Analysis
-
max time kernel
171s -
max time network
162s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
05-10-2024 17:22
General
-
Target
windhawk_setup.exe
-
Size
10.0MB
-
MD5
d634fcd62241a93efd88315091cced44
-
SHA1
f1baad89da31bf3f63d07e9cb1517e371101dde1
-
SHA256
e60928dee71b11866a826bc474a72b928327d1378ea80319819217cebcd53b2a
-
SHA512
93d37c89215f5123168d2d16dc74da5a36375d914201562b2701783f82bb50c4488f2a1330d7567fdc734db1089f87369b61e86188401c55e8c4fbc4bdaaff70
-
SSDEEP
196608:A3rzSJQkbeHufi8QhiNArredu5VODUqad9jDxrawNZFOu3U3V2:AbzkQGeHeQhqureM5MDBG9fIOdE30
Malware Config
Signatures
-
Executes dropped EXE 27 IoCs
-
Loads dropped DLL 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Executes dropped EXE
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkRunUITask /f3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkRunUITask /xml "C:\Users\Admin\AppData\Local\Temp\nshCB41.tmp\WindhawkRunUITask.xml"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /S /C "powershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff4⤵
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkUpdateTask /f3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkUpdateTask /xml "C:\Users\Admin\AppData\Local\Temp\nshCB41.tmp\WindhawkUpdateTask.xml"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "C:\ProgramData\Windhawk\EditorWorkspace" --locale=en --no-sandbox --disable-gpu-sandbox4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 --field-trial-handle=1688,i,8974846487946457807,8429630343914426957,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --mojo-platform-channel-handle=1832 --field-trial-handle=1688,i,8974846487946457807,8429630343914426957,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2520 --field-trial-handle=1688,i,8974846487946457807,8429630343914426957,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:d5a28a8b-e5d3-45f0-8ee4-216989f96556 /prefetch:15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2760 --field-trial-handle=1688,i,8974846487946457807,8429630343914426957,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:3ec0c952-e74a-4ea0-9acb-33a38badab1f --vscode-window-kind=shared-process /prefetch:15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=ptyHost --logsPath C:\ProgramData\Windhawk\UIData\user-data\logs\20241005T1725126⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=fileWatcher6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --inspect-port=0 "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=extensionHost --skipWorkspaceStorageLock5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=29886⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\Program Files\Windhawk\windhawk.exe"c:\Program Files\Windhawk\windhawk.exe" -new-updates-found6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
\??\c:\Program Files\Windhawk\Compiler\bin\g++.exe"c:\Program Files\Windhawk\Compiler\bin\g++.exe" -std=c++23 -O2 -shared -DUNICODE -D_UNICODE -DWINVER=0x0A00 -D_WIN32_WINNT=0x0A00 -D_WIN32_IE=0x0A00 -DNTDDI_VERSION=0x0A000008 -D__USE_MINGW_ANSI_STDIO=0 -DWH_MOD "-DWH_MOD_ID=L\"windows-11-taskbar-styler\"" "-DWH_MOD_VERSION=L\"1.3.7\"" "c:\Program Files\Windhawk\Engine\1.5.1\64\windhawk.lib" c:\ProgramData\Windhawk\EditorWorkspace\mod.wh.cpp -include windhawk_api.h -target x86_64-w64-mingw32 -o C:\ProgramData\Windhawk\Engine\Mods\64\windows-11-taskbar-styler_1.3.7_535670.dll -lcomctl32 -lole32 -loleaut32 -lruntimeobject -Wl,--export-all-symbols6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
