Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 22:56
Static task
static1
Behavioral task
behavioral1
Sample
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe
Resource
win10-en-20211208
General
-
Target
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe
-
Size
317KB
-
MD5
9d2468099aa2f693642790f0312f5fb1
-
SHA1
ea24e81a4314eae7abe8de96aa03844691fe1e35
-
SHA256
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543
-
SHA512
0dc4177039b797caab26a23b225a6fba1962d2302f603e7c2fa2ebea2b4f5bf9bd7e4c79af890409f5ffdfcb5e9867f0a100c5104a561502c02da9530a693432
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
4B4D.exepid process 3484 4B4D.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3068 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1040 3668 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe4B4D.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4B4D.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4B4D.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4B4D.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1540 ipconfig.exe 2528 NETSTAT.EXE 3000 NETSTAT.EXE 744 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A4644A6-7E32-11EC-9231-D241B17F579F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exepid process 2700 f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe 2700 f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3068 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe4B4D.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2700 f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe 3484 4B4D.exe 3068 3068 3068 3068 3068 3068 1664 explorer.exe 1664 explorer.exe 3068 3068 3860 explorer.exe 3860 explorer.exe 3068 3068 2096 explorer.exe 2096 explorer.exe 3068 3068 2332 explorer.exe 2332 explorer.exe 3068 3068 1352 explorer.exe 1352 explorer.exe 3068 3068 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe 3228 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2616 WMIC.exe Token: SeSecurityPrivilege 2616 WMIC.exe Token: SeTakeOwnershipPrivilege 2616 WMIC.exe Token: SeLoadDriverPrivilege 2616 WMIC.exe Token: SeSystemProfilePrivilege 2616 WMIC.exe Token: SeSystemtimePrivilege 2616 WMIC.exe Token: SeProfSingleProcessPrivilege 2616 WMIC.exe Token: SeIncBasePriorityPrivilege 2616 WMIC.exe Token: SeCreatePagefilePrivilege 2616 WMIC.exe Token: SeBackupPrivilege 2616 WMIC.exe Token: SeRestorePrivilege 2616 WMIC.exe Token: SeShutdownPrivilege 2616 WMIC.exe Token: SeDebugPrivilege 2616 WMIC.exe Token: SeSystemEnvironmentPrivilege 2616 WMIC.exe Token: SeRemoteShutdownPrivilege 2616 WMIC.exe Token: SeUndockPrivilege 2616 WMIC.exe Token: SeManageVolumePrivilege 2616 WMIC.exe Token: 33 2616 WMIC.exe Token: 34 2616 WMIC.exe Token: 35 2616 WMIC.exe Token: 36 2616 WMIC.exe Token: SeIncreaseQuotaPrivilege 2616 WMIC.exe Token: SeSecurityPrivilege 2616 WMIC.exe Token: SeTakeOwnershipPrivilege 2616 WMIC.exe Token: SeLoadDriverPrivilege 2616 WMIC.exe Token: SeSystemProfilePrivilege 2616 WMIC.exe Token: SeSystemtimePrivilege 2616 WMIC.exe Token: SeProfSingleProcessPrivilege 2616 WMIC.exe Token: SeIncBasePriorityPrivilege 2616 WMIC.exe Token: SeCreatePagefilePrivilege 2616 WMIC.exe Token: SeBackupPrivilege 2616 WMIC.exe Token: SeRestorePrivilege 2616 WMIC.exe Token: SeShutdownPrivilege 2616 WMIC.exe Token: SeDebugPrivilege 2616 WMIC.exe Token: SeSystemEnvironmentPrivilege 2616 WMIC.exe Token: SeRemoteShutdownPrivilege 2616 WMIC.exe Token: SeUndockPrivilege 2616 WMIC.exe Token: SeManageVolumePrivilege 2616 WMIC.exe Token: 33 2616 WMIC.exe Token: 34 2616 WMIC.exe Token: 35 2616 WMIC.exe Token: 36 2616 WMIC.exe Token: SeIncreaseQuotaPrivilege 3132 WMIC.exe Token: SeSecurityPrivilege 3132 WMIC.exe Token: SeTakeOwnershipPrivilege 3132 WMIC.exe Token: SeLoadDriverPrivilege 3132 WMIC.exe Token: SeSystemProfilePrivilege 3132 WMIC.exe Token: SeSystemtimePrivilege 3132 WMIC.exe Token: SeProfSingleProcessPrivilege 3132 WMIC.exe Token: SeIncBasePriorityPrivilege 3132 WMIC.exe Token: SeCreatePagefilePrivilege 3132 WMIC.exe Token: SeBackupPrivilege 3132 WMIC.exe Token: SeRestorePrivilege 3132 WMIC.exe Token: SeShutdownPrivilege 3132 WMIC.exe Token: SeDebugPrivilege 3132 WMIC.exe Token: SeSystemEnvironmentPrivilege 3132 WMIC.exe Token: SeRemoteShutdownPrivilege 3132 WMIC.exe Token: SeUndockPrivilege 3132 WMIC.exe Token: SeManageVolumePrivilege 3132 WMIC.exe Token: 33 3132 WMIC.exe Token: 34 3132 WMIC.exe Token: 35 3132 WMIC.exe Token: 36 3132 WMIC.exe Token: SeIncreaseQuotaPrivilege 3132 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 412 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 