Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
03-12-2021 12:23
Static task
static1
Behavioral task
behavioral1
Sample
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe
Resource
win10-en-20211014
General
-
Target
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe
-
Size
319KB
-
MD5
eb7b5f906ecf73484d83886cf779a254
-
SHA1
dd323ccbab09005e4fd7e85d61a4f4296c0acb6e
-
SHA256
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931
-
SHA512
5e136faaa654575fc9beecf1315fd72c010e3ca6fb361d5aa38ffde6b4baa3122b3f54a7afb4548fb0b14bec7540b6fedcac5299013d1a24a352407d013e3525
Malware Config
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3008 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2648 3744 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3816 ipconfig.exe 3416 NETSTAT.EXE 4044 NETSTAT.EXE 1008 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F14AB54C-5433-11EC-B8A2-C69383DE3CCE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exepid process 1516 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe 1516 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3008 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1516 5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe 3008 3008 3008 3008 3008 3008 64 explorer.exe 64 explorer.exe 3008 3008 1836 explorer.exe 1836 explorer.exe 3008 3008 2248 explorer.exe 2248 explorer.exe 3008 3008 2116 explorer.exe 2116 explorer.exe 3008 3008 2988 explorer.exe 2988 explorer.exe 3008 3008 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe 544 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 684 WMIC.exe Token: SeSecurityPrivilege 684 WMIC.exe Token: SeTakeOwnershipPrivilege 684 WMIC.exe Token: SeLoadDriverPrivilege 684 WMIC.exe Token: SeSystemProfilePrivilege 684 WMIC.exe Token: SeSystemtimePrivilege 684 WMIC.exe Token: SeProfSingleProcessPrivilege 684 WMIC.exe Token: SeIncBasePriorityPrivilege 684 WMIC.exe Token: SeCreatePagefilePrivilege 684 WMIC.exe Token: SeBackupPrivilege 684 WMIC.exe Token: SeRestorePrivilege 684 WMIC.exe Token: SeShutdownPrivilege 684 WMIC.exe Token: SeDebugPrivilege 684 WMIC.exe Token: SeSystemEnvironmentPrivilege 684 WMIC.exe Token: SeRemoteShutdownPrivilege 684 WMIC.exe Token: SeUndockPrivilege 684 WMIC.exe Token: SeManageVolumePrivilege 684 WMIC.exe Token: 33 684 WMIC.exe Token: 34 684 WMIC.exe Token: 35 684 WMIC.exe Token: 36 684 WMIC.exe Token: SeIncreaseQuotaPrivilege 684 WMIC.exe Token: SeSecurityPrivilege 684 WMIC.exe Token: SeTakeOwnershipPrivilege 684 WMIC.exe Token: SeLoadDriverPrivilege 684 WMIC.exe Token: SeSystemProfilePrivilege 684 WMIC.exe Token: SeSystemtimePrivilege 684 WMIC.exe Token: SeProfSingleProcessPrivilege 684 WMIC.exe Token: SeIncBasePriorityPrivilege 684 WMIC.exe Token: SeCreatePagefilePrivilege 684 WMIC.exe Token: SeBackupPrivilege 684 WMIC.exe Token: SeRestorePrivilege 684 WMIC.exe Token: SeShutdownPrivilege 684 WMIC.exe Token: SeDebugPrivilege 684 WMIC.exe Token: SeSystemEnvironmentPrivilege 684 WMIC.exe Token: SeRemoteShutdownPrivilege 684 WMIC.exe Token: SeUndockPrivilege 684 WMIC.exe Token: SeManageVolumePrivilege 684 WMIC.exe Token: 33 684 WMIC.exe Token: 34 684 WMIC.exe Token: 35 684 WMIC.exe Token: 36 684 WMIC.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 344 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 344 iexplore.exe 344 iexplore.exe 3184 IEXPLORE.EXE 3184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3008 wrote to memory of 2860 3008 cmd.exe PID 3008 wrote to memory of 2860 3008 cmd.exe PID 2860 wrote to memory of 684 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 684 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1452 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1452 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 372 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 372 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 64 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 64 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 4044 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 4044 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1008 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1008 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3784 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3784 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 644 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 644 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 792 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 792 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 2128 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 2128 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 432 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 432 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3600 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3600 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3032 