hawkeye | 6a75dfbdcc675d767cfaf741b25ff3e2527c6e9336febe0fb5b5a737a17d2c8c

General

Target

caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe
Size

328KB
MD5

caaf6e830cfe28f4cc5b097ab52d853b
SHA1

89bf48299ea7792e6891dfd267ad6013a34d307e
SHA256

6a75dfbdcc675d767cfaf741b25ff3e2527c6e9336febe0fb5b5a737a17d2c8c
SHA512

f5cf19ebf5a7ac7a14d8dc687df01d377653cab18d6c03228e0850485d0fb6d49d764eadef4ce7772a75655f62343f5776336ac42995edf592b597a69d45b451
SSDEEP

6144:pfe6Iq7LZgKRHNpfHb0AmhpJuxTQCIQHCZn5FBFOepDZzQJj/G4gx:JbZ7LZgSNpjsJPCIQo5jFR6jEx

Score

10^/10

hawkeye collection credential_access discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.gandi.net
Port:
587
Username:
[email protected]
Password:
@@yahoo.com@@

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 12 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/2752-31-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2752-33-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2752-34-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2752-28-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2752-26-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/1692-52-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1692-53-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2404-55-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2404-54-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/1692-56-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1692-57-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2404-63-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 9 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2752-31-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2752-33-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2752-34-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2752-28-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2752-26-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/1692-52-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1692-53-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1692-56-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/1692-57-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 8 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2752-31-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2752-33-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2752-34-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2752-28-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2752-26-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2404-55-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2404-54-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2404-63-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Executes dropped EXE 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

2148 svchost.exe
2752 svchost.exe
Loads dropped DLL 2 IoCs

Processes:

caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exesvchost.exe

pid process

2152 caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe
2148 svchost.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2152	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe
2148	svchost.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Load = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\DwiDesk\\svchost.lnk"	reg.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

svchost.exesvchost.exe

description	pid	process	target process
PID 2148 set thread context of 2752	2148	svchost.exe	svchost.exe
PID 2148 set thread context of 2656	2148	svchost.exe	MSBuild.exe
PID 2752 set thread context of 1692	2752	svchost.exe	vbc.exe
PID 2752 set thread context of 2404	2752	svchost.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MSBuild.exevbc.exevbc.execaaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exesvchost.execmd.exereg.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exeMSBuild.exe

pid	process
2148	svchost.exe
2148	svchost.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe
2656	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeMSBuild.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2148 svchost.exe
Token: SeDebugPrivilege 2656 MSBuild.exe
Token: SeDebugPrivilege 2752 svchost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

2752 svchost.exe

description	pid	process
Token: SeDebugPrivilege	2148	svchost.exe
Token: SeDebugPrivilege	2656	MSBuild.exe
Token: SeDebugPrivilege	2752	svchost.exe

pid	process
2752	svchost.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exesvchost.execmd.exesvchost.exe

description	pid	process	target process
PID 2152 wrote to memory of 2148	2152	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe	svchost.exe
PID 2152 wrote to memory of 2148	2152	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe	svchost.exe
PID 2152 wrote to memory of 2148	2152	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe	svchost.exe
PID 2152 wrote to memory of 2148	2152	caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe	svchost.exe
PID 2148 wrote to memory of 2852	2148	svchost.exe	cmd.exe
PID 2148 wrote to memory of 2852	2148	svchost.exe	cmd.exe
PID 2148 wrote to memory of 2852	2148	svchost.exe	cmd.exe
PID 2148 wrote to memory of 2852	2148	svchost.exe	cmd.exe
PID 2852 wrote to memory of 2780	2852	cmd.exe	reg.exe
PID 2852 wrote to memory of 2780	2852	cmd.exe	reg.exe
PID 2852 wrote to memory of 2780	2852	cmd.exe	reg.exe
PID 2852 wrote to memory of 2780	2852	cmd.exe	reg.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2752	2148	svchost.exe	svchost.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2148 wrote to memory of 2656	2148	svchost.exe	MSBuild.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 1692	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe
PID 2752 wrote to memory of 2404	2752	svchost.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\caaf6e830cfe28f4cc5b097ab52d853b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.exe" -n
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.lnk" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.lnk" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:1692
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab540.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\fl.txt

Filesize
11B

MD5
d1c56374fff0243832b8696d133b7861

SHA1
f4d236fdec2fd03914189c3b26e5cb0dfea9d761

SHA256
8e8eab0b4bfdc35c5f238935b81298e43970ee6818e9629d725297ebf03838a6

SHA512
e74cbfc425b9779b79dfb6b53dbf3d1451f9f35a766cc5167932b95c9bdb5288b65f9886fbdf3c3b180bf3a8360bfa1ef577b63e3443cae04b49e7ece433c452

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\svchost.exe

Filesize
328KB

MD5
caaf6e830cfe28f4cc5b097ab52d853b

SHA1
89bf48299ea7792e6891dfd267ad6013a34d307e

SHA256
6a75dfbdcc675d767cfaf741b25ff3e2527c6e9336febe0fb5b5a737a17d2c8c

SHA512
f5cf19ebf5a7ac7a14d8dc687df01d377653cab18d6c03228e0850485d0fb6d49d764eadef4ce7772a75655f62343f5776336ac42995edf592b597a69d45b451

Download Submit
memory/1692-52-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1692-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1692-57-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1692-53-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2148-17-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2148-15-0x0000000001330000-0x0000000001388000-memory.dmp

Filesize
352KB

Download
memory/2148-18-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2148-50-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-2-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/2152-3-0x0000000004C00000-0x0000000004C58000-memory.dmp

Filesize
352KB

Download
memory/2152-1-0x0000000001320000-0x0000000001378000-memory.dmp

Filesize
352KB

Download
memory/2152-16-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2404-54-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2404-55-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2404-63-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2656-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-46-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-43-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2656-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2752-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-51-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/2752-22-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-24-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-26-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-28-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-34-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-33-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2752-31-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads