Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
03-12-2021 21:29
Static task
static1
Behavioral task
behavioral1
Sample
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe
Resource
win10-en-20211104
General
-
Target
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe
-
Size
318KB
-
MD5
4bf2cb94c866a7484ac79cf0b78b3770
-
SHA1
c79c299b07dbebf6017578f9caa2df796561c70a
-
SHA256
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10
-
SHA512
5556c78b7c24d55fd7025679fc7f67109a33a1793dba0e1a48882455253eb1a26c26fe31698edd8d20671d2d9f4857320a9a16934897e2513dc268a49b4c28a7
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3056 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3404 3640 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1396 ipconfig.exe 1744 NETSTAT.EXE 3868 NETSTAT.EXE 3484 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67BA9351-3F99-11EC-B34F-4230168DE3D5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exepid process 3452 eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe 3452 eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 3056 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3056 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3452 eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe 3056 3056 3056 3056 3056 3056 1124 explorer.exe 1124 explorer.exe 3056 3056 1116 explorer.exe 1116 explorer.exe 3056 3056 1464 explorer.exe 1464 explorer.exe 3056 3056 1104 explorer.exe 1104 explorer.exe 3056 3056 1428 explorer.exe 1428 explorer.exe 3056 3056 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe 1824 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe Token: SeIncreaseQuotaPrivilege 1448 WMIC.exe Token: SeSecurityPrivilege 1448 WMIC.exe Token: SeTakeOwnershipPrivilege 1448 WMIC.exe Token: SeLoadDriverPrivilege 1448 WMIC.exe Token: SeSystemProfilePrivilege 1448 WMIC.exe Token: SeSystemtimePrivilege 1448 WMIC.exe Token: SeProfSingleProcessPrivilege 1448 WMIC.exe Token: SeIncBasePriorityPrivilege 1448 WMIC.exe Token: SeCreatePagefilePrivilege 1448 WMIC.exe Token: SeBackupPrivilege 1448 WMIC.exe Token: SeRestorePrivilege 1448 WMIC.exe Token: SeShutdownPrivilege 1448 WMIC.exe Token: SeDebugPrivilege 1448 WMIC.exe Token: SeSystemEnvironmentPrivilege 1448 WMIC.exe Token: SeRemoteShutdownPrivilege 1448 WMIC.exe Token: SeUndockPrivilege 1448 WMIC.exe Token: SeManageVolumePrivilege 1448 WMIC.exe Token: 33 1448 WMIC.exe Token: 34 1448 WMIC.exe Token: 35 1448 WMIC.exe Token: 36 1448 WMIC.exe Token: SeIncreaseQuotaPrivilege 1448 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1968 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1968 iexplore.exe 1968 iexplore.exe 3944 IEXPLORE.EXE 3944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3056 wrote to memory of 3360 3056 cmd.exe PID 3056 wrote to memory of 3360 3056 cmd.exe PID 3360 wrote to memory of 2780 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 2780 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1448 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1448 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1256 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1256 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 720 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 720 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 2884 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 2884 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1944 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1944 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3416 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3416 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1948 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1948 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 2240 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 2240 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 484 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 484 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3096 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3096 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3860 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3860 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 840 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 840 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3052 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 3052 3360 cmd.exe WMIC.exe PID 3360 wrote to memory of 1396 3360 cmd.exe ipconfig.exe PID 3360 wrote to memory of 1396 3360 cmd.exe ipconfig.exe PID 3360 wrote to memory of 1340 3360 cmd.exe ROUTE.EXE PID 3360 wrote to memory