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3032 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1144 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 1144 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 3816 2860 cmd.exe ipconfig.exe PID 2860 wrote to memory of 3816 2860 cmd.exe ipconfig.exe PID 2860 wrote to memory of 2484 2860 cmd.exe ROUTE.EXE PID 2860 wrote to memory of 2484 2860 cmd.exe ROUTE.EXE PID 2860 wrote to memory of 2680 2860 cmd.exe netsh.exe PID 2860 wrote to memory of 2680 2860 cmd.exe netsh.exe PID 2860 wrote to memory of 2780 2860 cmd.exe systeminfo.exe PID 2860 wrote to memory of 2780 2860 cmd.exe systeminfo.exe PID 2860 wrote to memory of 1032 2860 cmd.exe tasklist.exe PID 2860 wrote to memory of 1032 2860 cmd.exe tasklist.exe PID 2860 wrote to memory of 396 2860 cmd.exe net.exe PID 2860 wrote to memory of 396 2860 cmd.exe net.exe PID 396 wrote to memory of 3404 396 net.exe net1.exe PID 396 wrote to memory of 3404 396 net.exe net1.exe PID 2860 wrote to memory of 2540 2860 cmd.exe net.exe PID 2860 wrote to memory of 2540 2860 cmd.exe net.exe PID 2540 wrote to memory of 1724 2540 net.exe net1.exe PID 2540 wrote to memory of 1724 2540 net.exe net1.exe PID 2860 wrote to memory of 680 2860 cmd.exe net.exe PID 2860 wrote to memory of 680 2860 cmd.exe net.exe PID 680 wrote to memory of 936 680 net.exe net1.exe PID 680 wrote to memory of 936 680 net.exe net1.exe PID 2860 wrote to memory of 1512 2860 cmd.exe net.exe PID 2860 wrote to memory of 1512 2860 cmd.exe net.exe PID 1512 wrote to memory of 1544 1512 net.exe net1.exe PID 1512 wrote to memory of 1544 1512 net.exe net1.exe PID 2860 wrote to memory of 1728 2860 cmd.exe net.exe PID 2860 wrote to memory of 1728 2860 cmd.exe net.exe PID 2860 wrote to memory of 2056 2860 cmd.exe net.exe PID 2860 wrote to memory of 2056 2860 cmd.exe net.exe PID 2056 wrote to memory of 1704 2056 net.exe net1.exe PID 2056 wrote to memory of 1704 2056 net.exe net1.exe PID 2860 wrote to memory of 3948 2860 cmd.exe net.exe PID 2860 wrote to memory of 3948 2860 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3744 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe"C:\Users\Admin\AppData\Local\Temp\5384e46cc252164fc0e86388e89b54d61ffb89c239aaec404005a1a0cfd4b931.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:344 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-126-0x0000000000000000-mapping.dmp
-
memory/64-226-0x0000000000000000-mapping.dmp
-
memory/64-227-0x0000000002F30000-0x0000000002F37000-memory.dmpFilesize
28KB
-
memory/64-228-0x0000000002F20000-0x0000000002F2B000-memory.dmpFilesize
44KB
-
memory/344-189-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-216-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-186-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-239-0x000001D591E20000-0x000001D591E21000-memory.dmpFilesize
4KB
-
memory/344-184-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-232-0x000001D58FDC0000-0x000001D58FDC1000-memory.dmpFilesize
4KB
-
memory/344-210-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-181-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-250-0x000001D591ED0000-0x000001D591ED1000-memory.dmpFilesize
4KB
-
memory/344-180-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-179-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-177-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-251-0x000001D591ED0000-0x000001D591ED1000-memory.dmpFilesize
4KB
-
memory/344-209-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-176-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-253-0x000001D58FDD0000-0x000001D58FDD1000-memory.dmpFilesize
4KB
-
memory/344-175-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-174-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-173-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-172-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-171-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-190-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-215-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-214-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-169-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-168-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-213-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-212-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-211-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-167-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-187-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-183-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-188-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-208-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-207-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-203-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-202-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-201-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-199-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-197-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-196-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-194-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/344-193-0x00007FFCD84A0000-0x00007FFCD850B000-memory.dmpFilesize
