Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
Hellion.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Hellion.exe
Resource
win10v2004-20241007-en
General
-
Target
Hellion.exe
-
Size
39.2MB
-
MD5
7c8b836cc2e24a14994390ecfc23ab60
-
SHA1
ae07a2cfa281c3e597ca309fd1fc9ac0990490d8
-
SHA256
53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f
-
SHA512
da57ecf50fa02aeba119981e7ff6ec8d9efad9633192898db6caa2a3f57037edbc5165c7bfb3664c98dacd262ed207cf5a151997e1bd119ddefdbf9ce5e7377d
-
SSDEEP
786432:w1mgeOt2n0c009m7azBnwpF7zWAwpnut5n:w1oZn0c009S8exWA35n
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4520 netsh.exe 2224 netsh.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 3464 cmd.exe 2960 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1620 Stub.exe -
Loads dropped DLL 32 IoCs
pid Process 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe 1620 Stub.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 18 discord.com 19 discord.com 37 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 17 ipinfo.io 23 ip-api.com -
pid Process 4424 cmd.exe 1380 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 892 tasklist.exe 1584 tasklist.exe 3444 tasklist.exe 3580 tasklist.exe 4384 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1856 cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3068 sc.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 716 netsh.exe 3564 cmd.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 1624 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 1172 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4540 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4568 ipconfig.exe 1624 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1248 systeminfo.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2960 powershell.exe 2960 powershell.exe 2960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeIncreaseQuotaPrivilege 4952 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4952 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4952 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4952 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4952 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4952 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4952 WMIC.exe Token: SeIncBasePriorityPrivilege 4952 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4952 WMIC.exe Token: SeBackupPrivilege 4952 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4952 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4952 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4952 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4952 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4952 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4952 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4952 WMIC.exe Token: 33 4540 WMIC.exe Token: 33 4952 WMIC.exe Token: 34 4540 WMIC.exe Token: 34 4952 WMIC.exe Token: 35 4540 WMIC.exe Token: 35 4952 WMIC.exe Token: 36 4540 WMIC.exe Token: 36 4952 WMIC.exe Token: SeDebugPrivilege 892 tasklist.exe Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: 33 4540 WMIC.exe Token: 34 4540 WMIC.exe Token: 35 4540 WMIC.exe Token: 36 4540 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 1620 4048 Hellion.exe 86 PID 4048 wrote to memory of 1620 4048 Hellion.exe 86 PID 1620 wrote to memory of 4568 1620 Stub.exe 89 PID 1620 wrote to memory of 4568 1620 Stub.exe 89 PID 1620 wrote to memory of 1708 1620 Stub.exe 97 PID 1620 wrote to memory of 1708 1620 Stub.exe 97 PID 1620 wrote to memory of 4980 1620 Stub.exe 98 PID 1620 wrote to memory of 4980 1620 Stub.exe 98 PID 1620 wrote to memory of 1596 1620 Stub.exe 100 PID 1620 wrote to memory of 1596 1620 Stub.exe 100 PID 1620 wrote to memory of 4732 1620 Stub.exe 101 PID 1620 wrote to memory of 4732 1620 Stub.exe 101 PID 4980 wrote to memory of 4952 4980 cmd.exe 105 PID 4980 wrote to memory of 4952 4980 cmd.exe 105 PID 4732 wrote to memory of 892 4732 cmd.exe 106 PID 4732 wrote to memory of 892 4732 cmd.exe 106 PID 1708 wrote to memory of 4540 1708 cmd.exe 107 PID 1708 wrote to memory of 4540 1708 cmd.exe 107 PID 1620 wrote to memory of 1128 1620 Stub.exe 108 PID 1620 wrote to memory of 1128 