Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-11-2021 16:22
Static task
static1
Behavioral task
behavioral1
Sample
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe
Resource
win10-en-20211014
General
-
Target
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe
-
Size
296KB
-
MD5
4e041b209616fa86b0920c6b5d8198ab
-
SHA1
cc875a81da6864681c662bd3284fda36116d95e4
-
SHA256
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8
-
SHA512
9273eef266aab14c5cd75e18769fbc2be30e83dc6edda276953646b90da7d9cb7de9d21e7c36e022fd18a1779153d1aa89a1e173cb6dea12fa41e3611cf347e7
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2792 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2956 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEipconfig.exeipconfig.exeNETSTAT.EXEpid process 344 NETSTAT.EXE 3704 ipconfig.exe 2340 ipconfig.exe 2280 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14B5C381-4E0C-11EC-B8A2-52576DE11831} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exepid process 1912 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe 1912 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2792 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1912 2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe 2792 2792 2792 2792 2792 2792 3548 explorer.exe 3548 explorer.exe 2792 2792 2740 explorer.exe 2740 explorer.exe 2792 2792 2260 explorer.exe 2260 explorer.exe 2792 2792 1524 explorer.exe 1524 explorer.exe 2792 2792 2116 explorer.exe 2116 explorer.exe 2792 2792 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe 2128 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe Token: SeSecurityPrivilege 2744 WMIC.exe Token: SeTakeOwnershipPrivilege 2744 WMIC.exe Token: SeLoadDriverPrivilege 2744 WMIC.exe Token: SeSystemProfilePrivilege 2744 WMIC.exe Token: SeSystemtimePrivilege 2744 WMIC.exe Token: SeProfSingleProcessPrivilege 2744 WMIC.exe Token: SeIncBasePriorityPrivilege 2744 WMIC.exe Token: SeCreatePagefilePrivilege 2744 WMIC.exe Token: SeBackupPrivilege 2744 WMIC.exe Token: SeRestorePrivilege 2744 WMIC.exe Token: SeShutdownPrivilege 2744 WMIC.exe Token: SeDebugPrivilege 2744 WMIC.exe Token: SeSystemEnvironmentPrivilege 2744 WMIC.exe Token: SeRemoteShutdownPrivilege 2744 WMIC.exe Token: SeUndockPrivilege 2744 WMIC.exe Token: SeManageVolumePrivilege 2744 WMIC.exe Token: 33 2744 WMIC.exe Token: 34 2744 WMIC.exe Token: 35 2744 WMIC.exe Token: 36 2744 WMIC.exe Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe Token: SeSecurityPrivilege 2744 WMIC.exe Token: SeTakeOwnershipPrivilege 2744 WMIC.exe Token: SeLoadDriverPrivilege 2744 WMIC.exe Token: SeSystemProfilePrivilege 2744 WMIC.exe Token: SeSystemtimePrivilege 2744 WMIC.exe Token: SeProfSingleProcessPrivilege 2744 WMIC.exe Token: SeIncBasePriorityPrivilege 2744 WMIC.exe Token: SeCreatePagefilePrivilege 2744 WMIC.exe Token: SeBackupPrivilege 2744 WMIC.exe Token: SeRestorePrivilege 2744 WMIC.exe Token: SeShutdownPrivilege 2744 WMIC.exe Token: SeDebugPrivilege 2744 WMIC.exe Token: SeSystemEnvironmentPrivilege 2744 WMIC.exe Token: SeRemoteShutdownPrivilege 2744 WMIC.exe Token: SeUndockPrivilege 2744 WMIC.exe Token: SeManageVolumePrivilege 2744 WMIC.exe Token: 33 2744 WMIC.exe Token: 34 2744 WMIC.exe Token: 35 2744 WMIC.exe Token: 36 2744 WMIC.exe Token: SeIncreaseQuotaPrivilege 2132 WMIC.exe Token: SeSecurityPrivilege 2132 WMIC.exe Token: SeTakeOwnershipPrivilege 2132 WMIC.exe Token: SeLoadDriverPrivilege 2132 WMIC.exe Token: SeSystemProfilePrivilege 2132 WMIC.exe Token: SeSystemtimePrivilege 2132 WMIC.exe Token: SeProfSingleProcessPrivilege 2132 WMIC.exe Token: SeIncBasePriorityPrivilege 2132 WMIC.exe Token: SeCreatePagefilePrivilege 2132 WMIC.exe Token: SeBackupPrivilege 2132 WMIC.exe Token: SeRestorePrivilege 2132 WMIC.exe Token: SeShutdownPrivilege 2132 WMIC.exe Token: SeDebugPrivilege 2132 WMIC.exe Token: SeSystemEnvironmentPrivilege 2132 WMIC.exe Token: SeRemoteShutdownPrivilege 2132 WMIC.exe Token: SeUndockPrivilege 2132 WMIC.exe Token: SeManageVolumePrivilege 2132 WMIC.exe Token: 33 2132 WMIC.exe Token: 34 2132 WMIC.exe Token: 35 2132 WMIC.exe Token: 36 2132 WMIC.exe Token: SeIncreaseQuotaPrivilege 2132 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1036 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1036 iexplore.exe 1036 iexplore.exe 3692 IEXPLORE.EXE 3692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2792 wrote to memory of 2952 2792 cmd.exe PID 2792 wrote to memory of 2952 2792 cmd.exe PID 2952 wrote to memory of 2744 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2744 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2132 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2132 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1144 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1144 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 676 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 676 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1648 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1648 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3324 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3324 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3500 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3500 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 816 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 816 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1368 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1368 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1592 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1592 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1964 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 1964 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3580 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3580 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3552 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3552 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3180 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3180 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 2340 2952 cmd.exe ipconfig.exe PID 2952 wrote to memory of 2340 2952 cmd.exe ipconfig.exe PID 2952 wrote to memory of 3816 2952 cmd.exe ROUTE.EXE PID 2952 wrote to memory of 3816 2952 cmd.exe ROUTE.EXE PID 2952 wrote to memory of 2004 2952 cmd.exe netsh.exe PID 2952 wrote to memory of 2004 2952 cmd.exe netsh.exe PID 2952 wrote to memory of 1872 2952 cmd.exe systeminfo.exe PID 2952 wrote to memory of 1872 2952 cmd.exe systeminfo.exe PID 2952 wrote to memory of 2660 2952 cmd.exe tasklist.exe PID 2952 wrote to memory of 2660 2952 cmd.exe tasklist.exe PID 2952 wrote to memory of 64 2952 cmd.exe net.exe PID 2952 wrote to memory of 64 2952 cmd.exe net.exe PID 64 wrote to memory of 608 64 net.exe net1.exe PID 64 wrote to memory of 608 64 net.exe net1.exe PID 2952 wrote to memory of 392 2952 cmd.exe net.exe PID 2952 wrote to memory of 392 2952 cmd.exe net.exe PID 392 wrote to memory of 716 392 net.exe net1.exe PID 392 wrote to memory of 716 392 net.exe net1.exe PID 2952 wrote to memory of 2612 2952 cmd.exe net.exe PID 2952 wrote to memory of 2612 2952 cmd.exe net.exe PID 2612 wrote to memory of 2740 2612 net.exe net1.exe PID 2612 wrote to memory of 2740 2612 net.exe net1.exe PID 2952 wrote to memory of 2260 2952 cmd.exe net.exe PID 2952 wrote to memory of 2260 2952 cmd.exe net.exe PID 2260 wrote to memory of 2352 2260 net.exe net1.exe PID 2260 wrote to memory of 2352 2260 net.exe net1.exe PID 2952 wrote to memory of 1520 2952 cmd.exe net.exe PID 2952 wrote to memory of 1520 2952 cmd.exe net.exe PID 2952 wrote to memory of 1924 2952 cmd.exe net.exe PID 2952 wrote to memory of 1924 2952 cmd.exe net.exe PID 1924 wrote to memory of 2576 1924 net.exe net1.exe PID 1924 wrote to memory of 2576 1924 net.exe net1.exe PID 2952 wrote to memory of 1684 2952 cmd.exe net.exe PID 2952 wrote to memory of 1684 2952 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9202⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe"C:\Users\Admin\AppData\Local\Temp\2207c55000374d4f885c8d58b026191dce53e71e57ffad5aa0ead6df135691b8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-144-0x0000000000000000-mapping.dmp
-
memory/344-160-0x0000000000000000-mapping.dmp
-
memory/364-225-0x00000000008E0000-0x00000000008EC000-memory.dmpFilesize
48KB
-
memory/364-224-0x00000000008F0000-0x00000000008F7000-memory.dmpFilesize
28KB
-
memory/364-223-0x0000000000000000-mapping.dmp
-
memory/392-146-0x0000000000000000-mapping.dmp
-
memory/608-145-0x0000000000000000-mapping.dmp
-
memory/676-126-0x0000000000000000-mapping.dmp
-
memory/708-222-0x0000000000160000-0x00000000001CB000-memory.dmpFilesize
428KB
-
memory/708-220-0x0000000000000000-mapping.dmp
-
memory/708-221-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/716-147-0x0000000000000000-mapping.dmp
-
memory/816-132-0x0000000000000000-mapping.dmp
-
memory/1036-209-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-174-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-250-0x000002FCF8E70000-0x000002FCF8E71000-memory.dmpFilesize
4KB
-
memory/1036-190-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-185-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-188-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-207-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-194-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-189-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-183-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-232-0x000002FCF6D60000-0x000002FCF6D61000-memory.dmpFilesize
4KB
-
memory/1036-184-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-180-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-181-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-179-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-177-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-216-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-215-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-253-0x000002FCF6D70000-0x000002FCF6D71000-memory.dmpFilesize
4KB
-
memory/1036-203-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-213-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-212-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-211-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-176-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-175-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-210-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-251-0x000002FCF8E70000-0x000002FCF8E71000-memory.dmpFilesize
4KB
-
memory/1036-193-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-208-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-239-0x000002FCF8DC0000-0x000002FCF8DC1000-memory.dmpFilesize
4KB
-
memory/1036-214-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-202-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-201-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-199-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-197-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-196-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-187-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-167-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-168-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-169-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-171-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-172-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1036-173-0x00007FFCE8FA0000-0x00007FFCE900B000-memory.dmpFilesize
428KB
-
memory/1144-125-0x0000000000000000-mapping.dmp
-
memory/1304-128-0x000001BF88F90000-0x000001BF88F92000-memory.dmpFilesize
8KB
-
