Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-11-2021 16:32
Static task
static1
Behavioral task
behavioral1
Sample
0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe
Resource
win10-en-20211014
General
-
Target
0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe
-
Size
296KB
-
MD5
f0d7c89d9d2573a806332d24d9650164
-
SHA1
2aea6817194d84b9f9e44f73d748c1e0d9431851
-
SHA256
0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58
-
SHA512
3b9a1c860797d102aee75c633190e5f6d43239574d4fab1ecc9138f3d1b59129f97796d2889bc7709962320eec792aa2404d98d48d8e1321ebe85134a2951556
Malware Config
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
45EE.exeSmartClock.exe6771.exepid process 504 45EE.exe 1572 SmartClock.exe 1480 6771.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3020 -
Drops startup file 1 IoCs
Processes:
45EE.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 45EE.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2908 3704 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6771.exe0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6771.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6771.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 804 ipconfig.exe 1212 NETSTAT.EXE 2756 NETSTAT.EXE 900 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98D8DD81-4E0D-11EC-B8A2-EAD496D17CC8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 1572 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exepid process 2636 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe 2636 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3020 -
Suspicious behavior: MapViewOfSection 52 IoCs
Processes:
0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe6771.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2636 0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe 1480 6771.exe 3020 3020 3020 3020 3020 3020 3792 explorer.exe 3792 explorer.exe 3020 3020 3772 explorer.exe 3772 explorer.exe 3020 3020 3384 explorer.exe 3384 explorer.exe 3020 3020 900 explorer.exe 900 explorer.exe 3020 3020 1400 explorer.exe 1400 explorer.exe 1400 explorer.exe 1400 explorer.exe 3020 3020 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe 2676 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2300 WMIC.exe Token: SeSecurityPrivilege 2300 WMIC.exe Token: SeTakeOwnershipPrivilege 2300 WMIC.exe Token: SeLoadDriverPrivilege 2300 WMIC.exe Token: SeSystemProfilePrivilege 2300 WMIC.exe Token: SeSystemtimePrivilege 2300 WMIC.exe Token: SeProfSingleProcessPrivilege 2300 WMIC.exe Token: SeIncBasePriorityPrivilege 2300 WMIC.exe Token: SeCreatePagefilePrivilege 2300 WMIC.exe Token: SeBackupPrivilege 2300 WMIC.exe Token: SeRestorePrivilege 2300 WMIC.exe Token: SeShutdownPrivilege 2300 WMIC.exe Token: SeDebugPrivilege 2300 WMIC.exe Token: SeSystemEnvironmentPrivilege 2300 WMIC.exe Token: SeRemoteShutdownPrivilege 2300 WMIC.exe Token: SeUndockPrivilege 2300 WMIC.exe Token: SeManageVolumePrivilege 2300 WMIC.exe Token: 33 2300 WMIC.exe Token: 34 2300 WMIC.exe Token: 35 2300 WMIC.exe Token: 36 2300 WMIC.exe Token: SeIncreaseQuotaPrivilege 2300 WMIC.exe Token: SeSecurityPrivilege 2300 WMIC.exe Token: SeTakeOwnershipPrivilege 2300 WMIC.exe Token: SeLoadDriverPrivilege 2300 WMIC.exe Token: SeSystemProfilePrivilege 2300 WMIC.exe Token: SeSystemtimePrivilege 2300 WMIC.exe Token: SeProfSingleProcessPrivilege 2300 WMIC.exe Token: SeIncBasePriorityPrivilege 2300 WMIC.exe Token: SeCreatePagefilePrivilege 2300 WMIC.exe Token: SeBackupPrivilege 2300 WMIC.exe Token: SeRestorePrivilege 2300 WMIC.exe Token: SeShutdownPrivilege 2300 WMIC.exe Token: SeDebugPrivilege 2300 WMIC.exe Token: SeSystemEnvironmentPrivilege 2300 WMIC.exe Token: SeRemoteShutdownPrivilege 2300 WMIC.exe Token: SeUndockPrivilege 2300 WMIC.exe Token: SeManageVolumePrivilege 2300 WMIC.exe Token: 33 2300 WMIC.exe Token: 34 2300 WMIC.exe Token: 35 2300 WMIC.exe Token: 36 2300 WMIC.exe