hawkeye | ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe
Size

201KB
MD5

9066bf885cd72e46771654d0d8be15d3
SHA1

13afce866b59c99fa0319b7f204e6b6828d4b22c
SHA256

ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08
SHA512

ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec
SSDEEP

6144:Cz+glrx25snmJr/TqRd4y/Nns9ImK+BqIbsJHo57:Cz+glrxcsnor/mRGmsCt+BqFxod

Score

10^/10

hawkeye discovery evasion keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A11B4B0-04BD-C31C-DD5B-1F1EBA8BD1A3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mvscavAP.exe9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	mvscavAP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	explorer.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid	Process
4548	explorer.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exeexplorer.exemvscavAP.exeSiaPort.exe

pid	Process
4548	explorer.exe
1876	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1876-21-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1876-24-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1876-25-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1876-26-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exemvscavAP.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windws.exe = "C:\\Users\\Admin\\AppData\\Roaming\\A7K5E8K1BX.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\mvscavAP.exe"	mvscavAP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

explorer.exe

description	pid	Process	procid_target
PID 4548 set thread context of 1876	4548	explorer.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exereg.exe9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exeexplorer.execmd.exereg.exeSiaPort.exeexplorer.exereg.exemvscavAP.execmd.exereg.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SiaPort.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mvscavAP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exe

pid	Process
3500	reg.exe
2408	reg.exe
3208	reg.exe
1384	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exemvscavAP.exeSiaPort.exe

pid	Process
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe
3696	mvscavAP.exe
4416	SiaPort.exe
4548	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exeexplorer.exeexplorer.exemvscavAP.exeSiaPort.exe

description	pid	Process
Token: SeDebugPrivilege	2772	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe
Token: SeDebugPrivilege	4548	explorer.exe
Token: 1	1876	explorer.exe
Token: SeCreateTokenPrivilege	1876	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	1876	explorer.exe
Token: SeLockMemoryPrivilege	1876	explorer.exe
Token: SeIncreaseQuotaPrivilege	1876	explorer.exe
Token: SeMachineAccountPrivilege	1876	explorer.exe
Token: SeTcbPrivilege	1876	explorer.exe
Token: SeSecurityPrivilege	1876	explorer.exe
Token: SeTakeOwnershipPrivilege	1876	explorer.exe
Token: SeLoadDriverPrivilege	1876	explorer.exe
Token: SeSystemProfilePrivilege	1876	explorer.exe
Token: SeSystemtimePrivilege	1876	explorer.exe
Token: SeProfSingleProcessPrivilege	1876	explorer.exe
Token: SeIncBasePriorityPrivilege	1876	explorer.exe
Token: SeCreatePagefilePrivilege	1876	explorer.exe
Token: SeCreatePermanentPrivilege	1876	explorer.exe
Token: SeBackupPrivilege	1876	explorer.exe
Token: SeRestorePrivilege	1876	explorer.exe
Token: SeShutdownPrivilege	1876	explorer.exe
Token: SeDebugPrivilege	1876	explorer.exe
Token: SeAuditPrivilege	1876	explorer.exe
Token: SeSystemEnvironmentPrivilege	1876	explorer.exe
Token: SeChangeNotifyPrivilege	1876	explorer.exe
Token: SeRemoteShutdownPrivilege	1876	explorer.exe
Token: SeUndockPrivilege	1876	explorer.exe
Token: SeSyncAgentPrivilege	1876	explorer.exe
Token: SeEnableDelegationPrivilege	1876	explorer.exe
Token: SeManageVolumePrivilege	1876	explorer.exe
Token: SeImpersonatePrivilege	1876	explorer.exe
Token: SeCreateGlobalPrivilege	1876	explorer.exe
Token: 31	1876	explorer.exe
Token: 32	1876	explorer.exe
Token: 33	1876	explorer.exe
Token: 34	1876	explorer.exe
Token: 35	1876	explorer.exe
Token: SeDebugPrivilege	3696	mvscavAP.exe
Token: SeDebugPrivilege	4416	SiaPort.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

explorer.exe

pid	Process
1876	explorer.exe
1876	explorer.exe
1876	explorer.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exeexplorer.exeexplorer.execmd.execmd.execmd.execmd.exemvscavAP.exeSiaPort.exe