428KB
-
memory/368-222-0x0000000002C00000-0x0000000002C6B000-memory.dmpFilesize
428KB
-
memory/368-220-0x0000000000000000-mapping.dmp
-
memory/368-221-0x0000000002C70000-0x0000000002CE5000-memory.dmpFilesize
468KB
-
memory/372-125-0x0000000000000000-mapping.dmp
-
memory/396-144-0x0000000000000000-mapping.dmp
-
memory/432-135-0x0000000000000000-mapping.dmp
-
memory/544-245-0x0000000000F50000-0x0000000000F5D000-memory.dmpFilesize
52KB
-
memory/544-243-0x0000000000000000-mapping.dmp
-
memory/544-244-0x0000000000F60000-0x0000000000F67000-memory.dmpFilesize
28KB
-
memory/644-132-0x0000000000000000-mapping.dmp
-
memory/680-148-0x0000000000000000-mapping.dmp
-
memory/684-123-0x0000000000000000-mapping.dmp
-
memory/792-133-0x0000000000000000-mapping.dmp
-
memory/884-129-0x000002304C1E0000-0x000002304C1E2000-memory.dmpFilesize
8KB
-
memory/884-128-0x000002304C1E0000-0x000002304C1E2000-memory.dmpFilesize
8KB
-
memory/936-149-0x0000000000000000-mapping.dmp
-
memory/1008-162-0x0000000000000000-mapping.dmp
-
memory/1008-130-0x0000000000000000-mapping.dmp
-
memory/1032-143-0x0000000000000000-mapping.dmp
-
memory/1144-138-0x0000000000000000-mapping.dmp
-
memory/1300-223-0x0000000000000000-mapping.dmp
-
memory/1300-225-0x0000000000C00000-0x0000000000C0C000-memory.dmpFilesize
48KB
-
memory/1300-224-0x0000000000C10000-0x0000000000C17000-memory.dmpFilesize
28KB
-
memory/1452-124-0x0000000000000000-mapping.dmp
-
memory/1512-150-0x0000000000000000-mapping.dmp
-
memory/1516-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1516-117-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1516-115-0x0000000000701000-0x0000000000712000-memory.dmpFilesize
68KB
-
memory/1544-151-0x0000000000000000-mapping.dmp
-
memory/1704-154-0x0000000000000000-mapping.dmp
-
memory/1724-147-0x0000000000000000-mapping.dmp
-
memory/1728-152-0x0000000000000000-mapping.dmp
-
memory/1836-231-0x0000000000FD0000-0x0000000000FDE000-memory.dmpFilesize
56KB
-
memory/1836-230-0x0000000000FE0000-0x0000000000FE9000-memory.dmpFilesize
36KB
-
memory/1836-229-0x0000000000000000-mapping.dmp
-
memory/2056-153-0x0000000000000000-mapping.dmp
-
memory/2100-161-0x0000000000000000-mapping.dmp
-
memory/2116-236-0x0000000000000000-mapping.dmp
-
memory/2116-237-0x0000000000B00000-0x0000000000B06000-memory.dmpFilesize
24KB
-
memory/2116-238-0x0000000000AF0000-0x0000000000AFC000-memory.dmpFilesize
48KB
-
memory/2128-134-0x0000000000000000-mapping.dmp
-
memory/2248-235-0x0000000002BD0000-0x0000000002BD9000-memory.dmpFilesize
36KB
-
memory/2248-234-0x0000000002BE0000-0x0000000002BE5000-memory.dmpFilesize
20KB
-
memory/2248-233-0x0000000000000000-mapping.dmp
-
memory/2320-246-0x000002415B070000-0x000002415B071000-memory.dmpFilesize
4KB
-
memory/2336-247-0x0000021C423B0000-0x0000021C423B1000-memory.dmpFilesize
4KB
-
memory/2484-140-0x0000000000000000-mapping.dmp
-
memory/2492-248-0x000001D7282F0000-0x000001D7282F1000-memory.dmpFilesize
4KB
-
memory/2540-146-0x0000000000000000-mapping.dmp
-
memory/2648-252-0x0000019E76360000-0x0000019E76361000-memory.dmpFilesize
4KB
-
memory/2680-141-0x0000000000000000-mapping.dmp
-
memory/2700-158-0x0000000000000000-mapping.dmp
-
memory/2780-142-0x0000000000000000-mapping.dmp
-
memory/2860-122-0x0000000000000000-mapping.dmp
-
memory/2988-242-0x0000000002BF0000-0x0000000002BFB000-memory.dmpFilesize
44KB
-
memory/2988-241-0x0000000002E00000-0x0000000002E06000-memory.dmpFilesize
24KB
-
memory/2988-240-0x0000000000000000-mapping.dmp
-
memory/2996-156-0x0000000000000000-mapping.dmp
-
memory/3008-166-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/3008-118-0x0000000000E30000-0x0000000000E46000-memory.dmpFilesize
88KB
-
memory/3008-163-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/3008-121-0x0000000002830000-0x000000000283F000-memory.dmpFilesize
60KB
-
memory/3008-120-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/3008-119-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/3008-165-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/3032-137-0x0000000000000000-mapping.dmp
-
memory/3184-192-0x0000000000000000-mapping.dmp
-
memory/3404-145-0x0000000000000000-mapping.dmp
-
memory/3416-157-0x0000000000000000-mapping.dmp
-
memory/3464-249-0x0000019A83580000-0x0000019A83581000-memory.dmpFilesize
4KB
-
memory/3600-136-0x0000000000000000-mapping.dmp
-
memory/3724-159-0x0000000000000000-mapping.dmp
-
memory/3784-131-0x0000000000000000-mapping.dmp
-
memory/3816-139-0x0000000000000000-mapping.dmp
-
memory/3948-155-0x0000000000000000-mapping.dmp
-
memory/4044-160-0x0000000000000000-mapping.dmp
-
memory/4044-127-0x0000000000000000-mapping.dmp