Token: SeIncreaseQuotaPrivilege 1272 WMIC.exe Token: SeSecurityPrivilege 1272 WMIC.exe Token: SeTakeOwnershipPrivilege 1272 WMIC.exe Token: SeLoadDriverPrivilege 1272 WMIC.exe Token: SeSystemProfilePrivilege 1272 WMIC.exe Token: SeSystemtimePrivilege 1272 WMIC.exe Token: SeProfSingleProcessPrivilege 1272 WMIC.exe Token: SeIncBasePriorityPrivilege 1272 WMIC.exe Token: SeCreatePagefilePrivilege 1272 WMIC.exe Token: SeBackupPrivilege 1272 WMIC.exe Token: SeRestorePrivilege 1272 WMIC.exe Token: SeShutdownPrivilege 1272 WMIC.exe Token: SeDebugPrivilege 1272 WMIC.exe Token: SeSystemEnvironmentPrivilege 1272 WMIC.exe Token: SeRemoteShutdownPrivilege 1272 WMIC.exe Token: SeUndockPrivilege 1272 WMIC.exe Token: SeManageVolumePrivilege 1272 WMIC.exe Token: 33 1272 WMIC.exe Token: 34 1272 WMIC.exe Token: 35 1272 WMIC.exe Token: 36 1272 WMIC.exe Token: SeIncreaseQuotaPrivilege 1272 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2276 iexplore.exe 2276 iexplore.exe 716 IEXPLORE.EXE 716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
45EE.execmd.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3020 wrote to memory of 504 3020 45EE.exe PID 3020 wrote to memory of 504 3020 45EE.exe PID 3020 wrote to memory of 504 3020 45EE.exe PID 504 wrote to memory of 1572 504 45EE.exe SmartClock.exe PID 504 wrote to memory of 1572 504 45EE.exe SmartClock.exe PID 504 wrote to memory of 1572 504 45EE.exe SmartClock.exe PID 3020 wrote to memory of 1480 3020 6771.exe PID 3020 wrote to memory of 1480 3020 6771.exe PID 3020 wrote to memory of 1480 3020 6771.exe PID 3020 wrote to memory of 1176 3020 cmd.exe PID 3020 wrote to memory of 1176 3020 cmd.exe PID 1176 wrote to memory of 2300 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2300 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1272 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1272 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2068 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2068 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2124 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2124 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2272 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2272 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1212 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1212 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1764 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1764 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3384 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3384 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3004 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3004 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1420 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1420 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3412 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3412 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 504 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 504 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3300 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3300 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1480 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1480 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 804 1176 cmd.exe ipconfig.exe PID 1176 wrote to memory of 804 1176 cmd.exe ipconfig.exe PID 1176 wrote to memory of 348 1176 cmd.exe ROUTE.EXE PID 1176 wrote to memory of 348 1176 cmd.exe ROUTE.EXE PID 1176 wrote to memory of 1316 1176 cmd.exe netsh.exe PID 1176 wrote to memory of 1316 1176 cmd.exe netsh.exe PID 1176 wrote to memory of 1488 1176 cmd.exe systeminfo.exe PID 1176 wrote to memory of 1488 1176 cmd.exe systeminfo.exe PID 1176 wrote to memory of 2108 1176 cmd.exe tasklist.exe PID 1176 wrote to memory of 2108 1176 cmd.exe tasklist.exe PID 1176 wrote to memory of 3256 