1620 Stub.exe 108 PID 1128 wrote to memory of 1980 1128 cmd.exe 110 PID 1128 wrote to memory of 1980 1128 cmd.exe 110 PID 1620 wrote to memory of 2604 1620 Stub.exe 111 PID 1620 wrote to memory of 2604 1620 Stub.exe 111 PID 1620 wrote to memory of 216 1620 Stub.exe 112 PID 1620 wrote to memory of 216 1620 Stub.exe 112 PID 216 wrote to memory of 1584 216 cmd.exe 115 PID 216 wrote to memory of 1584 216 cmd.exe 115 PID 2604 wrote to memory of 2172 2604 cmd.exe 116 PID 2604 wrote to memory of 2172 2604 cmd.exe 116 PID 1620 wrote to memory of 1856 1620 Stub.exe 117 PID 1620 wrote to memory of 1856 1620 Stub.exe 117 PID 1856 wrote to memory of 1896 1856 cmd.exe 120 PID 1856 wrote to memory of 1896 1856 cmd.exe 120 PID 1620 wrote to memory of 4808 1620 Stub.exe 122 PID 1620 wrote to memory of 4808 1620 Stub.exe 122 PID 1620 wrote to memory of 4192 1620 Stub.exe 123 PID 1620 wrote to memory of 4192 1620 Stub.exe 123 PID 4808 wrote to memory of 400 4808 cmd.exe 126 PID 4808 wrote to memory of 400 4808 cmd.exe 126 PID 4192 wrote to memory of 3444 4192 cmd.exe 127 PID 4192 wrote to memory of 3444 4192 cmd.exe 127 PID 1620 wrote to memory of 3684 1620 Stub.exe 128 PID 1620 wrote to memory of 3684 1620 Stub.exe 128 PID 1620 wrote to memory of 1864 1620 Stub.exe 129 PID 1620 wrote to memory of 1864 1620 Stub.exe 129 PID 1620 wrote to memory of 1536 1620 Stub.exe 130 PID 1620 wrote to memory of 1536 1620 Stub.exe 130 PID 1620 wrote to memory of 3464 1620 Stub.exe 132 PID 1620 wrote to memory of 3464 1620 Stub.exe 132 PID 3684 wrote to memory of 3804 3684 cmd.exe 136 PID 3684 wrote to memory of 3804 3684 cmd.exe 136 PID 3464 wrote to memory of 2960 3464 cmd.exe 137 PID 3464 wrote to memory of 2960 3464 cmd.exe 137 PID 3804 wrote to memory of 4144 3804 cmd.exe 138 PID 3804 wrote to memory of 4144 3804 cmd.exe 138 PID 1864 wrote to memory of 5012 1864 cmd.exe 139 PID 1864 wrote to memory of 5012 1864 cmd.exe 139 PID 1536 wrote to memory of 3580 1536 cmd.exe 140 PID 1536 wrote to memory of 3580 1536 cmd.exe 140 PID 5012 wrote to memory of 3876 5012 cmd.exe 141 PID 5012 wrote to memory of 3876 5012 cmd.exe 141 PID 1620 wrote to memory of 4424 1620 Stub.exe 142 PID 1620 wrote to memory of 4424 1620 Stub.exe 142 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1896 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hellion.exe"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exeC:\Users\Admin\AppData\Local\Temp\Hellion.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:4568
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"3⤵PID:1596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"3⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer4⤵PID:1980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:2172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe"4⤵
- Views/modifies file attributes
PID:1896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"4⤵PID:400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"3⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:3444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\system32\chcp.comchcp5⤵PID:4144
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"3⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\cmd.execmd.exe /c chcp4⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\chcp.comchcp5⤵PID:3876
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:3580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"3⤵
- Network Service Discovery
PID:4424 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1248
-
-
C:\Windows\system32\HOSTNAME.EXEhostname4⤵PID:784
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername4⤵
- Collects information from the system
PID:1172
-
-
C:\Windows\system32\net.exenet user4⤵PID:3360
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user5⤵PID:384
-
-
-
C:\Windows\system32\query.exequery user4⤵PID:4552
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"5⤵PID:2588
-
-
-
C:\Windows\system32\net.exenet localgroup4⤵PID:3604
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup5⤵PID:5064
-
-
-
C:\Windows\system32\net.exenet localgroup administrators4⤵PID:1052
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:1680
-
-
-
