Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-12-2021 22:37
Static task
static1
Behavioral task
behavioral1
Sample
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe
Resource
win10-en-20211014
General
-
Target
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe
-
Size
254KB
-
MD5
761be6459f9d3254d2347bb587210a55
-
SHA1
d076017d18b3d3ee13ae093503ba6971651f188b
-
SHA256
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555
-
SHA512
dc9f413307a28989b878a4eb601b4cf560bdfa112da8f29f395623e92fca0da8ae0de6b4b1c43b6b0d8c5a557f6087b4343d02044c0a3ed9979177cb216d0eb3
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2792 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3036 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2180 ipconfig.exe 2120 NETSTAT.EXE 2640 NETSTAT.EXE 828 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94F00DC6-53C0-11EC-B8A2-52576DE11831} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exepid process 2756 d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe 2756 d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2792 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2756 d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe 2792 2792 2792 2792 2792 2792 3516 explorer.exe 3516 explorer.exe 2792 2792 372 explorer.exe 372 explorer.exe 2792 2792 3632 explorer.exe 3632 explorer.exe 2792 2792 1560 explorer.exe 1560 explorer.exe 2792 2792 1300 explorer.exe 1300 explorer.exe 2792 2792 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe 1992 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe Token: SeSecurityPrivilege 1180 WMIC.exe Token: SeTakeOwnershipPrivilege 1180 WMIC.exe Token: SeLoadDriverPrivilege 1180 WMIC.exe Token: SeSystemProfilePrivilege 1180 WMIC.exe Token: SeSystemtimePrivilege 1180 WMIC.exe Token: SeProfSingleProcessPrivilege 1180 WMIC.exe Token: SeIncBasePriorityPrivilege 1180 WMIC.exe Token: SeCreatePagefilePrivilege 1180 WMIC.exe Token: SeBackupPrivilege 1180 WMIC.exe Token: SeRestorePrivilege 1180 WMIC.exe Token: SeShutdownPrivilege 1180 WMIC.exe Token: SeDebugPrivilege 1180 WMIC.exe Token: SeSystemEnvironmentPrivilege 1180 WMIC.exe Token: SeRemoteShutdownPrivilege 1180 WMIC.exe Token: SeUndockPrivilege 1180 WMIC.exe Token: SeManageVolumePrivilege 1180 WMIC.exe Token: 33 1180 WMIC.exe Token: 34 1180 WMIC.exe Token: 35 1180 WMIC.exe Token: 36 1180 WMIC.exe Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe Token: SeSecurityPrivilege 1180 WMIC.exe Token: SeTakeOwnershipPrivilege 1180 WMIC.exe Token: SeLoadDriverPrivilege 1180 WMIC.exe Token: SeSystemProfilePrivilege 1180 WMIC.exe Token: SeSystemtimePrivilege 1180 WMIC.exe Token: SeProfSingleProcessPrivilege 1180 WMIC.exe Token: SeIncBasePriorityPrivilege 1180 WMIC.exe Token: SeCreatePagefilePrivilege 1180 WMIC.exe Token: SeBackupPrivilege 1180 WMIC.exe Token: SeRestorePrivilege 1180 WMIC.exe Token: SeShutdownPrivilege 1180 WMIC.exe Token: SeDebugPrivilege 1180 WMIC.exe Token: SeSystemEnvironmentPrivilege 1180 WMIC.exe Token: SeRemoteShutdownPrivilege 1180 WMIC.exe Token: SeUndockPrivilege 1180 WMIC.exe Token: SeManageVolumePrivilege 1180 WMIC.exe Token: 33 1180 WMIC.exe Token: 34 1180 WMIC.exe Token: 35 1180 WMIC.exe Token: 36 1180 WMIC.exe Token: SeIncreaseQuotaPrivilege 2956 WMIC.exe Token: SeSecurityPrivilege 2956 WMIC.exe Token: SeTakeOwnershipPrivilege 2956 WMIC.exe Token: SeLoadDriverPrivilege 2956 WMIC.exe Token: SeSystemProfilePrivilege 2956 WMIC.exe Token: SeSystemtimePrivilege 2956 WMIC.exe Token: SeProfSingleProcessPrivilege 2956 WMIC.exe Token: SeIncBasePriorityPrivilege 2956 WMIC.exe Token: SeCreatePagefilePrivilege 2956 WMIC.exe Token: SeBackupPrivilege 2956 WMIC.exe Token: SeRestorePrivilege 2956 WMIC.exe Token: SeShutdownPrivilege 2956 WMIC.exe Token: SeDebugPrivilege 2956 WMIC.exe Token: SeSystemEnvironmentPrivilege 2956 WMIC.exe Token: SeRemoteShutdownPrivilege 2956 WMIC.exe Token: SeUndockPrivilege 