of 1340 3360 cmd.exe ROUTE.EXE PID 3360 wrote to memory of 3768 3360 cmd.exe netsh.exe PID 3360 wrote to memory of 3768 3360 cmd.exe netsh.exe PID 3360 wrote to memory of 984 3360 cmd.exe systeminfo.exe PID 3360 wrote to memory of 984 3360 cmd.exe systeminfo.exe PID 3360 wrote to memory of 1780 3360 cmd.exe tasklist.exe PID 3360 wrote to memory of 1780 3360 cmd.exe tasklist.exe PID 3360 wrote to memory of 920 3360 cmd.exe net.exe PID 3360 wrote to memory of 920 3360 cmd.exe net.exe PID 920 wrote to memory of 1548 920 net.exe net1.exe PID 920 wrote to memory of 1548 920 net.exe net1.exe PID 3360 wrote to memory of 1492 3360 cmd.exe net.exe PID 3360 wrote to memory of 1492 3360 cmd.exe net.exe PID 1492 wrote to memory of 1568 1492 net.exe net1.exe PID 1492 wrote to memory of 1568 1492 net.exe net1.exe PID 3360 wrote to memory of 1124 3360 cmd.exe net.exe PID 3360 wrote to memory of 1124 3360 cmd.exe net.exe PID 1124 wrote to memory of 2708 1124 net.exe net1.exe PID 1124 wrote to memory of 2708 1124 net.exe net1.exe PID 3360 wrote to memory of 2288 3360 cmd.exe net.exe PID 3360 wrote to memory of 2288 3360 cmd.exe net.exe PID 2288 wrote to memory of 1104 2288 net.exe net1.exe PID 2288 wrote to memory of 1104 2288 net.exe net1.exe PID 3360 wrote to memory of 836 3360 cmd.exe net.exe PID 3360 wrote to memory of 836 3360 cmd.exe net.exe PID 3360 wrote to memory of 3396 3360 cmd.exe net.exe PID 3360 wrote to memory of 3396 3360 cmd.exe net.exe PID 3396 wrote to memory of 1404 3396 net.exe net1.exe PID 3396 wrote to memory of 1404 3396 net.exe net1.exe PID 3360 wrote to memory of 1428 3360 cmd.exe net.exe PID 3360 wrote to memory of 1428 3360 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3640 -s 9322⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe"C:\Users\Admin\AppData\Local\Temp\eb9af9bce4883f0140b54aab7a142a4e51e4e3585893f39ff58bb817298bcb10.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-137-0x0000000000000000-mapping.dmp
-
memory/608-226-0x0000000000000000-mapping.dmp
-
memory/608-227-0x0000000000890000-0x0000000000897000-memory.dmpFilesize
28KB
-
memory/608-228-0x0000000000880000-0x000000000088C000-memory.dmpFilesize
48KB
-
memory/720-129-0x0000000000000000-mapping.dmp
-
memory/836-155-0x0000000000000000-mapping.dmp
-
memory/840-140-0x0000000000000000-mapping.dmp
-
memory/920-147-0x0000000000000000-mapping.dmp
-
memory/984-145-0x0000000000000000-mapping.dmp
-
memory/1104-241-0x00000000012D0000-0x00000000012DC000-memory.dmpFilesize
48KB
-
memory/1104-239-0x0000000000000000-mapping.dmp
-
memory/1104-240-0x00000000012E0000-0x00000000012E6000-memory.dmpFilesize
24KB
-
memory/1104-154-0x0000000000000000-mapping.dmp
-
memory/1116-233-0x0000000000960000-0x0000000000969000-memory.dmpFilesize
36KB
-
memory/1116-232-0x0000000000000000-mapping.dmp
-
memory/1116-234-0x0000000000950000-0x000000000095E000-memory.dmpFilesize
56KB
-
memory/1124-151-0x0000000000000000-mapping.dmp
-
memory/1124-229-0x0000000000000000-mapping.dmp
-
memory/1124-230-0x0000000002920000-0x0000000002927000-memory.dmpFilesize
28KB
-
memory/1124-231-0x0000000002910000-0x000000000291B000-memory.dmpFilesize
44KB
-
memory/1256-128-0x0000000000000000-mapping.dmp
-
memory/1332-132-0x00000216945A0000-0x00000216945A2000-memory.dmpFilesize
8KB
-
memory/1332-131-0x00000216945A0000-0x00000216945A2000-memory.dmpFilesize
8KB
-
memory/1340-143-0x0000000000000000-mapping.dmp
-
memory/1396-142-0x0000000000000000-mapping.dmp
-
memory/1404-157-0x0000000000000000-mapping.dmp
-
memory/1428-243-0x0000000000000000-mapping.dmp
-
memory/1428-158-0x0000000000000000-mapping.dmp
-
memory/1428-245-0x00000000002C0000-0x00000000002CB000-memory.dmpFilesize
44KB
-
memory/1428-244-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/1448-127-0x0000000000000000-mapping.dmp
-
memory/1464-236-0x0000000000000000-mapping.dmp
-
memory/1464-238-0x0000000002850000-0x0000000002859000-memory.dmpFilesize
36KB
-
memory/1464-237-0x0000000002860000-0x0000000002865000-memory.dmpFilesize
20KB
-
memory/1492-149-0x0000000000000000-mapping.dmp
-
memory/1548-148-0x0000000000000000-mapping.dmp
-
memory/1568-150-0x0000000000000000-mapping.dmp
-
memory/1744-160-0x0000000000000000-mapping.dmp
-
memory/1780-146-0x0000000000000000-mapping.dmp
-
memory/1824-246-0x0000000000000000-mapping.dmp
-
memory/1824-248-0x0000000000150000-0x000000000015D000-memory.dmpFilesize
52KB
-
memory/1824-247-0x0000000000160000-0x0000000000167000-memory.dmpFilesize
28KB
-
memory/1928-164-0x0000000000000000-mapping.dmp
-
memory/1944-133-0x0000000000000000-mapping.dmp
-
memory/1948-135-0x0000000000000000-mapping.dmp
-
