Analysis
-
max time kernel
158s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-12-2021 13:51
Static task
static1
Behavioral task
behavioral1
Sample
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe
Resource
win10-en-20211014
General
-
Target
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe
-
Size
244KB
-
MD5
7bffbdad938e5cab5eca0012ce1a67e3
-
SHA1
f544f516f5855e3c26c81d4adea4295bd2ab1dca
-
SHA256
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca
-
SHA512
a98b0aa274b0ddcbf58f31a149fcaaba298919a17784071579acbc218d71b7b9f0ae5d802afe3d2ba9f01c9b8faebede45a17f88d19a7c262088578111960788
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2792 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1500 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3164 ipconfig.exe 2096 NETSTAT.EXE 3888 NETSTAT.EXE 2216 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFF8E822-55DA-11EC-B8A2-52576DE11831} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exepid process 3460 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe 3460 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 2792 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2792 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3460 96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe 2792 2792 2792 2792 2792 2792 2104 explorer.exe 2104 explorer.exe 2792 2792 784 explorer.exe 784 explorer.exe 2792 2792 2884 explorer.exe 2884 explorer.exe 2792 2792 392 explorer.exe 392 explorer.exe 2792 2792 2496 explorer.exe 2496 explorer.exe 2792 2792 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe 1044 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 760 WMIC.exe Token: SeSecurityPrivilege 760 WMIC.exe Token: SeTakeOwnershipPrivilege 760 WMIC.exe Token: SeLoadDriverPrivilege 760 WMIC.exe Token: SeSystemProfilePrivilege 760 WMIC.exe Token: SeSystemtimePrivilege 760 WMIC.exe Token: SeProfSingleProcessPrivilege 760 WMIC.exe Token: SeIncBasePriorityPrivilege 760 WMIC.exe Token: SeCreatePagefilePrivilege 760 WMIC.exe Token: SeBackupPrivilege 760 WMIC.exe Token: SeRestorePrivilege 760 WMIC.exe Token: SeShutdownPrivilege 760 WMIC.exe Token: SeDebugPrivilege 760 WMIC.exe Token: SeSystemEnvironmentPrivilege 760 WMIC.exe Token: SeRemoteShutdownPrivilege 760 WMIC.exe Token: SeUndockPrivilege 760 WMIC.exe Token: SeManageVolumePrivilege 760 WMIC.exe Token: 33 760 WMIC.exe Token: 34 760 WMIC.exe Token: 35 760 WMIC.exe Token: 36 760 WMIC.exe Token: SeIncreaseQuotaPrivilege 760 WMIC.exe Token: SeSecurityPrivilege 760 WMIC.exe Token: SeTakeOwnershipPrivilege 760 WMIC.exe Token: SeLoadDriverPrivilege 760 WMIC.exe Token: SeSystemProfilePrivilege 760 WMIC.exe Token: SeSystemtimePrivilege 760 WMIC.exe Token: SeProfSingleProcessPrivilege 760 WMIC.exe Token: SeIncBasePriorityPrivilege 760 WMIC.exe Token: SeCreatePagefilePrivilege 760 WMIC.exe Token: SeBackupPrivilege 760 WMIC.exe Token: SeRestorePrivilege 760 WMIC.exe Token: SeShutdownPrivilege 760 WMIC.exe Token: SeDebugPrivilege 760 WMIC.exe Token: SeSystemEnvironmentPrivilege 760 WMIC.exe Token: SeRemoteShutdownPrivilege 760 WMIC.exe Token: SeUndockPrivilege 760 WMIC.exe Token: SeManageVolumePrivilege 760 WMIC.exe Token: 33 760 WMIC.exe Token: 34 760 WMIC.exe Token: 35 760 WMIC.exe Token: 36 760 WMIC.exe Token: SeIncreaseQuotaPrivilege 2104 WMIC.exe Token: SeSecurityPrivilege 2104 WMIC.exe Token: SeTakeOwnershipPrivilege 2104 WMIC.exe Token: SeLoadDriverPrivilege 2104 WMIC.exe Token: SeSystemProfilePrivilege 2104 WMIC.exe Token: SeSystemtimePrivilege 2104 WMIC.exe Token: SeProfSingleProcessPrivilege 2104 WMIC.exe Token: SeIncBasePriorityPrivilege 2104 WMIC.exe Token: SeCreatePagefilePrivilege 2104 WMIC.exe Token: SeBackupPrivilege 2104 WMIC.exe Token: SeRestorePrivilege 2104 WMIC.exe Token: SeShutdownPrivilege 2104 WMIC.exe Token: SeDebugPrivilege 2104 WMIC.exe Token: SeSystemEnvironmentPrivilege 2104 WMIC.exe Token: SeRemoteShutdownPrivilege 2104 WMIC.exe