2956 WMIC.exe Token: SeManageVolumePrivilege 2956 WMIC.exe Token: 33 2956 WMIC.exe Token: 34 2956 WMIC.exe Token: 35 2956 WMIC.exe Token: 36 2956 WMIC.exe Token: SeIncreaseQuotaPrivilege 2956 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3772 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3772 iexplore.exe 3772 iexplore.exe 4008 IEXPLORE.EXE 4008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2792 wrote to memory of 3764 2792 cmd.exe PID 2792 wrote to memory of 3764 2792 cmd.exe PID 3764 wrote to memory of 1180 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1180 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2956 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2956 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 64 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 64 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2740 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2740 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2408 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2408 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1788 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1788 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3456 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3456 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1780 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1780 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1292 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1292 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 4000 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 4000 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1436 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 1436 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2884 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2884 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3064 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3064 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3164 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 3164 3764 cmd.exe WMIC.exe PID 3764 wrote to memory of 2180 3764 cmd.exe ipconfig.exe PID 3764 wrote to memory of 2180 3764 cmd.exe ipconfig.exe PID 3764 wrote to memory of 2472 3764 cmd.exe ROUTE.EXE PID 3764 wrote to memory of 2472 3764 cmd.exe ROUTE.EXE PID 3764 wrote to memory of 3748 3764 cmd.exe netsh.exe PID 3764 wrote to memory of 3748 3764 cmd.exe netsh.exe PID 3764 wrote to memory of 3032 3764 cmd.exe systeminfo.exe PID 3764 wrote to memory of 3032 3764 cmd.exe systeminfo.exe PID 3764 wrote to memory of 1388 3764 cmd.exe tasklist.exe PID 3764 wrote to memory of 1388 3764 cmd.exe tasklist.exe PID 3764 wrote to memory of 1636 3764 cmd.exe net.exe PID 3764 wrote to memory of 1636 3764 cmd.exe net.exe PID 1636 wrote to memory of 2744 1636 net.exe net1.exe PID 1636 wrote to memory of 2744 1636 net.exe net1.exe PID 3764 wrote to memory of 3516 3764 cmd.exe net.exe PID 3764 wrote to memory of 3516 3764 cmd.exe net.exe PID 3516 wrote to memory of 716 3516 net.exe net1.exe PID 3516 wrote to memory of 716 3516 net.exe net1.exe PID 3764 wrote to memory of 372 3764 cmd.exe net.exe PID 3764 wrote to memory of 372 3764 cmd.exe net.exe PID 372 wrote to memory of 3548 372 net.exe net1.exe PID 372 wrote to memory of 3548 372 net.exe net1.exe PID 3764 wrote to memory of 2536 3764 cmd.exe net.exe PID 3764 wrote to memory of 2536 3764 cmd.exe net.exe PID 2536 wrote to memory of 1300 2536 net.exe net1.exe PID 2536 wrote to memory of 1300 2536 net.exe net1.exe PID 3764 wrote to memory of 2352 3764 cmd.exe net.exe PID 3764 wrote to memory of 2352 3764 cmd.exe net.exe PID 3764 wrote to memory of 1652 3764 cmd.exe net.exe PID 3764 wrote to memory of 1652 3764 cmd.exe net.exe PID 1652 wrote to memory of 1924 1652 net.exe net1.exe PID 1652 wrote to memory of 1924 1652 net.exe net1.exe PID 3764 wrote to memory of 2576 3764 cmd.exe net.exe PID 3764 wrote to memory of 2576 3764 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9122⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe"C:\Users\Admin\AppData\Local\Temp\d4145ed3b1f393f62e1350146ec305a9189baa5176dfe92531dc4a112301c555.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3772 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-125-0x0000000000000000-mapping.dmp
-
memory/372-148-0x0000000000000000-mapping.dmp
-
memory/372-229-0x0000000000000000-mapping.dmp
-
memory/372-231-0x0000000000150000-0x000000000015E000-memory.dmpFilesize
56KB
-
memory/372-230-0x0000000000160000-0x0000000000169000-memory.dmpFilesize
36KB
-
memory/508-221-0x0000000002D40000-0x0000000002DB5000-memory.dmpFilesize
468KB
-
memory/508-220-0x0000000000000000-mapping.dmp
-
memory/508-222-0x0000000002CD0000-0x0000000002D3B000-memory.dmpFilesize
428KB
-
memory/716-147-0x0000000000000000-mapping.dmp
-
memory/828-162-0x0000000000000000-mapping.dmp
-
memory/1180-123-0x0000000000000000-mapping.dmp
-
memory/1292-133-0x0000000000000000-mapping.dmp
-
memory/1300-242-0x00000000005B0000-0x00000000005BB000-memory.dmpFilesize
44KB
-
memory/1300-151-0x0000000000000000-mapping.dmp
-
memory/1300-241-0x00000000005C0000-0x00000000005C6000-memory.dmpFilesize
24KB
-
memory/1300-240-0x0000000000000000-mapping.dmp
-
memory/1388-143-0x0000000000000000-mapping.dmp
-
memory/1436-135-0x0000000000000000-mapping.dmp
-
memory/1560-238-0x0000000000CE0000-0x0000000000CEC000-memory.dmpFilesize
48KB
-
memory/1560-236-0x0000000000000000-mapping.dmp
-
memory/1560-237-0x0000000000CF0000-0x0000000000CF6000-memory.dmpFilesize
24KB
-
memory/1572-161-0x0000000000000000-mapping.dmp
-
memory/1636-144-0x0000000000000000-mapping.dmp
-
memory/1652-153-0x0000000000000000-mapping.dmp
-
memory/1780-132-0x0000000000000000-mapping.dmp
-
memory/1788-130-0x0000000000000000-mapping.dmp
-
memory/1924-154-0x0000000000000000-mapping.dmp
-
memory/1972-129-0x000001F381340000-0x000001F381342000-memory.dmpFilesize
8KB
-
memory/1972-128-0x000001F381340000-0x000001F381342000-memory.dmpFilesize
8KB
-
memory/1992-156-0x0000000000000000-mapping.dmp
-
memory/1992-245-0x0000000000AA0000-0x0000000000AAD000-memory.dmpFilesize
52KB
-
memory/1992-244-0x0000000000AB0000-0x0000000000AB7000-memory.dmpFilesize
28KB
-
memory/1992-243-0x0000000000000000-mapping.dmp
-
memory/2120-157-0x0000000000000000-mapping.dmp
-
memory/2180-139-0x0000000000000000-mapping.dmp
-
memory/2316-246-0x0000028CDE780000-0x0000028CDE781000-memory.dmpFilesize
4KB
-
memory/2324-247-0x0000023B2EA50000-0x0000023B2EA51000-memory.dmpFilesize
4KB
-
memory/2352-152-0x0000000000000000-mapping.dmp
-
memory/2408-127-0x0000000000000000-mapping.dmp
-
memory/2412-158-0x0000000000000000-mapping.dmp
-
memory/2452-248-0x000001D8D7A30000-0x000001D8D7A31000-memory.dmpFilesize
4KB
-
memory/2472-140-0x0000000000000000-mapping.dmp
-
memory/2536-150-0x0000000000000000-mapping.dmp
-
memory/2576-155-0x0000000000000000-mapping.dmp
-
memory/2640-160-0x0000000000000000-mapping.dmp
-
memory/2708-224-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/2708-225-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/2708-223-0x0000000000000000-mapping.dmp
-
memory/2740-126-0x0000000000000000-mapping.dmp
-
memory/2744-145-0x0000000000000000-mapping.dmp
-
memory/2756-115-0x0000000002CA0000-0x0000000002CA8000-memory.dmpFilesize
32KB
-
memory/2756-116-0x0000000002CC0000-0x0000000002E0A000-memory.dmpFilesize
1.3MB
-
memory/2756-117-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2792-163-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-118-0x0000000001250000-0x0000000001266000-memory.dmpFilesize
88KB
-
memory/2792-120-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-119-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-166-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-122-0x00000000014B0000-0x00000000014BF000-memory.dmpFilesize