\??\c:\Program Files\Windhawk\Compiler\bin\clang-18.exe"c:\Program Files\Windhawk\Compiler\bin\clang-18" --start-no-unused-arguments --driver-mode=g++ -target i686-w64-mingw32 -rtlib=compiler-rt -unwindlib=libunwind -stdlib=libc++ -fuse-ld=lld --end-no-unused-arguments -std=c++23 -O2 -shared -DUNICODE -D_UNICODE -DWINVER=0x0A00 -D_WIN32_WINNT=0x0A00 -D_WIN32_IE=0x0A00 -DNTDDI_VERSION=0x0A000008 -D__USE_MINGW_ANSI_STDIO=0 -DWH_MOD "-DWH_MOD_ID=L\"windows-11-taskbar-styler\"" "-DWH_MOD_VERSION=L\"1.3.7\"" "c:\Program Files\Windhawk\Engine\1.5.1\64\windhawk.lib" c:\ProgramData\Windhawk\EditorWorkspace\mod.wh.cpp -include windhawk_api.h -target x86_64-w64-mingw32 -o C:\ProgramData\Windhawk\Engine\Mods\64\windows-11-taskbar-styler_1.3.7_535670.dll -lcomctl32 -lole32 -loleaut32 -lruntimeobject -Wl,--export-all-symbols7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\Compiler\bin\clang-18.exe"C:/Program Files/Windhawk/Compiler/bin/clang-18.exe" -cc1 -triple x86_64-w64-windows-gnu -emit-obj -dumpdir "C:\ProgramData\Windhawk\Engine\Mods\64\windows-11-taskbar-styler_1.3.7_535670.dll-" -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name mod.wh.cpp -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -mms-bitfields -funwind-tables=2 -fno-use-init-array -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb "-fdebug-compilation-dir=c:/Program Files/Windhawk/Compiler" "-fcoverage-compilation-dir=c:/Program Files/Windhawk/Compiler" -resource-dir "C:/Program Files/Windhawk/Compiler/lib/clang/18" -include windhawk_api.h -D UNICODE -D _UNICODE -D WINVER=0x0A00 -D _WIN32_WINNT=0x0A00 -D _WIN32_IE=0x0A00 -D NTDDI_VERSION=0x0A000008 -D __USE_MINGW_ANSI_STDIO=0 -D WH_MOD -D "WH_MOD_ID=L\"windows-11-taskbar-styler\"" -D "WH_MOD_VERSION=L\"1.3.7\"" -internal-isystem "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/include/c++/v1" -internal-isystem "c:/Program Files/Windhawk/Compiler/include/c++/v1" -internal-isystem "C:/Program Files/Windhawk/Compiler/lib/clang/18/include" -internal-isystem "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/include" -internal-isystem "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/usr/include" -internal-isystem "c:/Program Files/Windhawk/Compiler/include" -O2 -std=c++23 -fdeprecated-macro -ferror-limit 19 -fno-use-cxa-atexit -fgnuc-version=4.2.1 -fno-implicit-modules -fskip-odr-check-in-gmf -fcxx-exceptions -fexceptions -exception-model=seh -vectorize-loops -vectorize-slp -faddrsig -o C:/Users/Admin/AppData/Local/Temp/mod-d8e085.o -x c++ "c:\ProgramData\Windhawk\EditorWorkspace\mod.wh.cpp"8⤵
- Executes dropped EXE
-
-
