hawkeye | b491a4000f6257ea0cb2abe7e322c50032e36ab24aa61ee109482e795ef0fd09

Analysis

max time kernel
139s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ed90af568cc5d8e5cb7e581d55795fd.exe
Size

1023KB
MD5

8ed90af568cc5d8e5cb7e581d55795fd
SHA1

efd64d7374d4cda6df5670e9b1297767de24494d
SHA256

b491a4000f6257ea0cb2abe7e322c50032e36ab24aa61ee109482e795ef0fd09
SHA512

c7f7e1ff4f5d5151e5f6c2e23b11647717b57737707dfb2ba3269405a9ba6317c4b9e3f61e94df6e51495db0553b176b3f735194c042c84a6cf8356ba345bff6
SSDEEP

24576:fdya7rWvVw9ZgfHypAMmgGInjZ5YcL/GazTOV:f3rW/gVyyuazTO

Score

10^/10

hawkeye zgrat collection keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
ayocj2018

Signatures

Detect ZGRat V1 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3036-212-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-213-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-215-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-217-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-225-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-227-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-223-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-229-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-243-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-257-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-275-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-273-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-271-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-269-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-267-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-265-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-263-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-261-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-259-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-255-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-253-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-251-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-249-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-247-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-245-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-241-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-239-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-237-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-235-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-233-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-231-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-221-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-219-0x00000000088C0000-0x000000000893B000-memory.dmp	family_zgrat_v1

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8ed90af568cc5d8e5cb7e581d55795fd.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Normal = "\"C:\\Users\\Admin\\AppData\\Roaming\\Normal.exe\""	8ed90af568cc5d8e5cb7e581d55795fd.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 whatismyipaddress.com
9 whatismyipaddress.com

flow	ioc
7	whatismyipaddress.com
9	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

8ed90af568cc5d8e5cb7e581d55795fd.exe8ed90af568cc5d8e5cb7e581d55795fd.exe

description	pid	process	target process
PID 3036 set thread context of 1920	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	8ed90af568cc5d8e5cb7e581d55795fd.exe
PID 1920 set thread context of 1860	1920	8ed90af568cc5d8e5cb7e581d55795fd.exe	vbc.exe
PID 1920 set thread context of 2408	1920	8ed90af568cc5d8e5cb7e581d55795fd.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe8ed90af568cc5d8e5cb7e581d55795fd.exepowershell.exe8ed90af568cc5d8e5cb7e581d55795fd.exe

pid	process
2900	powershell.exe
2636	powershell.exe
3068	powershell.exe
2920	powershell.exe
1828	powershell.exe
1256	powershell.exe
3000	powershell.exe
1504	powershell.exe
412	powershell.exe
1268	powershell.exe
2104	powershell.exe
3048	powershell.exe
2736	powershell.exe
2628	powershell.exe
1924	powershell.exe
2172	powershell.exe
2500	powershell.exe
604	powershell.exe
588	powershell.exe
1008	powershell.exe
3036	8ed90af568cc5d8e5cb7e581d55795fd.exe
3036	8ed90af568cc5d8e5cb7e581d55795fd.exe
2928	powershell.exe
1920	8ed90af568cc5d8e5cb7e581d55795fd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeIncreaseQuotaPrivilege	2900	powershell.exe
Token: SeSecurityPrivilege	2900	powershell.exe
Token: SeTakeOwnershipPrivilege	2900	powershell.exe
Token: SeLoadDriverPrivilege	2900	powershell.exe
Token: SeSystemProfilePrivilege	2900	powershell.exe
Token: SeSystemtimePrivilege	2900	powershell.exe
Token: SeProfSingleProcessPrivilege	2900	powershell.exe
Token: SeIncBasePriorityPrivilege	2900	powershell.exe
Token: SeCreatePagefilePrivilege	2900	powershell.exe
Token: SeBackupPrivilege	2900	powershell.exe
Token: SeRestorePrivilege	2900	powershell.exe
Token: SeShutdownPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeSystemEnvironmentPrivilege	2900	powershell.exe
Token: SeRemoteShutdownPrivilege	2900	powershell.exe
Token: SeUndockPrivilege	2900	powershell.exe
Token: SeManageVolumePrivilege	2900	powershell.exe
Token: 33	2900	powershell.exe
Token: 34	2900	powershell.exe
Token: 35	2900	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeIncreaseQuotaPrivilege	2636	powershell.exe
Token: SeSecurityPrivilege	2636	powershell.exe
Token: SeTakeOwnershipPrivilege	2636	powershell.exe
Token: SeLoadDriverPrivilege	2636	powershell.exe
Token: SeSystemProfilePrivilege	2636	powershell.exe
Token: SeSystemtimePrivilege	2636	powershell.exe
Token: SeProfSingleProcessPrivilege	2636	powershell.exe
Token: SeIncBasePriorityPrivilege	2636	powershell.exe
Token: SeCreatePagefilePrivilege	2636	powershell.exe
Token: SeBackupPrivilege	2636	powershell.exe
Token: SeRestorePrivilege	2636	powershell.exe
Token: SeShutdownPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeSystemEnvironmentPrivilege	2636	powershell.exe
Token: SeRemoteShutdownPrivilege	2636	powershell.exe
Token: SeUndockPrivilege	2636	powershell.exe
Token: SeManageVolumePrivilege	2636	powershell.exe
Token: 33	2636	powershell.exe
Token: 34	2636	powershell.exe
Token: 35	2636	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8ed90af568cc5d8e5cb7e581d55795fd.exe

