Analysis
- max time kernel
299s - max time network
302s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/07/2026, 16:03
General
- Target windhawk_setup.exe
- Size 11.0MB
- Sample260702-tht47set7n
- SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of UnmapMainImage 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}2⤵
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-befdf114-b759-46ef-ba01-5ba75d31a1ad -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3918b9cd-a696-489c-9e7d-3aa7032c1d87 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-28364a50-0138-4faf-b925-41a05a82435e -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4207f371-e5cd-48b5-904f-061b8e913e75 -LifetimeId:78edffaa-585a-405d-b2f8-428adcf2a700 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -check-for-updates2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
- Executes dropped EXE
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkRunUITask /f3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkRunUITask /xml "C:\Users\Admin\AppData\Local\Temp\nst28F1.tmp\WindhawkRunUITask.xml"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /S /C "powershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff4⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindhawkUpdateTask /f3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn WindhawkUpdateTask /xml "C:\Users\Admin\AppData\Local\Temp\nst28F1.tmp\WindhawkUpdateTask.xml"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "C:\ProgramData\Windhawk\EditorWorkspace" --locale=en --no-sandbox --disable-gpu-sandbox3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1692,i,14180950052938385084,1778421138819437386,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --mojo-platform-channel-handle=1824 --field-trial-handle=1692,i,14180950052938385084,1778421138819437386,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2596 --field-trial-handle=1692,i,14180950052938385084,1778421138819437386,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:4ce115a9-9edc-4ebc-a9cf-f2f85269dfee /prefetch:14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1692,i,14180950052938385084,1778421138819437386,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:def55a63-8f39-4620-aab3-0e57c23565a7 --vscode-window-kind=shared-process /prefetch:14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=ptyHost --logsPath C:\ProgramData\Windhawk\UIData\user-data\logs\20260702T1708215⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=fileWatcher5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --inspect-port=0 "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=extensionHost --skipWorkspaceStorageLock4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=13205⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\Program Files\Windhawk\windhawk.exe"c:\Program Files\Windhawk\windhawk.exe" -new-updates-found5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Windhawk\UI\VSCodium.exe"C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1692,i,14180950052938385084,1778421138819437386,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:4ce115a9-9edc-4ebc-a9cf-f2f85269dfee /prefetch:14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wsl.exeC:\Windows\Sysnative\wsl.exe --status4⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Executes dropped EXE
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -service1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windhawk\windhawk.exe"C:\Program Files\Windhawk\windhawk.exe" -tray-only2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gcrt2.o
libc++.dll.a
libssp_nonshared.a
libc++.dll
libunwind.dll
gcrt2.o
libd3dcompiler_35.a
scardsrv.h
txctx.h
cfloat.inc
cfloat.inc
COPYING
gcrt2.o
libc++.modules.json
libd3dcompiler_35.a
libmapi32.a
libpthread.dll.a
COPYING.MinGW-w64-runtime.txt
COPYING.MinGW-w64.txt
COPYING.winpthreads.txt
COPYING.winstorecompat.txt
windhawk.dll
windhawk.dll
engine.ini
extension.js.LICENSE.txt
DO_NOT_EDIT.txt
processExplorer.js
letterpress-hcLight.svg
windhawk.exe
windhawk.ini
Windhawk.lnk
Windhawk.lnk~RFe5b4eb9.TMP
settings.json
settings.json
argv.json
extensions.json
Network Persistent State
Network Persistent State~RFe5c7a58.TMP
the-real-index
the-real-index~RFe5bb38d.TMP
index.txt
index.txt~RFe5bb3bc.TMP
CURRENT
index
the-real-index
the-real-index~RFe5baeda.TMP
MANIFEST-000001
__PSScriptPolicyTest_ww0myxer.1a3.ps1
AccessControl.dll
ApplicationID.dll
INetC.dll
LangDLL.dll
SimpleSC.dll
System.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
default.dic
Windhawk.lnk
Windhawk.lnk~RFe5b4eb9.TMP
WindhawkRunUITask
memory/416-18064-0x00000000329D0000-0x00000000329D1000-memory.dmp
memory/636-18053-0x000000002B530000-0x000000002B531000-memory.dmp
memory/636-18057-0x00007FF8B2D80000-0x00007FF8B2D90000-memory.dmp