memory/1304-129-0x000001BF88F90000-0x000001BF88F92000-memory.dmpFilesize
8KB
-
memory/1368-133-0x0000000000000000-mapping.dmp
-
memory/1520-152-0x0000000000000000-mapping.dmp
-
memory/1524-238-0x0000000000FF0000-0x0000000000FFC000-memory.dmpFilesize
48KB
-
memory/1524-236-0x0000000000000000-mapping.dmp
-
memory/1524-237-0x0000000001280000-0x0000000001286000-memory.dmpFilesize
24KB
-
memory/1592-134-0x0000000000000000-mapping.dmp
-
memory/1648-127-0x0000000000000000-mapping.dmp
-
memory/1684-155-0x0000000000000000-mapping.dmp
-
memory/1872-142-0x0000000000000000-mapping.dmp
-
memory/1912-117-0x0000000000400000-0x0000000001C00000-memory.dmpFilesize
24.0MB
-
memory/1912-116-0x0000000001D70000-0x0000000001D79000-memory.dmpFilesize
36KB
-
memory/1924-153-0x0000000000000000-mapping.dmp
-
memory/1964-135-0x0000000000000000-mapping.dmp
-
memory/2004-141-0x0000000000000000-mapping.dmp
-
memory/2116-241-0x0000000000720000-0x0000000000726000-memory.dmpFilesize
24KB
-
memory/2116-242-0x0000000000710000-0x000000000071B000-memory.dmpFilesize
44KB
-
memory/2116-240-0x0000000000000000-mapping.dmp
-
memory/2128-156-0x0000000000000000-mapping.dmp
-
memory/2128-245-0x0000000000AA0000-0x0000000000AAD000-memory.dmpFilesize
52KB
-
memory/2128-244-0x0000000000AB0000-0x0000000000AB7000-memory.dmpFilesize
28KB
-
memory/2128-243-0x0000000000000000-mapping.dmp
-
memory/2132-124-0x0000000000000000-mapping.dmp
-
memory/2260-150-0x0000000000000000-mapping.dmp
-
memory/2260-235-0x0000000000370000-0x0000000000379000-memory.dmpFilesize
36KB
-
memory/2260-234-0x0000000000380000-0x0000000000385000-memory.dmpFilesize
20KB
-
memory/2260-233-0x0000000000000000-mapping.dmp
-
memory/2280-157-0x0000000000000000-mapping.dmp
-
memory/2316-246-0x0000028CDE780000-0x0000028CDE781000-memory.dmpFilesize
4KB
-
memory/2324-247-0x0000023B2EA50000-0x0000023B2EA51000-memory.dmpFilesize
4KB
-
memory/2340-139-0x0000000000000000-mapping.dmp
-
memory/2352-151-0x0000000000000000-mapping.dmp
-
memory/2372-161-0x0000000000000000-mapping.dmp
-
memory/2380-158-0x0000000000000000-mapping.dmp
-
memory/2452-248-0x000001D8D7A30000-0x000001D8D7A31000-memory.dmpFilesize
4KB
-
memory/2576-154-0x0000000000000000-mapping.dmp
-
memory/2612-148-0x0000000000000000-mapping.dmp
-
memory/2660-143-0x0000000000000000-mapping.dmp
-
memory/2740-149-0x0000000000000000-mapping.dmp
-
memory/2740-229-0x0000000000000000-mapping.dmp
-
memory/2740-230-0x0000000000B70000-0x0000000000B79000-memory.dmpFilesize
36KB
-
memory/2740-231-0x0000000000B60000-0x0000000000B6E000-memory.dmpFilesize
56KB
-
memory/2744-123-0x0000000000000000-mapping.dmp
-
memory/2792-165-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-121-0x00000000014B0000-0x00000000014BF000-memory.dmpFilesize
60KB
-
memory/2792-163-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-166-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-120-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-118-0x0000000001250000-0x0000000001266000-memory.dmpFilesize
88KB
-
memory/2792-119-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2836-159-0x0000000000000000-mapping.dmp
-
memory/2952-122-0x0000000000000000-mapping.dmp
-
memory/2956-252-0x000001F0FB970000-0x000001F0FB971000-memory.dmpFilesize
4KB
-
memory/3180-138-0x0000000000000000-mapping.dmp
-
memory/3324-130-0x0000000000000000-mapping.dmp
-
memory/3424-249-0x000001EE64CE0000-0x000001EE64CE1000-memory.dmpFilesize
4KB
-
memory/3500-131-0x0000000000000000-mapping.dmp
-
memory/3548-228-0x00000000008B0000-0x00000000008BB000-memory.dmpFilesize
44KB
-
memory/3548-227-0x00000000008C0000-0x00000000008C7000-memory.dmpFilesize
28KB
-
memory/3548-226-0x0000000000000000-mapping.dmp
-
memory/3552-137-0x0000000000000000-mapping.dmp
-
memory/3580-136-0x0000000000000000-mapping.dmp
-
memory/3692-192-0x0000000000000000-mapping.dmp
-
memory/3704-162-0x0000000000000000-mapping.dmp
-
memory/3816-140-0x0000000000000000-mapping.dmp