description	pid	Process	procid_target
PID 2772 wrote to memory of 4548	2772	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4548	2772	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4548	2772	9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe	87
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 4548 wrote to memory of 1876	4548	explorer.exe	90
PID 1876 wrote to memory of 3900	1876	explorer.exe	91
PID 1876 wrote to memory of 3900	1876	explorer.exe	91
PID 1876 wrote to memory of 3900	1876	explorer.exe	91
PID 1876 wrote to memory of 3656	1876	explorer.exe	92
PID 1876 wrote to memory of 3656	1876	explorer.exe	92
PID 1876 wrote to memory of 3656	1876	explorer.exe	92
PID 1876 wrote to memory of 3144	1876	explorer.exe	93
PID 1876 wrote to memory of 3144	1876	explorer.exe	93
PID 1876 wrote to memory of 3144	1876	explorer.exe	93
PID 1876 wrote to memory of 2336	1876	explorer.exe	94
PID 1876 wrote to memory of 2336	1876	explorer.exe	94
PID 1876 wrote to memory of 2336	1876	explorer.exe	94
PID 3900 wrote to memory of 1384	3900	cmd.exe	99
PID 3900 wrote to memory of 1384	3900	cmd.exe	99
PID 3900 wrote to memory of 1384	3900	cmd.exe	99
PID 3144 wrote to memory of 3500	3144	cmd.exe	100
PID 3144 wrote to memory of 3500	3144	cmd.exe	100
PID 3144 wrote to memory of 3500	3144	cmd.exe	100
PID 3656 wrote to memory of 3208	3656	cmd.exe	101
PID 3656 wrote to memory of 3208	3656	cmd.exe	101
PID 3656 wrote to memory of 3208	3656	cmd.exe	101
PID 2336 wrote to memory of 2408	2336	cmd.exe	102
PID 2336 wrote to memory of 2408	2336	cmd.exe	102
PID 2336 wrote to memory of 2408	2336	cmd.exe	102
PID 4548 wrote to memory of 3696	4548	explorer.exe	103
PID 4548 wrote to memory of 3696	4548	explorer.exe	103
PID 4548 wrote to memory of 3696	4548	explorer.exe	103
PID 3696 wrote to memory of 4416	3696	mvscavAP.exe	105
PID 3696 wrote to memory of 4416	3696	mvscavAP.exe	105
PID 3696 wrote to memory of 4416	3696	mvscavAP.exe	105
PID 4416 wrote to memory of 3516	4416	SiaPort.exe	107
PID 4416 wrote to memory of 3516	4416	SiaPort.exe	107
PID 4416 wrote to memory of 3516	4416	SiaPort.exe	107

C:\Users\Admin\AppData\Local\Temp\9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9066bf885cd72e46771654d0d8be15d3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3500
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\A7K5E8K1BX.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2408
- - C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe
    "C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
      "C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
        
        C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe
        5⤵
        
        PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
717371b9b665ead5e4e2f052a98c7eba

SHA1
fea748fcab2e473ac5eeeac378b19e1bb296a868

SHA256
dca6b5d9d19a3449a2d314e73513c2ee387bbcbc9c660e83e54621280975da0e

SHA512
8d37c813e3526ec3839c982c4267ec1fe6f537fed336225299738a654799e5cd953897cf4c4c1319e7215cbee4e336d4d7163e7aa821930eca44692ca3f06fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\mvscavAP.exe

Filesize
6KB

MD5
c203e138f460101f8af1314c0e817892

SHA1
13c2bc33e42e86e066d303b8596211d92a1a814e

SHA256
1d06c0e123142e3d119f5d865cba651d10c1b96a6fb44b68782b5f762ee16454

SHA512
ed9890756d06e0418223bda173c054839c407687c4f4cc0de63f7ef77a8872c146157c85be215b45f60636c7dfc2c815660d979b2f581408bbdae336428e045c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
201KB

MD5
9066bf885cd72e46771654d0d8be15d3

SHA1
13afce866b59c99fa0319b7f204e6b6828d4b22c

SHA256
ad90872dfd4b64dfbff9c38d36bd8b1fdb4173a14e84ad9d151d56d36dc87d08

SHA512
ed55f1e9567c5076172f9037a6487fe406b0a87ecb7f8cc892a2e2d1cd9a2d832f7286d286dc90b85de34ecc0216309e5fe658c9c14cbaf07d4e1a4df42861ec

Download Submit
memory/1876-24-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1876-21-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1876-25-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1876-26-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2772-13-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/2772-2-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/2772-0-0x0000000074AC2000-0x0000000074AC3000-memory.dmp

Filesize
4KB

Download
memory/2772-1-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/4548-15-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/4548-14-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/4548-45-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download