1176 cmd.exe net.exe PID 1176 wrote to memory of 3256 1176 cmd.exe net.exe PID 3256 wrote to memory of 1628 3256 net.exe net1.exe PID 3256 wrote to memory of 1628 3256 net.exe net1.exe PID 1176 wrote to memory of 2484 1176 cmd.exe net.exe PID 1176 wrote to memory of 2484 1176 cmd.exe net.exe PID 2484 wrote to memory of 2444 2484 net.exe net1.exe PID 2484 wrote to memory of 2444 2484 net.exe net1.exe PID 1176 wrote to memory of 3584 1176 cmd.exe net.exe PID 1176 wrote to memory of 3584 1176 cmd.exe net.exe PID 3584 wrote to memory of 3692 3584 net.exe net1.exe PID 3584 wrote to memory of 3692 3584 net.exe net1.exe PID 1176 wrote to memory of 3184 1176 cmd.exe net.exe PID 1176 wrote to memory of 3184 1176 cmd.exe net.exe PID 3184 wrote to memory of 3476 3184 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3704 -s 9122⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe"C:\Users\Admin\AppData\Local\Temp\0187bdd84091d29b6ef0dd0ad8bebe7139f7207ec546e04e0ba5baa30b001b58.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\45EE.exeC:\Users\Admin\AppData\Local\Temp\45EE.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\6771.exeC:\Users\Admin\AppData\Local\Temp\6771.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\45EE.exeMD5
3dd64bad7093671bc8892602189d7ff2
SHA19e573c37bd5ccbc4ccdc20d129a7bf30bdd5ce44
SHA25669c05a508e316c42b4a911a2ef8ccf3abc6a6ffe107b4917385caf83f1dd7a9d
SHA512dbd02c12ce60e3b46d401d7a03c0d94ac84ed667de84d70d8f4c6e73894f3bbf6dce2f93d6924a079beaf537b56dccf347d4fa0ed294ec870d2f6def31270a67
-
C:\Users\Admin\AppData\Local\Temp\45EE.exeMD5
3dd64bad7093671bc8892602189d7ff2
SHA19e573c37bd5ccbc4ccdc20d129a7bf30bdd5ce44
SHA25669c05a508e316c42b4a911a2ef8ccf3abc6a6ffe107b4917385caf83f1dd7a9d
SHA512dbd02c12ce60e3b46d401d7a03c0d94ac84ed667de84d70d8f4c6e73894f3bbf6dce2f93d6924a079beaf537b56dccf347d4fa0ed294ec870d2f6def31270a67
-
C:\Users\Admin\AppData\Local\Temp\6771.exeMD5
4e041b209616fa86b0920c6b5d8198ab
SHA1cc875a81da6864681c662bd3284fda36116d95e4
SHA2562207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8
SHA5129273eef266aab14c5cd75e18769fbc2be30e83dc6edda276953646b90da7d9cb7de9d21e7c36e022fd18a1779153d1aa89a1e173cb6dea12fa41e3611cf347e7
-
C:\Users\Admin\AppData\Local\Temp\6771.exeMD5
4e041b209616fa86b0920c6b5d8198ab
SHA1cc875a81da6864681c662bd3284fda36116d95e4
SHA2562207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8
SHA5129273eef266aab14c5cd75e18769fbc2be30e83dc6edda276953646b90da7d9cb7de9d21e7c36e022fd18a1779153d1aa89a1e173cb6dea12fa41e3611cf347e7
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
3dd64bad7093671bc8892602189d7ff2
SHA19e573c37bd5ccbc4ccdc20d129a7bf30bdd5ce44
SHA25669c05a508e316c42b4a911a2ef8ccf3abc6a6ffe107b4917385caf83f1dd7a9d
SHA512dbd02c12ce60e3b46d401d7a03c0d94ac84ed667de84d70d8f4c6e73894f3bbf6dce2f93d6924a079beaf537b56dccf347d4fa0ed294ec870d2f6def31270a67
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
3dd64bad7093671bc8892602189d7ff2
SHA19e573c37bd5ccbc4ccdc20d129a7bf30bdd5ce44
SHA25669c05a508e316c42b4a911a2ef8ccf3abc6a6ffe107b4917385caf83f1dd7a9d
SHA512dbd02c12ce60e3b46d401d7a03c0d94ac84ed667de84d70d8f4c6e73894f3bbf6dce2f93d6924a079beaf537b56dccf347d4fa0ed294ec870d2f6def31270a67
-
memory/348-160-0x0000000000000000-mapping.dmp
-
memory/504-120-0x0000000000000000-mapping.dmp
-
memory/504-127-0x0000000001C20000-0x0000000001CCE000-memory.dmpFilesize
696KB
-
memory/504-128-0x0000000000400000-0x0000000001C1B000-memory.dmpFilesize
24.1MB
-
memory/504-156-0x0000000000000000-mapping.dmp
-
memory/716-212-0x0000000000000000-mapping.dmp
-
memory/772-178-0x0000000000000000-mapping.dmp
-
memory/804-159-0x0000000000000000-mapping.dmp
-
memory/900-258-0x0000000000630000-0x000000000063C000-memory.dmpFilesize
48KB
-
memory/900-256-0x0000000000000000-mapping.dmp
-
memory/900-257-0x0000000000640000-0x0000000000646000-memory.dmpFilesize
24KB
-
memory/900-182-0x0000000000000000-mapping.dmp