pid process

1920 8ed90af568cc5d8e5cb7e581d55795fd.exe

pid	process
1920	8ed90af568cc5d8e5cb7e581d55795fd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8ed90af568cc5d8e5cb7e581d55795fd.exe

description	pid	process	target process
PID 3036 wrote to memory of 2900	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2900	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2900	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2900	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2636	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2636	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2636	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2636	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3068	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3068	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3068	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3068	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2920	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2920	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2920	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2920	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1828	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1828	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1828	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1828	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1256	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1256	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1256	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1256	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3000	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3000	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3000	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3000	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1504	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1504	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1504	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1504	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 412	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 412	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 412	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 412	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1268	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1268	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1268	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1268	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2104	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2104	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2104	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2104	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3048	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3048	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3048	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 3048	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2736	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2736	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2736	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2736	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2628	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2628	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2628	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2628	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1924	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1924	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1924	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 1924	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2172	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2172	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2172	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe
PID 3036 wrote to memory of 2172	3036	8ed90af568cc5d8e5cb7e581d55795fd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\8ed90af568cc5d8e5cb7e581d55795fd.exe
"C:\Users\Admin\AppData\Local\Temp\8ed90af568cc5d8e5cb7e581d55795fd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Eurlbfipnkjbd.vbs"
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Normal.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2928
- C:\Users\Admin\AppData\Local\Temp\8ed90af568cc5d8e5cb7e581d55795fd.exe
  C:\Users\Admin\AppData\Local\Temp\8ed90af568cc5d8e5cb7e581d55795fd.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1920
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Eurlbfipnkjbd.vbs

Filesize
136B

MD5
311c68a158dfff6bf4be0ca469e8e365

SHA1
45ba4bb07de99dd65b0a7606db053623b8661281

SHA256
be6f0c382365cb583292150b9ca236a7ca40651a0cbdbc8672dd51bdd532ddbf

SHA512
4956d0c12303a49baf2c93ea2e03b3863fdad1bbb0e081e9a6d1976a2e6fc97671057b0c6c229ac70856c8d23f94f773f2e4abbf78b7c69a2d4e0195659bd851

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1c4fd2e6ff7139f473fbff9399a28c3c

SHA1
9a76503bc5665ede7cb1933db6fd289a7bb40a50

SHA256
595377aeffed95341bc25b4e3430a20af946f8568e4c87a797c8393b83218e04

SHA512
5f86727750277041101bd1149567a3031c2f5dc1341facc6879179934884a275b9cf239de39962f6a14a7a39f77c3d3a70afa1c7b18bd572cc1b02e3c64d4648

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c2fce674d95d33ed2b2436ded5e09d8e