Token: SeUndockPrivilege 2104 WMIC.exe Token: SeManageVolumePrivilege 2104 WMIC.exe Token: 33 2104 WMIC.exe Token: 34 2104 WMIC.exe Token: 35 2104 WMIC.exe Token: 36 2104 WMIC.exe Token: SeIncreaseQuotaPrivilege 2104 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3208 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3208 iexplore.exe 3208 iexplore.exe 1352 IEXPLORE.EXE 1352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2792 wrote to memory of 1176 2792 cmd.exe PID 2792 wrote to memory of 1176 2792 cmd.exe PID 1176 wrote to memory of 760 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 760 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2104 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2104 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 424 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 424 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 976 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 976 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 4068 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 4068 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2116 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2116 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3208 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3208 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3324 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3324 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3464 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3464 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1036 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1036 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1368 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 1368 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2156 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2156 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2552 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 2552 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3576 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3576 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 3164 1176 cmd.exe ipconfig.exe PID 1176 wrote to memory of 3164 1176 cmd.exe ipconfig.exe PID 1176 wrote to memory of 3180 1176 cmd.exe ROUTE.EXE PID 1176 wrote to memory of 3180 1176 cmd.exe ROUTE.EXE PID 1176 wrote to memory of 3052 1176 cmd.exe netsh.exe PID 1176 wrote to memory of 3052 1176 cmd.exe netsh.exe PID 1176 wrote to memory of 860 1176 cmd.exe systeminfo.exe PID 1176 wrote to memory of 860 1176 cmd.exe systeminfo.exe PID 1176 wrote to memory of 3360 1176 cmd.exe tasklist.exe PID 1176 wrote to memory of 3360 1176 cmd.exe tasklist.exe PID 1176 wrote to memory of 3952 1176 cmd.exe net.exe PID 1176 wrote to memory of 3952 1176 cmd.exe net.exe PID 3952 wrote to memory of 3152 3952 net.exe net1.exe PID 3952 wrote to memory of 3152 3952 net.exe net1.exe PID 1176 wrote to memory of 784 1176 cmd.exe net.exe PID 1176 wrote to memory of 784 1176 cmd.exe net.exe PID 784 wrote to memory of 3516 784 net.exe net1.exe PID 784 wrote to memory of 3516 784 net.exe net1.exe PID 1176 wrote to memory of 3608 1176 cmd.exe net.exe PID 1176 wrote to memory of 3608 1176 cmd.exe net.exe PID 3608 wrote to memory of 708 3608 net.exe net1.exe PID 3608 wrote to memory of 708 3608 net.exe net1.exe PID 1176 wrote to memory of 2740 1176 cmd.exe net.exe PID 1176 wrote to memory of 2740 1176 cmd.exe net.exe PID 2740 wrote to memory of 3548 2740 net.exe net1.exe PID 2740 wrote to memory of 3548 2740 net.exe net1.exe PID 1176 wrote to memory of 2496 1176 cmd.exe net.exe PID 1176 wrote to memory of 2496 1176 cmd.exe net.exe PID 1176 wrote to memory of 1648 1176 cmd.exe net.exe PID 1176 wrote to memory of 1648 1176 cmd.exe net.exe PID 1648 wrote to memory of 948 1648 net.exe net1.exe PID 1648 wrote to memory of 948 1648 net.exe net1.exe PID 1176 wrote to memory of 1968 1176 cmd.exe net.exe PID 1176 wrote to memory of 1968 1176 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9042⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe"C:\Users\Admin\AppData\Local\Temp\96701798fd053c9b597459a94d5216a7381a195191c13bd3c79eb972636319ca.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3208 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-241-0x0000000000480000-0x000000000048C000-memory.dmpFilesize