memory/816-18058-0x00000000140F0000-0x00000000140F1000-memory.dmp
memory/908-18060-0x00000000115E0000-0x00000000115E1000-memory.dmp
memory/980-18062-0x000000002E290000-0x000000002E291000-memory.dmp
memory/1008-18231-0x0000000033440000-0x0000000033441000-memory.dmp
memory/1028-18233-0x0000000012340000-0x0000000012341000-memory.dmp
memory/1056-18066-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/1084-18229-0x0000000025290000-0x0000000025291000-memory.dmp
memory/1108-18068-0x000000003FA60000-0x000000003FA61000-memory.dmp
memory/1120-18070-0x000000002C700000-0x000000002C701000-memory.dmp
memory/1136-18072-0x0000000012F40000-0x0000000012F41000-memory.dmp
memory/1224-18074-0x00000000064E0000-0x00000000064E1000-memory.dmp
memory/1256-18076-0x000000000FB60000-0x000000000FB61000-memory.dmp
memory/1324-18078-0x00000000282E0000-0x00000000282E1000-memory.dmp
memory/1352-18101-0x0000000029AC0000-0x0000000029AC1000-memory.dmp
memory/1396-18104-0x0000000027E80000-0x0000000027E81000-memory.dmp
memory/1548-18110-0x0000000007F00000-0x0000000007F01000-memory.dmp
memory/1580-18112-0x0000000026490000-0x0000000026491000-memory.dmp
memory/1632-18235-0x000000001CBA0000-0x000000001CBA1000-memory.dmp
memory/1652-18114-0x000000001C660000-0x000000001C661000-memory.dmp
memory/1752-18116-0x000000001FEF0000-0x000000001FEF1000-memory.dmp
memory/1760-18118-0x0000000030530000-0x0000000030531000-memory.dmp
memory/1800-18120-0x0000000009090000-0x0000000009091000-memory.dmp
memory/1828-18290-0x0000000002540000-0x0000000002576000-memory.dmp
memory/1828-18295-0x0000000005110000-0x000000000573A000-memory.dmp
memory/1828-18436-0x00000000062C0000-0x00000000062DA000-memory.dmp
memory/1828-18328-0x0000000005820000-0x0000000005886000-memory.dmp
memory/1828-18327-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/1828-18336-0x0000000005890000-0x0000000005BE7000-memory.dmp
memory/1828-18362-0x0000000005D70000-0x0000000005D8E000-memory.dmp
memory/1828-18326-0x0000000004ED0000-0x0000000004EF2000-memory.dmp
memory/1828-18364-0x0000000005DF0000-0x0000000005E3C000-memory.dmp
memory/1828-18435-0x00000000074C0000-0x0000000007B3A000-memory.dmp
memory/1856-18122-0x0000000019910000-0x0000000019911000-memory.dmp
memory/1900-18138-0x0000000029100000-0x0000000029101000-memory.dmp
memory/1988-18190-0x0000000027BA0000-0x0000000027BA1000-memory.dmp
memory/1992-18140-0x0000000003220000-0x0000000003221000-memory.dmp
memory/2040-18142-0x00000000364F0000-0x00000000364F1000-memory.dmp
memory/2076-18144-0x0000000018E80000-0x0000000018E81000-memory.dmp
memory/2100-18146-0x0000000008020000-0x0000000008021000-memory.dmp
memory/2156-18148-0x00000000133F0000-0x00000000133F1000-memory.dmp
memory/2204-18237-0x000000001F1B0000-0x000000001F1B1000-memory.dmp
memory/2208-18158-0x00000000141E0000-0x00000000141E1000-memory.dmp
memory/2360-18160-0x0000000036530000-0x0000000036531000-memory.dmp
memory/2376-18164-0x000000003A890000-0x000000003A891000-memory.dmp
memory/2436-18192-0x000000000B640000-0x000000000B641000-memory.dmp
memory/2516-18167-0x0000000038500000-0x0000000038501000-memory.dmp
memory/2652-18169-0x0000000008280000-0x0000000008281000-memory.dmp
memory/2660-18171-0x0000000029630000-0x0000000029631000-memory.dmp
memory/2700-18173-0x000000000BC00000-0x000000000BC01000-memory.dmp
memory/2760-18175-0x00000000354A0000-0x00000000354A1000-memory.dmp
memory/2768-18177-0x00000000125E0000-0x00000000125E1000-memory.dmp
memory/2784-18179-0x000000003E050000-0x000000003E051000-memory.dmp
memory/2792-18188-0x000000000BCE0000-0x000000000BCE1000-memory.dmp
memory/3036-18241-0x0000000039A90000-0x0000000039A91000-memory.dmp
memory/3176-18194-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3220-18225-0x000000002F240000-0x000000002F241000-memory.dmp
memory/3276-18239-0x0000000022D10000-0x0000000022D11000-memory.dmp
memory/3312-18196-0x0000000020950000-0x0000000020951000-memory.dmp
memory/3364-18198-0x0000000037450000-0x0000000037451000-memory.dmp
memory/3564-18205-0x00000000074A0000-0x00000000074A1000-memory.dmp
memory/3588-18208-0x0000000012170000-0x0000000012171000-memory.dmp
memory/3692-18210-0x000000003FE60000-0x000000003FE61000-memory.dmp
memory/3760-18212-0x000000002D760000-0x000000002D761000-memory.dmp
memory/3812-18214-0x0000000027190000-0x0000000027191000-memory.dmp
memory/3860-18219-0x0000000015550000-0x0000000015551000-memory.dmp
memory/3984-18034-0x0000000000840000-0x000000000095C000-memory.dmp
memory/3984-18243-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3984-18245-0x000000004E050000-0x000000004E060000-memory.dmp
memory/4148-18221-0x000000001F8D0000-0x000000001F8D1000-memory.dmp
memory/4344-18227-0x0000000013BE0000-0x0000000013BE1000-memory.dmp
memory/4440-18223-0x000000002A4A0000-0x000000002A4A1000-memory.dmp