Family: HawkEye

HawkEye is a malware kit that has seen continuous development since at least 2013.

Modifies WinLogon for persistence

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender notification settings

UAC bypass

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Disables cmd.exe use via registry modification

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Sets service image path in registry

This determines the executable launched when a service starts. It can be used to establish persistence.