48KB
-
memory/392-240-0x0000000000490000-0x0000000000496000-memory.dmpFilesize
24KB
-
memory/392-239-0x0000000000000000-mapping.dmp
-
memory/424-128-0x0000000000000000-mapping.dmp
-
memory/708-152-0x0000000000000000-mapping.dmp
-
memory/760-126-0x0000000000000000-mapping.dmp
-
memory/784-149-0x0000000000000000-mapping.dmp
-
memory/784-233-0x0000000000D20000-0x0000000000D29000-memory.dmpFilesize
36KB
-
memory/784-234-0x0000000000D10000-0x0000000000D1E000-memory.dmpFilesize
56KB
-
memory/784-232-0x0000000000000000-mapping.dmp
-
memory/860-145-0x0000000000000000-mapping.dmp
-
memory/948-157-0x0000000000000000-mapping.dmp
-
memory/976-129-0x0000000000000000-mapping.dmp
-
memory/1036-137-0x0000000000000000-mapping.dmp
-
memory/1044-248-0x0000000000810000-0x000000000081D000-memory.dmpFilesize
52KB
-
memory/1044-247-0x0000000000820000-0x0000000000827000-memory.dmpFilesize
28KB
-
memory/1044-246-0x0000000000000000-mapping.dmp
-
memory/1176-125-0x0000000000000000-mapping.dmp
-
memory/1328-164-0x0000000000000000-mapping.dmp
-
memory/1332-226-0x0000000002CD0000-0x0000000002D3B000-memory.dmpFilesize
428KB
-
memory/1332-225-0x0000000002D40000-0x0000000002DB5000-memory.dmpFilesize
468KB
-
memory/1332-223-0x0000000000000000-mapping.dmp
-
memory/1352-195-0x0000000000000000-mapping.dmp
-
memory/1368-138-0x0000000000000000-mapping.dmp
-
memory/1392-162-0x0000000000000000-mapping.dmp
-
memory/1500-255-0x0000016D80450000-0x0000016D80451000-memory.dmpFilesize
4KB
-
memory/1648-156-0x0000000000000000-mapping.dmp
-
memory/1968-158-0x0000000000000000-mapping.dmp
-
memory/1992-161-0x0000000000000000-mapping.dmp
-
memory/2096-160-0x0000000000000000-mapping.dmp
-
memory/2104-127-0x0000000000000000-mapping.dmp
-
memory/2104-229-0x0000000000000000-mapping.dmp
-
memory/2104-230-0x00000000032F0000-0x00000000032F7000-memory.dmpFilesize
28KB
-
memory/2104-231-0x00000000032E0000-0x00000000032EB000-memory.dmpFilesize
44KB
-
memory/2116-133-0x0000000000000000-mapping.dmp
-
memory/2156-139-0x0000000000000000-mapping.dmp
-
memory/2204-224-0x0000000000000000-mapping.dmp
-
memory/2204-227-0x00000000008F0000-0x00000000008F7000-memory.dmpFilesize
28KB
-
memory/2204-228-0x00000000008E0000-0x00000000008EC000-memory.dmpFilesize
48KB
-
memory/2216-165-0x0000000000000000-mapping.dmp
-
memory/2316-249-0x0000028CDE780000-0x0000028CDE781000-memory.dmpFilesize
4KB
-
memory/2324-250-0x0000023B2EA50000-0x0000023B2EA51000-memory.dmpFilesize
4KB
-
memory/2452-251-0x000001D8D7A30000-0x000001D8D7A31000-memory.dmpFilesize
4KB
-
memory/2496-155-0x0000000000000000-mapping.dmp
-
memory/2496-245-0x0000000002F70000-0x0000000002F7B000-memory.dmpFilesize
44KB
-
memory/2496-243-0x0000000000000000-mapping.dmp
-
memory/2496-244-0x0000000002F80000-0x0000000002F86000-memory.dmpFilesize
24KB
-
memory/2528-159-0x0000000000000000-mapping.dmp
-
memory/2552-140-0x0000000000000000-mapping.dmp
-
memory/2740-153-0x0000000000000000-mapping.dmp
-
memory/2792-122-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-124-0x00000000014B0000-0x00000000014BF000-memory.dmpFilesize
60KB
-
memory/2792-169-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-123-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-168-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-166-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/2792-121-0x0000000001250000-0x0000000001266000-memory.dmpFilesize
88KB
-
memory/2884-236-0x0000000000000000-mapping.dmp
-
memory/2884-237-0x0000000002DE0000-0x0000000002DE5000-memory.dmpFilesize