C:\Windows\system32\net.exenet user guest4⤵PID:4460
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest5⤵PID:404
-
-
-
C:\Windows\system32\net.exenet user administrator4⤵PID:1736
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator5⤵PID:2716
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command4⤵PID:3136
-
-
C:\Windows\system32\tasklist.exetasklist /svc4⤵
- Enumerates processes with tasklist
PID:4384
-
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
PID:4568
-
-
C:\Windows\system32\ROUTE.EXEroute print4⤵PID:4808
-
-
C:\Windows\system32\ARP.EXEarp -a4⤵
- Network Service Discovery
PID:1380
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano4⤵
- System Network Connections Discovery
- Gathers network information
PID:1624
-
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
PID:3068
-
-
C:\Windows\system32\netsh.exenetsh firewall show state4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4520
-
-
C:\Windows\system32\netsh.exenetsh firewall show config4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3564 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:4144
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:636
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:2072
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1System Information Discovery
3System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD579f71c92c850b2d0f5e39128a59054f1
SHA1a773e62fa5df1373f08feaa1fb8fa1b6d5246252
SHA2560237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980
SHA5123fdef4c04e7d89d923182e3e48d4f3d866204e878abcaacff657256f054aeafafdd352b5a55ea3864a090d01169ec67b52c7f944e02247592417d78532cc5171
-
Filesize
82KB
MD53859239ced9a45399b967ebce5a6ba23
SHA16f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA256a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
SHA512030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69
-
Filesize
120KB
MD5bd36f7d64660d120c6fb98c8f536d369
SHA16829c9ce6091cb2b085eb3d5469337ac4782f927
SHA256ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
SHA512bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56
-
Filesize
31KB
MD5f00133f7758627a15f2d98c034cf1657
SHA12f5f54eda4634052f5be24c560154af6647eee05
SHA25635609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
SHA5121c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201
-
Filesize
50KB
MD5add987aec610b3d921decbef60e0de8d
SHA12763d5d3acf58bc751323310f1f46abcbc093c82
SHA256ad5f49d13ddea57319e9d404e8947b5207239d07d94332dfe601331a70a8d5eb
SHA512d460aea5256de208cc0d13d59d05e809b3f5fd88c34731c776498113da45b6fd732f00cc1c6e02b2f43992cbcd04598e48aee140ca1c1e7ffdd3e8ff18238020
-
Filesize
260KB
MD557abdbfc3f2020177909e20984032dd5
SHA1b814a1e284bf330f3387afe0f1dc2ccf2b9b8016
SHA2563a143c933fadd1a1a60a65bdd37858ea11d47a074f9a7934933b13c01b7c3b8b
SHA5125ca9b1903e8aa7ea244a6807ac8107ad651aa6b16c444d420e9200d689d2a9fa9daac25bf937deb9214cc0dd550e6f9231b4e8551aa0dc38d265a87b7dae582e
-
Filesize
36KB
MD5ec9e2d8cc7966cacac49da5409bb72f7
SHA1eb0f500f21b7134ebc833ced27df1450db9ea241
SHA25623391519e1bf052d4832ada81bca088c2b8bce582f0eb3535109b524a2891e10
SHA512faa4a03cf4b0e7eb18412594f5199e57624099d4f53789bcd87cf2572f8f94636fadb8e99e3deabba57b2ab91427cdc7e239cf9d137d4ee3b31f6423e166f65b
-
Filesize
6.3MB
MD5b3cb55561c716c2e87eb7403e133db11
SHA1acb76d9271ad7de8b7415a645c0c8d1457eb4233
SHA256f207aaa9b7e757453ed1f128d26c27061b613901654e5a48eacdbfc1dcc348c0
SHA5129805e4431481a820db921057d7d876ef30b3abb967d702f8ce6c35ab0c916165f6d0f817aafb4eafc0e1c032537ba67283f9414b975cdfe2115f50e9d807844d
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
688KB
MD525bde25d332383d1228b2e66a4cb9f3e
SHA1cd5b9c3dd6aab470d445e3956708a324e93a9160
SHA256c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
SHA512ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa
-
Filesize
73KB
MD504444380b89fb22b57e6a72b3ae42048
SHA1cfe9c662cb5ca1704e3f0763d02e0d59c5817d77
SHA256d123d7fefde551c82eb61454d763177322e5ce1eaa65dc489e19de5ab7faf7b4
SHA5129e7d367bab0f6cc880c5870fdcdb06d9a9e5eb24eba489ca85549947879b0fa3c586779ffcea0fca4c50aa67dad098e7bd9e82c00e2d00412d9441991267d2da
-
Filesize
29KB
MD5c97a587e19227d03a85e90a04d7937f6
SHA1463703cf1cac4e2297b442654fc6169b70cfb9bf