-
memory/1176-142-0x0000000000000000-mapping.dmp
-
memory/1212-177-0x0000000000000000-mapping.dmp
-
memory/1212-150-0x0000000000000000-mapping.dmp
-
memory/1272-144-0x0000000000000000-mapping.dmp
-
memory/1316-161-0x0000000000000000-mapping.dmp
-
memory/1400-260-0x0000000000000000-mapping.dmp
-
memory/1400-261-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1400-262-0x0000000000390000-0x000000000039B000-memory.dmpFilesize
44KB
-
memory/1420-154-0x0000000000000000-mapping.dmp
-
memory/1480-135-0x0000000001DF8000-0x0000000001E09000-memory.dmpFilesize
68KB
-
memory/1480-136-0x0000000001C10000-0x0000000001C19000-memory.dmpFilesize
36KB
-
memory/1480-137-0x0000000000400000-0x0000000001C00000-memory.dmpFilesize
24.0MB
-
memory/1480-158-0x0000000000000000-mapping.dmp
-
memory/1480-130-0x0000000000000000-mapping.dmp
-
memory/1488-162-0x0000000000000000-mapping.dmp
-
memory/1572-129-0x0000000001E68000-0x0000000001E94000-memory.dmpFilesize
176KB
-
memory/1572-263-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1572-264-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/1572-124-0x0000000000000000-mapping.dmp
-
memory/1572-133-0x0000000001C90000-0x0000000001DDA000-memory.dmpFilesize
1.3MB
-
memory/1572-134-0x0000000000400000-0x0000000001C1B000-memory.dmpFilesize
24.1MB
-
memory/1628-165-0x0000000000000000-mapping.dmp
-
memory/1764-151-0x0000000000000000-mapping.dmp
-
memory/2068-145-0x0000000000000000-mapping.dmp
-
memory/2100-181-0x0000000000000000-mapping.dmp
-
memory/2108-163-0x0000000000000000-mapping.dmp
-
memory/2124-146-0x0000000000000000-mapping.dmp
-
memory/2172-173-0x0000000000000000-mapping.dmp
-
memory/2272-147-0x0000000000000000-mapping.dmp
-
memory/2276-235-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-221-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-275-0x0000023128460000-0x0000023128461000-memory.dmpFilesize
4KB
-
memory/2276-273-0x000002312A550000-0x000002312A551000-memory.dmpFilesize
4KB
-
memory/2276-272-0x000002312A550000-0x000002312A551000-memory.dmpFilesize
4KB
-
memory/2276-259-0x000002312A4A0000-0x000002312A4A1000-memory.dmpFilesize
4KB
-
memory/2276-252-0x0000023128450000-0x0000023128451000-memory.dmpFilesize
4KB
-
memory/2276-236-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-234-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-233-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-232-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-231-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-230-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-229-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-228-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-227-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-223-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-222-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-219-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-217-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-216-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-187-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-188-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-189-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-191-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-192-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-193-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-194-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-195-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-196-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-197-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-199-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-200-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-201-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-203-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-204-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-205-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-207-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-208-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-209-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-210-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-214-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2276-213-0x00007FFB32DB0000-0x00007FFB32E1B000-memory.dmpFilesize