\??\c:\Program Files\Windhawk\Compiler\bin\ld.lld.exe"c:/Program Files/Windhawk/Compiler/bin/ld.lld" -m i386pep --shared -Bdynamic -e DllMainCRTStartup --enable-auto-image-base -o "C:\ProgramData\Windhawk\Engine\Mods\64\windows-11-taskbar-styler_1.3.7_535670.dll" "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/lib/dllcrt2.o" "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/lib/crtbegin.o" "-Lc:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/lib" "-Lc:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/mingw/lib" "-LC:/Program Files/Windhawk/Compiler/lib/clang/18/lib/windows" "c:\Program Files\Windhawk\Engine\1.5.1\64\windhawk.lib" C:/Users/Admin/AppData/Local/Temp/mod-d8e085.o -lcomctl32 -lole32 -loleaut32 -lruntimeobject --export-all-symbols -lc++ -lmingw32 "C:/Program Files/Windhawk/Compiler/lib/clang/18/lib/windows/libclang_rt.builtins-x86_64.a" -lunwind -lmoldname -lmingwex -lmsvcrt -ladvapi32 -lshell32 -luser32 -lkernel32 -lmingw32 "C:/Program Files/Windhawk/Compiler/lib/clang/18/lib/windows/libclang_rt.builtins-x86_64.a" -lunwind -lmoldname -lmingwex -lmsvcrt -lkernel32 "c:/Program Files/Windhawk/Compiler/x86_64-w64-mingw32/lib/crtend.o"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1688,i,8974846487946457807,8429630343914426957,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:d5a28a8b-e5d3-45f0-8ee4-216989f96556 /prefetch:15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wsl.exeC:\Windows\Sysnative\wsl.exe --status5⤵
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Executes dropped EXE
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Loads dropped DLL
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -service1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -tray-only2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -check-for-updates1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD530bc92170c41a90ada79dd377ace7b01
SHA11179bb5a55d736b2f046a796737cc19f996a8b6a
SHA2560115210e2469944ae998ca69fcc39953e2692f6692304d33fad9aacfacfe1ba7
SHA512b78884b448e1cd855c549f60e855404f6c34d61a3b94a6a031a62163babdb87c51122107a0da8e6e8bedd4a094377b4cc045220fdeef4aadf808d8b4f2944dad
-
Filesize
2KB
MD5a6833e66680b7457352965a85482e126
SHA1b67e69b6b16ec490b0804ac5b01a26073fb38f55
SHA25618aa8cb29c35ca25ebf616aedc059371ea3cb481435662830a29d3ee3d1a0b78
SHA51211697bf09a1cabd46c7dd0349b3c04859ef0c1028a51e438ead2ecf107d143e31ed144213a8927aed7d8d9a137b03be97592cb0f5f55fc1f2d4be31921c1e3ed
-
Filesize
8B
MD5ab0a4c8c62da160eaae565341c07f202
SHA1c98a17c08a612b399bcbcffed621456142bf10af
SHA256f0a17a43c74d2fe5474fa2fd29c8f14799e777d7d75a2cc4d11c20a6e7b161c5
SHA512220dbd2e437313c441bc34a9707ccc2e70a9c864399cfcb2aad34a012b75c45316758f8b6e85c668920beb510e0a4bc11a3129ee4d9df25a3fd090e944437dab
-
Filesize
238B
MD51f0d70d404140b0b980828d2d02345ce
SHA1cc21371a235a392bd17807d6774c60e64ff5bb28
SHA256a32207b286686ad5f42d72a5c96308b96c5cb5f42fb2a7deef01843e657c6035
SHA512d1a5589be969b15e09379c630fd56849d2a57eb6d26068899753c7701c97ff695fefe63648749f2bc7526cd0fd8816970ecec00d5f476f84f9cb10c0e9a377a0
-
Filesize
237B
MD578e0d5a995d78a006930de3633bbd3be
SHA1f58a7650dece31af5c4f3931981dc9bb2584c101
SHA256255a11df990657af623e682c7c3a81274fbb4a80c10f1dc2280cb3ce4eb98cf4
SHA51218a5f5166a12b157e5727e7e4187c1b9521530419fefbb355be693da8fa959a852a6b00eadf4d759c74931f7943ca3f08ce01ac7497a80892b79489aa1bf8b38
-
Filesize
440B
MD5c90884b4b37c4416bc9e06b7e05eee83
