Loading malware…
Windows Credential Editor (WCE) is a publicly available, dual-use Windows security utility from Amplia Security used to extract and reuse operating-system credentials. It superseded the original Pass-the-Hash Toolkit, extending its functionality and operating-system support. Although legitimate security practitioners can use WCE, adversaries employ it during post-exploitation to steal credentials, impersonate accounts, and expand access within Windows environments.
WCE extracts credentials and password hashes from Local Security Authority Subsystem Service (LSASS) memory. It supports pass-the-hash and pass-the-ticket operations, allowing authentication with acquired credential material without recovering the original plaintext password. These capabilities facilitate lateral movement and execution under higher-privileged accounts. Credential-access operations generally require local administrator privileges, and WCE can use remote-thread creation and module loading within LSASS during credential extraction.
Documented users include APT41, APT39, APT40, BRONZE BUTLER (Tick), Cleaver, FIN6, and FIN8. Its use spans espionage and financially motivated intrusions. Tick has deployed it during post-compromise operations against Japanese technology, engineering, and media organizations. WCE is principally a post-compromise tool rather than an initial-access payload and is not tied to a single infection vector or industry.
12 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.
+6 more in the app. View in Mallory
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.
Installation of Mimikatz driver. Lets hunt it! event_id:7045 AND (event_data.ServiceName:*mimidrv* OR event_data.ImagePath:*mimidrv*)
WCE ... A record of the fact that WCESERVICE was installed and executed ... Event ID : 7045 (A service was installed in the system) ... Event ID : 7036
APT3 has used a tool to dump credentials by injecting itself into lsass.exe
CreateRemoteThread into LSASS. Sysmon events Mimikatz (lsadump::lsa /inject) lsadump PWDump6 Windows Credential Editor (WCE)
WCE ... A record of the fact that WCESERVICE was installed and executed ... Event ID : 7045 (A service was installed in the system) ... Event ID : 7036
APT3 has used a tool to dump credentials by injecting itself into lsass.exe
CreateRemoteThread into LSASS. Sysmon events Mimikatz (lsadump::lsa /inject) lsadump PWDump6 Windows Credential Editor (WCE)
「192.168.1.x-PWHashes.txt」というファイルが一時的に作成された痕跡があったとします…この特徴的な「PWHashes.txt」という文字列で…PWDumpXを実行した際に作成されるファイルであることが分かります。…サーバー上のパスワードハッシュを入手する攻撃が実行されたと推測される
Dumping authenticated users' credentials stored by Windows in the memory of the lsass.exe process. The credentials dumped in this way may include those of domain users or administrators
リモートログイン … Pass-the-hash / Pass-the-ticket … Overpass-the-hash … Diamond Ticket … ドメイン管理者権限アカウントの奪取 … Mimikatz (Golden Ticket) Mimikatz (Silver Ticket)
WCE (Remote Login) ... Remotely executes a command on another machine ... Windows Management Instrumentation ... WMIC.exe ... WmiPrvSE.exe ... random 5-digit port (WMIC)
WCE (Remote Login) pass-the-hash, pass-the-ticket ... Mimikatz (Remote Login) pass-the-hash, pass-the-ticket ... Executes a command with another user's privileges using a hash of the acquired password
リモートログイン RDP Pass-the-hash / Pass-the-ticket Mimikatz (Pass-the-Hash) WCE(リモートログイン) Overpass-the-hash
リモートログイン RDP Pass-the-hash / Pass-the-ticket Mimikatz (Pass-the-Hash) WCE(リモートログイン) Overpass-the-hash
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.