428KB
-
memory/2300-143-0x0000000000000000-mapping.dmp
-
memory/2336-268-0x0000017176270000-0x0000017176271000-memory.dmpFilesize
4KB
-
memory/2352-269-0x0000020688370000-0x0000020688371000-memory.dmpFilesize
4KB
-
memory/2436-175-0x0000000000000000-mapping.dmp
-
memory/2444-167-0x0000000000000000-mapping.dmp
-
memory/2472-245-0x0000000000D00000-0x0000000000D0C000-memory.dmpFilesize
48KB
-
memory/2472-244-0x0000000000D10000-0x0000000000D17000-memory.dmpFilesize
28KB
-
memory/2472-243-0x0000000000000000-mapping.dmp
-
memory/2484-166-0x0000000000000000-mapping.dmp
-
memory/2636-117-0x0000000001C00000-0x0000000001CAE000-memory.dmpFilesize
696KB
-
memory/2636-118-0x0000000000400000-0x0000000001C00000-memory.dmpFilesize
24.0MB
-
memory/2676-267-0x0000000000D10000-0x0000000000D1D000-memory.dmpFilesize
52KB
-
memory/2676-266-0x0000000000D20000-0x0000000000D27000-memory.dmpFilesize
28KB
-
memory/2676-265-0x0000000000000000-mapping.dmp
-
memory/2756-180-0x0000000000000000-mapping.dmp
-
memory/2764-270-0x0000019D687F0000-0x0000019D687F1000-memory.dmpFilesize
4KB
-
memory/2908-274-0x000002A05DDE0000-0x000002A05DDE1000-memory.dmpFilesize
4KB
-
memory/3004-153-0x0000000000000000-mapping.dmp
-
memory/3020-119-0x0000000000520000-0x0000000000536000-memory.dmpFilesize
88KB
-
memory/3020-138-0x0000000002720000-0x0000000002736000-memory.dmpFilesize
88KB
-
memory/3020-183-0x0000000004230000-0x0000000004232000-memory.dmpFilesize
8KB
-
memory/3020-186-0x0000000004230000-0x0000000004232000-memory.dmpFilesize
8KB
-
memory/3020-185-0x0000000004230000-0x0000000004232000-memory.dmpFilesize
8KB
-
memory/3020-139-0x0000000004230000-0x0000000004232000-memory.dmpFilesize
8KB
-
memory/3020-140-0x0000000004230000-0x0000000004232000-memory.dmpFilesize
8KB
-
memory/3020-141-0x00000000041A0000-0x00000000041AF000-memory.dmpFilesize
60KB
-
memory/3064-174-0x0000000000000000-mapping.dmp
-
memory/3088-148-0x0000018DD1500000-0x0000018DD1502000-memory.dmpFilesize
8KB
-
memory/3088-149-0x0000018DD1500000-0x0000018DD1502000-memory.dmpFilesize
8KB
-
memory/3184-170-0x0000000000000000-mapping.dmp
-
memory/3256-164-0x0000000000000000-mapping.dmp
-
memory/3300-157-0x0000000000000000-mapping.dmp
-
memory/3384-152-0x0000000000000000-mapping.dmp
-
memory/3384-253-0x0000000000000000-mapping.dmp
-
memory/3384-254-0x00000000003E0000-0x00000000003E5000-memory.dmpFilesize
20KB
-
memory/3384-255-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB
-
memory/3412-155-0x0000000000000000-mapping.dmp
-
memory/3468-271-0x00000227EE430000-0x00000227EE431000-memory.dmpFilesize
4KB
-
memory/3476-171-0x0000000000000000-mapping.dmp
-
memory/3568-242-0x0000000000440000-0x00000000004AB000-memory.dmpFilesize
428KB
-
memory/3568-240-0x0000000000000000-mapping.dmp
-
memory/3568-241-0x00000000004B0000-0x0000000000525000-memory.dmpFilesize
468KB
-
memory/3584-168-0x0000000000000000-mapping.dmp
-
memory/3692-169-0x0000000000000000-mapping.dmp
-
memory/3772-250-0x0000000000180000-0x0000000000189000-memory.dmpFilesize
36KB
-
memory/3772-249-0x0000000000000000-mapping.dmp
-
memory/3772-251-0x0000000000170000-0x000000000017E000-memory.dmpFilesize
56KB
-
memory/3792-247-0x0000000000550000-0x0000000000557000-memory.dmpFilesize
28KB
-
memory/3792-248-0x0000000000540000-0x000000000054B000-memory.dmpFilesize
44KB
-
memory/3792-246-0x0000000000000000-mapping.dmp
-
memory/3800-176-0x0000000000000000-mapping.dmp
-
memory/3848-179-0x0000000000000000-mapping.dmp
-
memory/3920-172-0x0000000000000000-mapping.dmp