SHA1
3a70980cc5ace6d62954d956e55b7bb858b2adb0

SHA256
1cb5566d4c80729121440e7ed4696b5e4cce58049bb54ae674afec1d32b32740

SHA512
d5492a39f7b17686551cdf2096237794d147f078aa8fd88eef678d11d92c902022f37451d1be0a70b9e8647cfb6d445641d1f50c0cec53ecc83f5b068ac24bf9

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/412-93-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/412-96-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/412-95-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/412-94-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/412-92-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/412-97-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-62-0x0000000002ED0000-0x0000000002F10000-memory.dmp

Filesize
256KB

Download
memory/1256-58-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-59-0x0000000002ED0000-0x0000000002F10000-memory.dmp

Filesize
256KB

Download
memory/1256-60-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-63-0x0000000002ED0000-0x0000000002F10000-memory.dmp

Filesize
256KB

Download
memory/1256-61-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-64-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1268-104-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/1268-103-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1268-108-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1268-105-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1268-106-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/1268-107-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/1504-86-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-81-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-84-0x0000000002B10000-0x0000000002B50000-memory.dmp

Filesize
256KB

Download
memory/1504-82-0x0000000002B10000-0x0000000002B50000-memory.dmp

Filesize
256KB

Download
memory/1504-83-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/1504-85-0x0000000002B10000-0x0000000002B50000-memory.dmp

Filesize
256KB

Download
memory/1828-48-0x0000000002990000-0x00000000029D0000-memory.dmp

Filesize
256KB

Download
memory/1828-47-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/1828-52-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/1828-49-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/1828-51-0x0000000002990000-0x00000000029D0000-memory.dmp

Filesize
256KB

Download
memory/1828-50-0x0000000002990000-0x00000000029D0000-memory.dmp

Filesize
256KB

Download
memory/2104-114-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-115-0x0000000002A00000-0x0000000002A40000-memory.dmp

Filesize
256KB

Download
memory/2636-15-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-17-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2636-16-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2636-18-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2636-19-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2900-9-0x000000006FDA0000-0x000000007034B000-memory.dmp

Filesize
5.7MB

Download
memory/2900-6-0x000000006FDA0000-0x000000007034B000-memory.dmp

Filesize
5.7MB

Download
memory/2900-7-0x00000000029A0000-0x00000000029E0000-memory.dmp

Filesize
256KB

Download
memory/2900-8-0x00000000029A0000-0x00000000029E0000-memory.dmp

Filesize
256KB

Download
memory/2900-5-0x000000006FDA0000-0x000000007034B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-41-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-36-0x00000000028D0000-0x0000000002910000-memory.dmp

Filesize
256KB

Download
memory/2920-35-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-37-0x000000006FAF0000-0x000000007009B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-38-0x00000000028D0000-0x0000000002910000-memory.dmp

Filesize
256KB

Download
memory/2920-39-0x00000000028D0000-0x0000000002910000-memory.dmp

Filesize
256KB

Download
memory/3000-70-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-72-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-73-0x0000000002930000-0x0000000002970000-memory.dmp

Filesize
256KB

Download
memory/3000-74-0x0000000002930000-0x0000000002970000-memory.dmp

Filesize
256KB

Download
memory/3000-71-0x0000000002930000-0x0000000002970000-memory.dmp

Filesize
256KB

Download
memory/3000-75-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/3036-243-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-267-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-34-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-1-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-2-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/3036-219-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-221-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-212-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-213-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-215-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-217-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-225-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-227-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-223-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-229-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-0-0x00000000012E0000-0x00000000013E6000-memory.dmp

Filesize
1.0MB

Download
memory/3036-257-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-275-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-273-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-271-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-269-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-40-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/3036-265-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-263-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-261-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-259-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-255-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-253-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-251-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-249-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-247-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-245-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-241-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-239-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-237-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-235-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-233-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3036-231-0x00000000088C0000-0x000000000893B000-memory.dmp

Filesize
492KB

Download
memory/3068-25-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/3068-26-0x0000000001E70000-0x0000000001EB0000-memory.dmp

Filesize
256KB

Download
memory/3068-27-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download
memory/3068-28-0x000000006FD70000-0x000000007031B000-memory.dmp

Filesize
5.7MB

Download