Procedure examples

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.

Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.

Magic Hound has used Ping for discovery on targeted networks.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.

Magic Hound has used base64-encoded commands.

Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.

Magic Hound malware has obtained the victim username and sent it to the C2 server.

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.

Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.

Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.

Magic Hound has used quser.exe to identify existing RDP connections.

Magic Hound has used scheduled tasks to establish persistence and execution.

Magic Hound malware is capable of keylogging.

Magic Hound malware can list running processes.

Magic Hound has used PowerShell for execution and privilege escalation.

Magic Hound has used the command-line interface for code execution.

Magic Hound malware has used VBS scripts for execution.

Magic Hound has removed mailbox export requests from compromised Exchange servers.

Magic Hound has deleted and overwrote files to cover tracks.

Magic Hound malware has used IRC for C2.

Magic Hound has used HTTP for C2.

Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.

Magic Hound has used domain administrator accounts after dumping LSASS process memory.

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.

Magic Hound has used Powershell to discover email accounts.

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.

Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.

Magic Hound malware can use a SOAP Web service to communicate with its C2 server.

Magic Hound has downloaded additional code and files from servers onto victims.

Magic Hound has modified Registry settings for security tools.

Magic Hound malware can take a screenshot and upload the file to its C2 server.

Magic Hound has compromised email credentials in order to steal sensitive data.

Magic Hound has collected .PST archives.

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

Magic Hound has conducted watering-hole attacks through media and magazine websites.

Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.

Magic Hound has attempted to lure victims into opening malicious email attachments.

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.

Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.

Magic Hound has used multiple web shells to gain execution.