60KB
-
memory/2792-165-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2832-159-0x0000000000000000-mapping.dmp
-
memory/2884-136-0x0000000000000000-mapping.dmp
-
memory/2956-124-0x0000000000000000-mapping.dmp
-
memory/3032-142-0x0000000000000000-mapping.dmp
-
memory/3036-252-0x000001F0FDCD0000-0x000001F0FDCD1000-memory.dmpFilesize
4KB
-
memory/3064-137-0x0000000000000000-mapping.dmp
-
memory/3164-138-0x0000000000000000-mapping.dmp
-
memory/3424-249-0x000001EE64CE0000-0x000001EE64CE1000-memory.dmpFilesize
4KB
-
memory/3456-131-0x0000000000000000-mapping.dmp
-
memory/3516-228-0x00000000003E0000-0x00000000003EB000-memory.dmpFilesize
44KB
-
memory/3516-227-0x00000000003F0000-0x00000000003F7000-memory.dmpFilesize
28KB
-
memory/3516-226-0x0000000000000000-mapping.dmp
-
memory/3516-146-0x0000000000000000-mapping.dmp
-
memory/3548-149-0x0000000000000000-mapping.dmp
-
memory/3632-233-0x0000000000000000-mapping.dmp
-
memory/3632-234-0x0000000000830000-0x0000000000835000-memory.dmpFilesize
20KB
-
memory/3632-235-0x0000000000820000-0x0000000000829000-memory.dmpFilesize
36KB
-
memory/3748-141-0x0000000000000000-mapping.dmp
-
memory/3764-121-0x0000000000000000-mapping.dmp
-
memory/3772-188-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-232-0x000001DE01F80000-0x000001DE01F81000-memory.dmpFilesize
4KB
-
memory/3772-208-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-209-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-210-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-211-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-212-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-213-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-214-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-215-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-216-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-203-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-202-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-201-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-199-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-197-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-196-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-194-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-193-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-253-0x000001DE01F90000-0x000001DE01F91000-memory.dmpFilesize
4KB
-
memory/3772-190-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-189-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-187-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-207-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-185-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-184-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-183-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-181-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-180-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-167-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-239-0x000001DE020E0000-0x000001DE020E1000-memory.dmpFilesize
4KB
-
memory/3772-179-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-177-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-176-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-175-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-174-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-173-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-172-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-171-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-169-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-168-0x00007FFCE8940000-0x00007FFCE89AB000-memory.dmpFilesize
428KB
-
memory/3772-250-0x000001DE02110000-0x000001DE02111000-memory.dmpFilesize
4KB
-
memory/3772-251-0x000001DE02110000-0x000001DE02111000-memory.dmpFilesize
4KB
-
memory/4000-134-0x0000000000000000-mapping.dmp
-
memory/4008-192-0x0000000000000000-mapping.dmp