5;

Mutex

fde0218e-5e9c-462f-b529-a61f688a2e66

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:PyAF1VMa~s5; _EmailPort:587 _EmailSSL:true _EmailServer:mail.patrogabon.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:fde0218e-5e9c-462f-b529-a61f688a2e66 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

MSI8578.tmp

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions MSI8578.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	MSI8578.tmp

M00nD3v Logger Payload 6 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1932-68-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1932-69-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1932-70-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1932-71-0x000000000048B2FE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1932-73-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1932-75-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Executes dropped EXE 1 IoCs

Processes:

MSI8578.tmp

pid process

1700 MSI8578.tmp
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

MSI8578.tmp

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools MSI8578.tmp

pid	process
1700	MSI8578.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	MSI8578.tmp

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSI8578.tmp

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MSI8578.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MSI8578.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

MSI8578.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	MSI8578.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	MSI8578.tmp

Suspicious use of SetThreadContext 1 IoCs

Processes:

MSI8578.tmp

description pid process target process

PID 1700 set thread context of 1932 1700 MSI8578.tmp RegAsm.exe

description	pid	process	target process
PID 1700 set thread context of 1932	1700	MSI8578.tmp	RegAsm.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6d8038.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6d8038.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI849B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8578.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6d803a.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6d803a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1664 schtasks.exe

pid	process
1664	schtasks.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exeMSI8578.tmp

pid process

812 msiexec.exe
812 msiexec.exe
1700 MSI8578.tmp
1700 MSI8578.tmp

pid	process
812	msiexec.exe
812	msiexec.exe
1700	MSI8578.tmp
1700	MSI8578.tmp

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSI8578.tmp

description	pid	process
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeSecurityPrivilege	812	msiexec.exe
Token: SeCreateTokenPrivilege	1120	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1120	msiexec.exe
Token: SeLockMemoryPrivilege	1120	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1120	msiexec.exe
Token: SeMachineAccountPrivilege	1120	msiexec.exe
Token: SeTcbPrivilege	1120	msiexec.exe
Token: SeSecurityPrivilege	1120	msiexec.exe
Token: SeTakeOwnershipPrivilege	1120	msiexec.exe
Token: SeLoadDriverPrivilege	1120	msiexec.exe
Token: SeSystemProfilePrivilege	1120	msiexec.exe
Token: SeSystemtimePrivilege	1120	msiexec.exe
Token: SeProfSingleProcessPrivilege	1120	msiexec.exe
Token: SeIncBasePriorityPrivilege	1120	msiexec.exe
Token: SeCreatePagefilePrivilege	1120	msiexec.exe
Token: SeCreatePermanentPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	1120	msiexec.exe
Token: SeRestorePrivilege	1120	msiexec.exe
Token: SeShutdownPrivilege	1120	msiexec.exe
Token: SeDebugPrivilege	1120	msiexec.exe
Token: SeAuditPrivilege	1120	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1120	msiexec.exe
Token: SeChangeNotifyPrivilege	1120	msiexec.exe
Token: SeRemoteShutdownPrivilege	1120	msiexec.exe
Token: SeUndockPrivilege	1120	msiexec.exe
Token: SeSyncAgentPrivilege	1120	msiexec.exe
Token: SeEnableDelegationPrivilege	1120	msiexec.exe
Token: SeManageVolumePrivilege	1120	msiexec.exe
Token: SeImpersonatePrivilege	1120	msiexec.exe
Token: SeCreateGlobalPrivilege	1120	msiexec.exe
Token: SeBackupPrivilege	828	vssvc.exe
Token: SeRestorePrivilege	828	vssvc.exe
Token: SeAuditPrivilege	828	vssvc.exe
Token: SeBackupPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	1660	DrvInst.exe
Token: SeLoadDriverPrivilege	1660	DrvInst.exe
Token: SeLoadDriverPrivilege	1660	DrvInst.exe
Token: SeLoadDriverPrivilege	1660	DrvInst.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeDebugPrivilege	1700	MSI8578.tmp
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe
Token: SeRestorePrivilege	812	msiexec.exe
Token: SeTakeOwnershipPrivilege	812	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1120 msiexec.exe
1120 msiexec.exe

pid	process
1120	msiexec.exe
1120	msiexec.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

msiexec.exeMSI8578.tmp

description	pid	process	target process
PID 812 wrote to memory of 1700	812	msiexec.exe	MSI8578.tmp
PID 812 wrote to memory of 1700	812	msiexec.exe	MSI8578.tmp
PID 812 wrote to memory of 1700	812	msiexec.exe	MSI8578.tmp
PID 812 wrote to memory of 1700	812	msiexec.exe	MSI8578.tmp
PID 1700 wrote to memory of 1664	1700	MSI8578.tmp	schtasks.exe
PID 1700 wrote to memory of 1664	1700	MSI8578.tmp	schtasks.exe
PID 1700 wrote to memory of 1664	1700	MSI8578.tmp	schtasks.exe
PID 1700 wrote to memory of 1664	1700	MSI8578.tmp	schtasks.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe
PID 1700 wrote to memory of 1932	1700	MSI8578.tmp	RegAsm.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ktrazuaohhbo7kc.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1120

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\Installer\MSI8578.tmp
"C:\Windows\Installer\MSI8578.tmp"
2⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JvwXYWCv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7437.tmp"
3⤵
- Creates scheduled task(s)
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A4" "00000000000002BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7437.tmp

Filesize
1KB

MD5
db715665e143e88b24b3305568dfa3fa

SHA1
c79d33dcba568e52b9daf658368bdc26e5af019b

SHA256
65f08eeb943f2336a2b99e64578ffaa3e347d168c88c3600705d2ec91b5a9982

SHA512
ac0ca907ff1403290777360501648ec05a165a14120a56d945b3f63d848927600854c015a1aef1eb907059dfee23cd7fbe26ce45e2249357143cbe8a1ae640f0

Download Submit
C:\Windows\Installer\MSI8578.tmp

Filesize
1.0MB

MD5
d29982e380361445494782bd1c9b5006

SHA1
9f101141ad54dbad246636fd240d4b70e2d443d9

SHA256
1dd929b928371a47a5bee9ae2fbf9997675d91b9e376472ab313e4d685cce42c

SHA512
d90395c79ab5a88e3d2131750b4890e549d76ff97fec06dd4fb6c5e030fee5d56d474ea7d99b507064ae77eb19253f0668502e8d92201a51384f873f34d20831

Download Submit
C:\Windows\Installer\MSI8578.tmp

Filesize
1.0MB

MD5
d29982e380361445494782bd1c9b5006

SHA1
9f101141ad54dbad246636fd240d4b70e2d443d9

SHA256
1dd929b928371a47a5bee9ae2fbf9997675d91b9e376472ab313e4d685cce42c

SHA512
d90395c79ab5a88e3d2131750b4890e549d76ff97fec06dd4fb6c5e030fee5d56d474ea7d99b507064ae77eb19253f0668502e8d92201a51384f873f34d20831

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1120-54-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/1664-63-0x0000000000000000-mapping.dmp

Download
memory/1700-61-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/1700-62-0x0000000005450000-0x00000000054EC000-memory.dmp

Filesize
624KB

Download
memory/1700-60-0x0000000000B50000-0x0000000000C5A000-memory.dmp

Filesize
1.0MB

Download
memory/1700-57-0x0000000000000000-mapping.dmp

Download
memory/1932-65-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-68-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-69-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-70-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-71-0x000000000048B2FE-mapping.dmp

Download
memory/1932-73-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1932-75-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads