Analysis
-
max time kernel
158s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
01-12-2021 16:35
Static task
static1
Behavioral task
behavioral1
Sample
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe
Resource
win10-en-20211104
General
-
Target
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe
-
Size
313KB
-
MD5
1df18eee77b7bdb425fa8079112ac215
-
SHA1
22e2b8857247c1d90c8b2d8c4abe45f17b552270
-
SHA256
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896
-
SHA512
a1e81b2acb729ba53007c65bf6949453034d44a573be7d18c6371886cb8c8626b2ef75f6ac401b0cf2b816d211f87d16440fe6d1e6873c344ddf6ca1e8089dbe
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3168 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 4648 ipconfig.exe 1660 NETSTAT.EXE 2004 NETSTAT.EXE 2244 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE09DFBE-52C4-11EC-B34F-6EDE93C6208D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exepid process 2256 c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe 2256 c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2256 c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe 396 396 396 396 396 396 4424 explorer.exe 4424 explorer.exe 396 396 904 explorer.exe 904 explorer.exe 396 396 320 explorer.exe 320 explorer.exe 396 396 1272 explorer.exe 1272 explorer.exe 396 396 1612 explorer.exe 1612 explorer.exe 396 396 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe 2212 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 436 WMIC.exe Token: SeSecurityPrivilege 436 WMIC.exe Token: SeTakeOwnershipPrivilege 436 WMIC.exe Token: SeLoadDriverPrivilege 436 WMIC.exe Token: SeSystemProfilePrivilege 436 WMIC.exe Token: SeSystemtimePrivilege 436 WMIC.exe Token: SeProfSingleProcessPrivilege 436 WMIC.exe Token: SeIncBasePriorityPrivilege 436 WMIC.exe Token: SeCreatePagefilePrivilege 436 WMIC.exe Token: SeBackupPrivilege 436 WMIC.exe Token: SeRestorePrivilege 436 WMIC.exe Token: SeShutdownPrivilege 436 WMIC.exe Token: SeDebugPrivilege 436 WMIC.exe Token: SeSystemEnvironmentPrivilege 436 WMIC.exe Token: SeRemoteShutdownPrivilege 436 WMIC.exe Token: SeUndockPrivilege 436 WMIC.exe Token: SeManageVolumePrivilege 436 WMIC.exe Token: 33 436 WMIC.exe Token: 34 436 WMIC.exe Token: 35 436 WMIC.exe Token: 36 436 WMIC.exe Token: SeIncreaseQuotaPrivilege 436 WMIC.exe Token: SeSecurityPrivilege 436 WMIC.exe Token: SeTakeOwnershipPrivilege 436 WMIC.exe Token: SeLoadDriverPrivilege 436 WMIC.exe Token: SeSystemProfilePrivilege 436 WMIC.exe Token: SeSystemtimePrivilege 436 WMIC.exe Token: SeProfSingleProcessPrivilege 436 WMIC.exe Token: SeIncBasePriorityPrivilege 436 WMIC.exe Token: SeCreatePagefilePrivilege 436 WMIC.exe Token: SeBackupPrivilege 436 WMIC.exe Token: SeRestorePrivilege 436 WMIC.exe Token: SeShutdownPrivilege 436 WMIC.exe Token: SeDebugPrivilege 436 WMIC.exe Token: SeSystemEnvironmentPrivilege 436 WMIC.exe Token: SeRemoteShutdownPrivilege 436 WMIC.exe Token: SeUndockPrivilege 436 WMIC.exe Token: SeManageVolumePrivilege 436 WMIC.exe Token: 33 436 WMIC.exe Token: 34 436 WMIC.exe Token: 35 436 WMIC.exe Token: 36 436 WMIC.exe Token: SeIncreaseQuotaPrivilege 656 WMIC.exe Token: SeSecurityPrivilege 656 WMIC.exe Token: SeTakeOwnershipPrivilege 656 WMIC.exe Token: SeLoadDriverPrivilege 656 WMIC.exe Token: SeSystemProfilePrivilege 656 WMIC.exe Token: SeSystemtimePrivilege 656 WMIC.exe Token: SeProfSingleProcessPrivilege 656 WMIC.exe Token: SeIncBasePriorityPrivilege 656 WMIC.exe Token: SeCreatePagefilePrivilege 656 WMIC.exe Token: SeBackupPrivilege 656 WMIC.exe Token: SeRestorePrivilege 656 WMIC.exe Token: SeShutdownPrivilege 656 WMIC.exe Token: SeDebugPrivilege 656 WMIC.exe Token: SeSystemEnvironmentPrivilege 656 WMIC.exe Token: SeRemoteShutdownPrivilege 656 WMIC.exe Token: SeUndockPrivilege 656 WMIC.exe Token: SeManageVolumePrivilege 656 WMIC.exe Token: 33 656 WMIC.exe Token: 34 656 WMIC.exe Token: 35 656 WMIC.exe Token: 36 656 WMIC.exe Token: SeIncreaseQuotaPrivilege 656 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2788 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2788 iexplore.exe 2788 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 396 wrote to memory of 2904 396 cmd.exe PID 396 wrote to memory of 2904 396 cmd.exe PID 2904 wrote to memory of 436 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 436 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 656 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 656 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 352 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 352 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1088 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1088 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1260 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1260 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 3120 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 3120 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4604 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4604 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1884 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1884 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4864 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4864 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1344 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 1344 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 5012 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 5012 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 2192 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 2192 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4928 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4928 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 3736 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 3736 2904 cmd.exe WMIC.exe PID 2904 wrote to memory of 4648 2904 cmd.exe ipconfig.exe PID 2904 wrote to memory of 4648 2904 cmd.exe ipconfig.exe PID 2904 wrote to memory of 4336 2904 cmd.exe ROUTE.EXE PID 2904 wrote to memory of 4336 2904 cmd.exe ROUTE.EXE PID 2904 wrote to memory of 4468 2904 cmd.exe netsh.exe PID 2904 wrote to memory of 4468 2904 cmd.exe netsh.exe PID 2904 wrote to memory of 2756 2904 cmd.exe systeminfo.exe PID 2904 wrote to memory of 2756 2904 cmd.exe systeminfo.exe PID 2904 wrote to memory of 400 2904 cmd.exe tasklist.exe PID 2904 wrote to memory of 400 2904 cmd.exe tasklist.exe PID 2904 wrote to memory of 2900 2904 cmd.exe net.exe PID 2904 wrote to memory of 2900 2904 cmd.exe net.exe PID 2900 wrote to memory of 5076 2900 net.exe net1.exe PID 2900 wrote to memory of 5076 2900 net.exe net1.exe PID 2904 wrote to memory of 4672 2904 cmd.exe net.exe PID 2904 wrote to memory of 4672 2904 cmd.exe net.exe PID 4672 wrote to memory of 4816 4672 net.exe net1.exe PID 4672 wrote to memory of 4816 4672 net.exe net1.exe PID 2904 wrote to memory of 1948 2904 cmd.exe net.exe PID 2904 wrote to memory of 1948 2904 cmd.exe net.exe PID 1948 wrote to memory of 880 1948 net.exe net1.exe PID 1948 wrote to memory of 880 1948 net.exe net1.exe PID 2904 wrote to memory of 4264 2904 cmd.exe net.exe PID 2904 wrote to memory of 4264 2904 cmd.exe net.exe PID 4264 wrote to memory of 1240 4264 net.exe net1.exe PID 4264 wrote to memory of 1240 4264 net.exe net1.exe PID 2904 wrote to memory of 4596 2904 cmd.exe net.exe PID 2904 wrote to memory of 4596 2904 cmd.exe net.exe PID 2904 wrote to memory of 1516 2904 cmd.exe net.exe PID 2904 wrote to memory of 1516 2904 cmd.exe net.exe PID 1516 wrote to memory of 1136 1516 net.exe net1.exe PID 1516 wrote to memory of 1136 1516 net.exe net1.exe PID 2904 wrote to memory of 2708 2904 cmd.exe net.exe PID 2904 wrote to memory of 2708 2904 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe"C:\Users\Admin\AppData\Local\Temp\c970962d9f99a8b0c7bb542d77fa7353379a0c576a4948f46c16039731944896.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-238-0x0000000000650000-0x0000000000659000-memory.dmpFilesize
36KB
-
memory/320-237-0x0000000000660000-0x0000000000665000-memory.dmpFilesize
20KB
-
memory/320-236-0x0000000000000000-mapping.dmp
-
memory/352-128-0x0000000000000000-mapping.dmp
-
memory/396-122-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/396-123-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/396-124-0x0000000000790000-0x000000000079F000-memory.dmpFilesize
60KB
-
memory/396-169-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/396-121-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/396-168-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/396-166-0x00000000007B0000-0x00000000007B2000-memory.dmpFilesize
8KB
-
memory/400-146-0x0000000000000000-mapping.dmp
-
memory/436-126-0x0000000000000000-mapping.dmp
-
memory/656-127-0x0000000000000000-mapping.dmp
-
memory/880-152-0x0000000000000000-mapping.dmp
-
memory/904-233-0x0000000000FF0000-0x0000000000FF9000-memory.dmpFilesize
36KB
-
memory/904-232-0x0000000000000000-mapping.dmp
-
memory/904-234-0x0000000000FE0000-0x0000000000FEE000-memory.dmpFilesize
56KB
-
memory/1088-129-0x0000000000000000-mapping.dmp
-
memory/1136-157-0x0000000000000000-mapping.dmp
-
memory/1240-154-0x0000000000000000-mapping.dmp
-
memory/1260-130-0x0000000000000000-mapping.dmp
-
memory/1272-240-0x0000000001080000-0x0000000001086000-memory.dmpFilesize
24KB
-
memory/1272-239-0x0000000000000000-mapping.dmp
-
memory/1272-241-0x0000000000DF0000-0x0000000000DFC000-memory.dmpFilesize
48KB
-
memory/1344-137-0x0000000000000000-mapping.dmp
-
memory/1516-156-0x0000000000000000-mapping.dmp
-
memory/1608-131-0x0000019C4FC70000-0x0000019C4FC72000-memory.dmpFilesize
8KB
-
memory/1608-132-0x0000019C4FC70000-0x0000019C4FC72000-memory.dmpFilesize
8KB
-
memory/1612-244-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/1612-243-0x0000000000000000-mapping.dmp
-
memory/1612-245-0x0000000000410000-0x000000000041B000-memory.dmpFilesize
44KB
-
memory/1660-160-0x0000000000000000-mapping.dmp
-
memory/1792-159-0x0000000000000000-mapping.dmp
-
memory/1884-135-0x0000000000000000-mapping.dmp
-
memory/1948-151-0x0000000000000000-mapping.dmp
-
memory/2004-163-0x0000000000000000-mapping.dmp
-
memory/2028-161-0x0000000000000000-mapping.dmp
-
memory/2192-139-0x0000000000000000-mapping.dmp
-
memory/2212-246-0x0000000000000000-mapping.dmp
-
memory/2212-247-0x0000000000390000-0x0000000000397000-memory.dmpFilesize
28KB
-
memory/2212-248-0x0000000000380000-0x000000000038D000-memory.dmpFilesize
52KB
-
memory/2244-165-0x0000000000000000-mapping.dmp
-
memory/2256-118-0x00000000007A1000-0x00000000007B2000-memory.dmpFilesize
68KB
-
memory/2256-120-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB
-
memory/2256-119-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2592-249-0x0000026D7F0A0000-0x0000026D7F0A1000-memory.dmpFilesize
4KB
-
memory/2612-250-0x000001AB3A4C0000-0x000001AB3A4C1000-memory.dmpFilesize
4KB
-
memory/2708-158-0x0000000000000000-mapping.dmp
-
memory/2756-145-0x0000000000000000-mapping.dmp
-
memory/2788-200-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-235-0x000001CFE8660000-0x000001CFE8661000-memory.dmpFilesize
4KB
-