SHA1a7910f32378931a4c8cf86186cde5f0488c96196
SHA256ba6d2968e387be16375170a945d210b42a3f103bb7c1c8ab7c9d3d190c746105
SHA5126f0ecb0f9e5a65747e6f59b29b4e6a1da04a1d17fffcf971936193df58423dbfac0ca4898d3ef924b1244f515553755534b3685584da567b65401efc08b180e1
-
Filesize
461B
MD52d594af0d5a963e56d9f77abf7042abb
SHA1c716f93b2bd4c23a05bee2830b99756bfbf69de6
SHA256dde40ec35e6728a5ddcde229fe62f85c6c8d2a573126de3a3603fc8981ae6d2a
SHA5124a3a0f8593a6f84e3884b9ad06a59c305a834f59ba357714d3a7f07d5440fbd93c6ac049c4390a67c198299999be7839d2b034d31a0b3c287d132c50740c2928
-
Filesize
2KB
MD595b85c946719739b5aa5c30395802386
SHA10e481993feb633e388ae9bec972e5c11b65d59c8
SHA256c5a4b460090009d50c715eb9b4cb9df12cf18826490860ee95fdac1802638d65
SHA51256c5be94c7de012021adb22a1c6bbc905f27200ac92ca65cc00734a4fe7a724d431b262a853d009d3d87ba83f7c829746c714eeb60b815054482adb7e3bc8fc4
-
Filesize
2KB
MD5d2c085bda6edba7c0bc2611576a3eaa2
SHA10b82e1b3d5e9075d6411432b8838fd964b7a6b7f
SHA256a836e2c842878a7df2351079edc9cbaa5a9dd14a2a1ca4ef042447d4a5446601
SHA512dc9c5afb02d3a2cab3028f086b822738c39c366358bcf12a1780e5be14eb55c865ef6348e59e94f4896c3fe5db383c5bb83009dbe2bdbf7fd65701cceed87567
-
Filesize
2KB
MD5bb936f0e04d8f1e19ad545100cee9654
SHA1ca7a993958b886d2435da65fe6996b89e57e8354
SHA25699a69660981156c21336fdb5661f89341b013c94e4bf9e1c7467b4745718397f
SHA51207e171b66b74e967e3a233639de62df503304c8ec7185019cd61849ec82c5f0e33fcce1b92fc3fc2fc3116b6b17f332d1b31571f804e970a8a624fafb625b693
-
Filesize
866KB
MD550b6669e7b8cf120b2066e2d366d3994
SHA1374d45d76e536320716c5808b168e2fb58522c14
SHA2568e690f5d967df2eedf3d0ee542b8b9df3febfb7c70939df28fc363aa7c66acf5
SHA512cfd11b16825378549282c4bffe54e622b734f5df540b0a7299ac0c9055ea57e59c853d117c79d9a8029d00a80b3a48ff9477a22caafc9fabb0b80ee6441e03f4
-
Filesize
940KB
MD53fb6ebd7d8db72e172e911a266277d55
SHA1aa8448ca2d56b196b5773ac5804df26b298100d8
SHA2561a04cc0166d12d9e2f6b7c842961f0916086f680d941993e073ee2f6c4d46c38
SHA5120e2d6016d6d55794188b64fa638b778bbb03b16b6a9b86d967ea3387540f561743d17851ca973e1176073070a635d35c0321f3b5e1e706750080fda89f3c6187
-
Filesize
224B
MD58ab713faf7a25a288e92a46bd4f5576b
SHA126f032e7b074a788ed91df1777b1e82f3411198b
SHA25663f6c638bbd1f0bd8852dd6460d40561c13b103b9e70d4b3c53d0b671162708f
SHA5123c8bfa0f2a1b0c1518badb21c856013fb940320a4d2b13d667ad4807f5ac112af6e07155b354fde1100dee90efcbad014b896e1419766ee6bd1a2201ec12d7d3
-
Filesize
5KB
MD51ec85b4d25937dcbeff1c35b7fa5c6bc
SHA1e782b747b88450957391619b376abf98f11f7aa3
SHA25638ee4192b4a1f7da0535d4f2bd219ab5b108b1d3b6b9871ca00c762464b60701
SHA51295ded5456a7ce6fb3af391bc859cfb1d964e718d3540cc29c5f1288550f109fc12dbbcf9ffff923cd486f23bd90d5f2020e7d580724fe445480be09a1f173573
-
Filesize
42KB
MD5fc848a0f835f1bdd835ea2efd680cca0
SHA1751ba7ee0e9740557981b670502b10a8ca38f41b
SHA256b5e31fcdc54694d52b1955c2d57134bbd8b0f9f0b2ce28de5b9a9b92eaab19a4
SHA51203bc050c287d7948d350fff8ba25d3e75903fe27b2f89faba3b7d40487b2e70c93bf50c39c61cbab3a8d54d5221c85a1cc50d1c5443b5e80e8e3fba91ba73607
-
Filesize
4KB
MD570ab425ac6de0c114b7b57b180a73219
SHA1e8612a2c34c219d543f79486e1c5c10d581f084d
SHA2560602eb49509d57434b724afed57b1f2dcbb8b78a731e38ed8eb61aaf75c6397b