SHA256c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
SHA51297784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12
-
Filesize
1.4MB
MD508d50fd2b635972dc84a6fb6fc581c06
SHA14bcfc96a1aad74f7ab11596788acb9a8d1126064
SHA256bb5ac4945b43611c1821fa575af3152b2937b4bc1a77531136780cc4a28f82e9
SHA5128ec536e97d7265f007ad0f99fc8b9eecc9355a63f131b96e8a04e4bd38d3c72e3b80e36e4b1923548bd77eb417c5e0ac6a01d09af23311784a328fbed3c41084
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
177KB
MD5fde9a1d6590026a13e81712cd2f23522
SHA1ca99a48caea0dbaccf4485afd959581f014277ed
SHA25616eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b
SHA512a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4
-
Filesize
63KB
MD54255c44dc64f11f32c961bf275aab3a2
SHA1c1631b2821a7e8a1783ecfe9a14db453be54c30a
SHA256e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
SHA5127d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52
-
Filesize
155KB
MD5e5abc3a72996f8fde0bcf709e6577d9d
SHA115770bdcd06e171f0b868c803b8cf33a8581edd3
SHA2561796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
SHA512b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6
-
Filesize
49KB
MD5e5aceaf21e82253e300c0b78793887a8
SHA1c58f78fbbe8713cb00ccdfeb1d8d7359f58ebfde
SHA256d950342686c959056ff43c9e5127554760fa20669d97166927dd6aae5494e02a
SHA512517c29928d6623cf3b2bcdcd68551070d2894874893c0d115a0172d749b6fe102af6261c0fd1b65664f742fa96abbce2f8111a72e1a3c2f574b58b909205937f
-
Filesize
77KB
MD51eea9568d6fdef29b9963783827f5867
SHA1a17760365094966220661ad87e57efe09cd85b84
SHA25674181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
SHA512d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09
-
Filesize
117KB
MD5d7b9ed5f37519b68750ecb5defb8e957
SHA1661cf73707e02d2837f914adc149b61a120dda7d
SHA2562ce63e16df518ae178de0940505ff1b11da97a5b175fe2a0d355b2ee351c55fd
SHA512f04708c28feb54f355d977e462245b183a0b50f4db6926c767e8f1499e83e910b05a3023b84d398fb5dd87743fe6146dbbc3e1caaed5351c27396f16746c6d6b
-
Filesize
157KB
MD5208b0108172e59542260934a2e7cfa85
SHA11d7ffb1b1754b97448eb41e686c0c79194d2ab3a
SHA2565160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
SHA51241abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d
-
Filesize
24KB
MD546e9d7b5d9668c9db5caa48782ca71ba
SHA16bbc83a542053991b57f431dd377940418848131
SHA256f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
SHA512c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7
-
Filesize
48KB
MD5c5036e8b04879173f5e530f7b11c65ba
SHA11f17b7551020575943b92058cc493b0c1a35d32c
SHA2568d12bdd47dbabc836930a663a5149c4f2d2b9ae082f954ee26fe66d501febfe9
SHA51207588b3e311ed1aebd5be0d96388fe180fed4629fe08ebca4e86802b8af3daed603eabdb5aa427c2e5e80e384c5b3d859b0ac4438bd2a278e949de6ce2fce44b
-
Filesize
76KB
MD57f06b8ac7734c5d932108b260d545a6d
SHA163a55be8ebd69918805f0188a3dcae83ed494a54
SHA256173551fdf4514c7995e32652b637c2b08da7b0e0fd4d17392441f48169475d65
SHA5129df9058460e50cb8943d1071abc93851d21aa0efad84419fd08ca384301f9bf98871e45962d991cd8f04ecf9b0d74398a5f56779a12be49fce0c8feb59ec2e93
-
Filesize
3.3MB
MD5e94733523bcd9a1fb6ac47e10a267287
SHA194033b405386d04c75ffe6a424b9814b75c608ac
SHA256f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
SHA51207dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f
-
Filesize
45KB
MD5b92f8efb672c383ab60b971b3c6c87de
SHA1acb671089a01d7f1db235719c52e6265da0f708f
SHA256b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72
SHA512680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b
-
Filesize
65KB
MD5b711598fc3ed0fe4cf2c7f3e0877979e
SHA1299c799e5d697834aa2447d8a313588ab5c5e433
SHA256520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
SHA512b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
Filesize
1.1MB
MD5aa13ee6770452af73828b55af5cd1a32
SHA1c01ece61c7623e36a834d8b3c660e7f28c91177e
SHA2568fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
SHA512b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
95KB
MD51c6c610e5e2547981a2f14f240accf20
SHA14a2438293d2f86761ef84cfdf99a6ca86604d0b8
SHA2564a982ff53e006b462ddf7090749bc06ebb6e97578be04169489d27e93f1d1804
SHA512f6ea205a49bf586d7f3537d56b805d34584a4c2c7d75a81c53ce457a4a438590f6dbeded324362bfe18b86ff5696673de5fbe4c9759ad121b5e4c9ae2ef267c0