20KB
-
memory/2884-238-0x0000000002DD0000-0x0000000002DD9000-memory.dmpFilesize
36KB
-
memory/2964-131-0x0000026C43EC0000-0x0000026C43EC2000-memory.dmpFilesize
8KB
-
memory/2964-132-0x0000026C43EC0000-0x0000026C43EC2000-memory.dmpFilesize
8KB
-
memory/3052-144-0x0000000000000000-mapping.dmp
-
memory/3152-148-0x0000000000000000-mapping.dmp
-
memory/3164-142-0x0000000000000000-mapping.dmp
-
memory/3180-143-0x0000000000000000-mapping.dmp
-
memory/3208-178-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-193-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-186-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-192-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-177-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-184-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-196-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-197-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-199-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-200-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-202-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-204-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-205-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-206-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-210-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-211-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-212-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-213-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-214-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-215-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-216-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-217-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-218-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-219-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-176-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-182-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-180-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-179-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-191-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-190-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-183-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-175-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-174-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-172-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-171-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-170-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-235-0x0000018580650000-0x0000018580651000-memory.dmpFilesize
4KB
-
memory/3208-256-0x0000018580660000-0x0000018580661000-memory.dmpFilesize
4KB
-
memory/3208-254-0x00000185807E0000-0x00000185807E1000-memory.dmpFilesize
4KB
-
memory/3208-253-0x00000185807E0000-0x00000185807E1000-memory.dmpFilesize
4KB
-
memory/3208-134-0x0000000000000000-mapping.dmp
-
memory/3208-187-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-188-0x00007FFCE89D0000-0x00007FFCE8A3B000-memory.dmpFilesize
428KB
-
memory/3208-242-0x00000185807B0000-0x00000185807B1000-memory.dmpFilesize
4KB
-
memory/3324-135-0x0000000000000000-mapping.dmp
-
memory/3360-146-0x0000000000000000-mapping.dmp
-
memory/3424-252-0x000001EE64CE0000-0x000001EE64CE1000-memory.dmpFilesize
4KB
-
memory/3460-118-0x0000000002CA0000-0x0000000002CA8000-memory.dmpFilesize
32KB
-
memory/3460-119-0x0000000002CC0000-0x0000000002E0A000-memory.dmpFilesize
1.3MB
-
memory/3460-120-0x0000000000400000-0x0000000002B76000-memory.dmpFilesize
39.5MB
-
memory/3464-136-0x0000000000000000-mapping.dmp
-
memory/3516-150-0x0000000000000000-mapping.dmp
-
memory/3548-154-0x0000000000000000-mapping.dmp
-
memory/3576-141-0x0000000000000000-mapping.dmp
-
memory/3608-151-0x0000000000000000-mapping.dmp
-
memory/3888-163-0x0000000000000000-mapping.dmp
-
memory/3952-147-0x0000000000000000-mapping.dmp
-
memory/4068-130-0x0000000000000000-mapping.dmp