SHA512ee762d3656cb2851d3cf116c1dcdd2b58dedfece1784166bd27741e4f6ca52dcfa6599436bc7a060fdcc149aa71802d1163b9f90a7bc789eebc8bebaeaed4453
-
Filesize
763KB
MD54e26dc9976c4577830c9b287b3b9633e
SHA1f257668bc1630e82d7a9e2b91fbd16440a9f0d72
SHA256685d95cc192a9a46869d11b5f3dab7945c0570f4e5972a02042fde2257e96f87
SHA5128c3d5bf8e76547321031047c2593e3da6ab1e8ca75d1f38922f87a5a2d5a455c8207984a2ccd5ee806fcbbdbc58574ca859bb8009d1d87d132c5110edf411b2e
-
Filesize
314B
MD5b2ae0ad9f88256ce9381e081f0ef5ff2
SHA17d8036ade580de6c8a054e2bce6f1e27e0d9c75f
SHA25624d721bcca8e7bc2b320aaa711dc948ac7ec2a78e38daaa188c6d3b78e1bff74
SHA512fd2d83a83012bf3ad779339b8d5610099f1bcc0b34ccd2c45d15eb8096d6eb76268917dcee6d63a94e163ad04beb2f06eff2f2f9d1d81d42ba7d6ba37518d71f
-
Filesize
1KB
MD569786112c3f6d978587027d0e85e27a2
SHA1aa226175885a29a353a3a0d4c3af487f3865f215
SHA256430eda6450fedf60abe68d209fcf66c3256f8409d77a07aedcac0c7cbd7ea3d0
SHA512786132b84ea70c5881e470e617aece5190bd8ddbfc2a2bb7d4ecbdf073700ba145c2b87d94336a2d5f01c531dc4f69a34ca507463868213e729810dddd6ccdd5
-
Filesize
1KB
MD575faf0e29fa61d9cb07c64a231387b19
SHA19d4c43608dab9248eaa4864414528dad5220321a
SHA256523ba5f0fe7d94e9ae557ed580a980c1d317685e9e6b157bbff14c6287764b19
SHA512ab85112e38100d0cb6342e82c70878fe28b060f5ace69486835167089bcd8a198ef6a7dff9de4b5925cd42bba4109d5d7d0860e468d8bb5d7593e8b7e070dc2a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
132B
MD5dba8585757015ec118827534ea6b9a93
SHA10caa2c4753afd6e61e5aafe74f2e3e75671c2e8e
SHA256212bf7f1772994c8399eaacee875d378e3ac263e6a4950d117666a4f1dce4f08
SHA512bcc5263c683b149f8c0f7f638c5cfff6e18d39ca83685998b28c43e864020de124047061f614c630e278157b28fe8e4eebbbf673e0493f904adafa506ca11ce7
-
Filesize
799B
MD518027ee9ac670d632c74c512fee15785
SHA1d1755c680c7b60173a9a0b7dbe234bcd632cbabb
SHA25623e3363412b57fda08ee3235a2abad67a1d45844c5a1b0d5ce99f0b61e607a91
SHA512f4168d5235167fc41d8ff7edadb1103ac831197082209a41cd42b4cf27fa578f11e63bf43342937dca2793f20f3f43db9edef65dc25a933996934e4cf4ad6c3f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
216B
MD558d09928d7c8e1b8df31d06530bcd8bf
SHA1a012c21f161ac96363c4eb865c7a975bd8e79cbe
SHA256073a8433ec53559400736ee7d3a46eaf457090191baba8e796879a9e14a51595
SHA512417ebc13a1ad0bf4d3081eb3b1ef069db0b7cf280af61f82ab7f12c4ec1abca55150f7f560eb58bdb7983efa38bd48b57ed7da152dae8d9040cb7cebb42df728
-
Filesize
48B
MD5f10c68c647c48f6a7763f9d25433d003
SHA1f4f31f9380158b9a5e754ab35d1dc2698ca9a8fe
SHA256996990ada62b163cf29a69c458bc8aff73d4fa77344949570e0c10b8a31f76c7
SHA5124ef8ac3a888496aec4f267a1009a2db779abe5f981180cc9df2296a8c99b985a0039f0659ee60275132cdcfacaa1491dd85f0a0a95e9302618164d791b860bdc
-
Filesize
146B
MD573fc916d7c5cf37cde85862d7ab63f64
SHA1bd8ba2c2dfc7281b398dece79d9bc86e31595861
SHA2565bbd32fa609a5b5e1d93a2b61f20698999623c616e11c1f34f212b0c14e43b35
SHA512800c29e348e1ed16f8405dac23cf64c40e4d4083b0459d9cd56e6e39e119605bfc72437959a5ffa7f373eabfc86bf0f6694772acd8a90da65b993c0bc651d0d1
-
Filesize
150B
MD58a5833ef2a72447f343049af51ae52a8
SHA1b2c2dc12c4a0addde0f8858700ccbe3efffc0616
SHA2561a73ee1a4b87472c8db10b2799d3d31f746abf1d4f7994c9beb60f85965f886a
SHA51269fbd32cd549c543fe4a748c2f69fff65fa3d42336a14ede427bcfd6d4cd33db640450e2595fc1b6aeec87da2d5f6b135a5c85eddfcfbdafd0588717863ed7a0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