memory/2788-171-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-172-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-174-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-175-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-176-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-177-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-178-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-179-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-180-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-182-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-183-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-184-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-186-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-187-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-189-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-190-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-191-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-192-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-193-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-256-0x000001CFE8670000-0x000001CFE8671000-memory.dmpFilesize
4KB
-
memory/2788-196-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-197-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-199-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-170-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-202-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-204-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-205-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-206-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-210-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-211-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-212-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-213-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-214-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-215-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-216-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-217-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-218-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-219-0x00007FF929ED0000-0x00007FF929F3B000-memory.dmpFilesize
428KB
-
memory/2788-254-0x000001CFEA760000-0x000001CFEA761000-memory.dmpFilesize
4KB
-
memory/2788-242-0x000001CFEA6B0000-0x000001CFEA6B1000-memory.dmpFilesize
4KB
-
memory/2788-253-0x000001CFEA760000-0x000001CFEA761000-memory.dmpFilesize
4KB
-
memory/2880-251-0x0000018C9EB20000-0x0000018C9EB21000-memory.dmpFilesize
4KB
-
memory/2900-147-0x0000000000000000-mapping.dmp
-
memory/2904-125-0x0000000000000000-mapping.dmp
-
memory/2972-195-0x0000000000000000-mapping.dmp
-
memory/3120-133-0x0000000000000000-mapping.dmp
-
memory/3168-255-0x0000028770890000-0x0000028770891000-memory.dmpFilesize
4KB
-
memory/3192-162-0x0000000000000000-mapping.dmp
-
memory/3448-252-0x0000026086800000-0x0000026086801000-memory.dmpFilesize
4KB
-
memory/3736-141-0x0000000000000000-mapping.dmp
-
memory/4016-228-0x0000000000DE0000-0x0000000000DEC000-memory.dmpFilesize
48KB
-
memory/4016-224-0x0000000000000000-mapping.dmp
-
memory/4016-227-0x0000000000DF0000-0x0000000000DF7000-memory.dmpFilesize
28KB
-
memory/4216-226-0x00000000012A0000-0x000000000130B000-memory.dmpFilesize
428KB
-
memory/4216-223-0x0000000000000000-mapping.dmp
-
memory/4216-225-0x0000000001310000-0x0000000001385000-memory.dmpFilesize
468KB
-
memory/4264-153-0x0000000000000000-mapping.dmp
-
memory/4336-143-0x0000000000000000-mapping.dmp
-
memory/4424-230-0x0000000000340000-0x0000000000347000-memory.dmpFilesize
28KB
-
memory/4424-229-0x0000000000000000-mapping.dmp
-
memory/4424-231-0x0000000000330000-0x000000000033B000-memory.dmpFilesize
44KB
-
memory/4468-144-0x0000000000000000-mapping.dmp
-
memory/4560-164-0x0000000000000000-mapping.dmp
-
memory/4596-155-0x0000000000000000-mapping.dmp
-
memory/4604-134-0x0000000000000000-mapping.dmp
-
memory/4648-142-0x0000000000000000-mapping.dmp
-
memory/4672-149-0x0000000000000000-mapping.dmp
-
memory/4816-150-0x0000000000000000-mapping.dmp
-
memory/4864-136-0x0000000000000000-mapping.dmp
-
memory/4928-140-0x0000000000000000-mapping.dmp
-
memory/5012-138-0x0000000000000000-mapping.dmp
-
memory/5076-148-0x0000000000000000-mapping.dmp