memory/1968-182-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-215-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-256-0x000002160CAF0000-0x000002160CAF1000-memory.dmpFilesize
4KB
-
memory/1968-254-0x000002160EBE0000-0x000002160EBE1000-memory.dmpFilesize
4KB
-
memory/1968-253-0x000002160EBE0000-0x000002160EBE1000-memory.dmpFilesize
4KB
-
memory/1968-170-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-171-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-172-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-174-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-175-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-176-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-177-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-178-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-179-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-180-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-242-0x000002160EB30000-0x000002160EB31000-memory.dmpFilesize
4KB
-
memory/1968-183-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-184-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-186-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-187-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-189-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-190-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-191-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-192-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-193-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-235-0x000002160CAE0000-0x000002160CAE1000-memory.dmpFilesize
4KB
-
memory/1968-196-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-197-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-199-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-200-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-202-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-204-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-205-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-206-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-210-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-211-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-212-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-213-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-214-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-219-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-216-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-217-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/1968-218-0x00007FFDB9BA0000-0x00007FFDB9C0B000-memory.dmpFilesize
428KB
-
memory/2060-162-0x0000000000000000-mapping.dmp
-
memory/2064-159-0x0000000000000000-mapping.dmp
-
memory/2240-136-0x0000000000000000-mapping.dmp
-
memory/2288-153-0x0000000000000000-mapping.dmp
-
memory/2548-225-0x0000000000240000-0x00000000002AB000-memory.dmpFilesize
428KB
-
memory/2548-224-0x00000000002B0000-0x0000000000325000-memory.dmpFilesize
468KB
-
memory/2548-220-0x0000000000000000-mapping.dmp
-
memory/2644-249-0x000002ADD5700000-0x000002ADD5701000-memory.dmpFilesize
4KB
-
memory/2660-250-0x000001EB9F7E0000-0x000001EB9F7E1000-memory.dmpFilesize
4KB
-
memory/2708-152-0x0000000000000000-mapping.dmp
-
memory/2780-126-0x0000000000000000-mapping.dmp
-
memory/2856-251-0x0000022816AE0000-0x0000022816AE1000-memory.dmpFilesize
4KB
-
memory/2884-130-0x0000000000000000-mapping.dmp
-
memory/3052-141-0x0000000000000000-mapping.dmp
-
memory/3056-122-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/3056-166-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/3056-168-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/3056-169-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/3056-124-0x00000000009A0000-0x00000000009AF000-memory.dmpFilesize
60KB
-
memory/3056-123-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/3056-121-0x0000000000890000-0x00000000008A6000-memory.dmpFilesize
88KB
-
memory/3096-138-0x0000000000000000-mapping.dmp
-
memory/3360-125-0x0000000000000000-mapping.dmp
-
memory/3396-156-0x0000000000000000-mapping.dmp
-
memory/3404-255-0x00000217B0650000-0x00000217B0651000-memory.dmpFilesize
4KB
-
memory/3416-134-0x0000000000000000-mapping.dmp
-
memory/3420-252-0x000001E2E55B0000-0x000001E2E55B1000-memory.dmpFilesize
4KB
-
memory/3452-120-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB
-
memory/3452-119-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3484-165-0x0000000000000000-mapping.dmp
-
memory/3572-161-0x0000000000000000-mapping.dmp
-
memory/3768-144-0x0000000000000000-mapping.dmp
-
memory/3860-139-0x0000000000000000-mapping.dmp
-
memory/3868-163-0x0000000000000000-mapping.dmp
-
memory/3944-195-0x0000000000000000-mapping.dmp