72B
MD59062d08a3ff5a76bc2282ee4a11b53ff
SHA10364f01055c69c64440167527f61cac3548db88d
SHA256f4d77d8a1c5cd116b898aa92ebd91cf097317b889526851cd7210c1a809e5088
SHA512bccb76a28cb37dd58cedb69ea67f2d47ba5ab2cf1d909f884e3e36dd526c360009fcbcff57d0912704792ce4340f203e7ac57a527a75c2202f3f2ac8d8c95793
-
Filesize
72B
MD56c06a8f4c189fe6023ce6b4c9aa9bd69
SHA131bfa66a16ec7d1af97c5144c491c093093cd9f8
SHA256496ffd288807a0d30103e92e7b11f4b427616c4d3f2088274fd263830fd8821f
SHA5120e42e91fd6ba78df2db92c3851b95bf0922dbb881acf9b69ff9965b82f11a3400119998def723ff1d6d01e4dd83190a0132c4247a8fe307266f6415dd0782343
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
15KB
MD5d74bb4447af48da081c7d9b499f3a023
SHA1dadf6e140e6fd8e49a1851cc144bb022e0adb185
SHA2565fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
SHA5129a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
-
Filesize
198KB
MD591c2e2f34b5bba068e9a6178e13a4e5c
SHA1affcac00894c9afd152e55d0bff7899349edcd6c
SHA256f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
SHA512ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
-
Filesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
Filesize
5KB
MD5549ee11198143574f4d9953198a09fe8
SHA12e89ba5f30e1c1c4ce517f28ec1505294bb6c4c1
SHA256131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
SHA5120fb4cea4fd320381fe50c52d1c198261f0347d6dcee857917169fcc3e2083ed4933beff708e81d816787195cca050f3f5f9c5ac9cc7f781831b028ef5714bec8
-
Filesize
1.1MB
MD57b89329c6d8693fb2f6a4330100490a0
SHA1851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA2561620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
SHA512ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
2KB
MD5c5a8c610ef39cca87d8eb9c43b85184d
SHA1059446b83be2ada64e91e7b86b51dc55bfdd1355
SHA25610b198979ca99ca5bb387af5684014227687a00cf9e0ff71ea8a0ccfcf8250fc
SHA5121c0f5a36df78d5734ee139138b903dbdf85108d7b78abc76cdb1afd528103fba514e403404bff2eef9b7ad7f115b5b365cf1767377ed56d22fc27de175df3a31
-
Filesize
9KB
MD5b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA115ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA25689a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
SHA5126467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
-
Filesize
7KB
MD511092c1d3fbb449a60695c44f9f3d183
SHA1b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA2562cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
SHA512c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
1KB
MD503f8007e70bd378e3171cf1315b1c3c4
SHA1e8980b33700aa4ea412301854f69c6f74922ae88
SHA25685a71de4c90a445153be46514743235be8f303932f5ae6bb1b1f4830a2174535
SHA51202531e75b5eb48b986be179cc0fe5fe66dc5130ede2f20dc035ed2cae4b02929f62cd205d3cce10f9e39e906e21b99195fb41eca9c692b0a142b6542dbcc42f2
-
Filesize
1KB
MD5a7dc72a61037f26d92fa59f7c060fadd
SHA12a1ca614990370aec55a30420a201546ac36346e
SHA25682ddea46e399d949e9b9f482a641b8d39d2f49c4ec471b98cabd6c249b9a647b
SHA5121734c45f26c27db15df9260811301781b75d3dd616244a69274b4b1a69215ac375fb1ee3b2d50093d3e1695fe7857bbdfabed79bb5fb0e4754f626025e962da1
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