412 iexplore.exe 412 iexplore.exe 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3068 wrote to memory of 3484 3068 4B4D.exe PID 3068 wrote to memory of 3484 3068 4B4D.exe PID 3068 wrote to memory of 3484 3068 4B4D.exe PID 3068 wrote to memory of 1032 3068 cmd.exe PID 3068 wrote to memory of 1032 3068 cmd.exe PID 1032 wrote to memory of 2616 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2616 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3132 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3132 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2044 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2044 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2716 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2716 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2320 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2320 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2292 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2292 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2084 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2084 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3692 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3692 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3524 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3524 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3164 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3164 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3140 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3140 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2416 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 2416 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 1232 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 1232 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3440 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 3440 1032 cmd.exe WMIC.exe PID 1032 wrote to memory of 1540 1032 cmd.exe ipconfig.exe PID 1032 wrote to memory of 1540 1032 cmd.exe ipconfig.exe PID 1032 wrote to memory of 3688 1032 cmd.exe ROUTE.EXE PID 1032 wrote to memory of 3688 1032 cmd.exe ROUTE.EXE PID 1032 wrote to memory of 2472 1032 cmd.exe netsh.exe PID 1032 wrote to memory of 2472 1032 cmd.exe netsh.exe PID 1032 wrote to memory of 1748 1032 cmd.exe systeminfo.exe PID 1032 wrote to memory of 1748 1032 cmd.exe systeminfo.exe PID 1032 wrote to memory of 3780 1032 cmd.exe tasklist.exe PID 1032 wrote to memory of 3780 1032 cmd.exe tasklist.exe PID 1032 wrote to memory of 1656 1032 cmd.exe net.exe PID 1032 wrote to memory of 1656 1032 cmd.exe net.exe PID 1656 wrote to memory of 3684 1656 net.exe net1.exe PID 1656 wrote to memory of 3684 1656 net.exe net1.exe PID 1032 wrote to memory of 3136 1032 cmd.exe net.exe PID 1032 wrote to memory of 3136 1032 cmd.exe net.exe PID 3136 wrote to memory of 972 3136 net.exe net1.exe PID 3136 wrote to memory of 972 3136 net.exe net1.exe PID 1032 wrote to memory of 576 1032 cmd.exe net.exe PID 1032 wrote to memory of 576 1032 cmd.exe net.exe PID 576 wrote to memory of 2132 576 net.exe net1.exe PID 576 wrote to memory of 2132 576 net.exe net1.exe PID 1032 wrote to memory of 2008 1032 cmd.exe net.exe PID 1032 wrote to memory of 2008 1032 cmd.exe net.exe PID 2008 wrote to memory of 1348 2008 net.exe net1.exe PID 2008 wrote to memory of 1348 2008 net.exe net1.exe PID 1032 wrote to memory of 1372 1032 cmd.exe net.exe PID 1032 wrote to memory of 1372 1032 cmd.exe net.exe PID 1032 wrote to memory of 4016 1032 cmd.exe net.exe PID 1032 wrote to memory of 4016 1032 cmd.exe net.exe PID 4016 wrote to memory of 2300 4016 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3668 -s 9162⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe"C:\Users\Admin\AppData\Local\Temp\f0dc732a1e1f8d6e554ab36653632de8723d43a4da505c388609f5ed63816543.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4B4D.exeC:\Users\Admin\AppData\Local\Temp\4B4D.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:412 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4B4D.exeMD5
144f3b39f333e19e50d9b1fdd79ccc69
SHA10be1677f2d5b95b87588563d87a8a7b31aaf9e9e
SHA25642e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008
SHA512da2a721d78a86c371434bb42565e55a79bd542c14357ec9315af9c694e23180ccefb890b9ca451a64edc6fd924d87877d74982b6b2fdfe749e3878bc02b417c1
-
C:\Users\Admin\AppData\Local\Temp\4B4D.exeMD5
144f3b39f333e19e50d9b1fdd79ccc69
SHA10be1677f2d5b95b87588563d87a8a7b31aaf9e9e
SHA25642e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008
SHA512da2a721d78a86c371434bb42565e55a79bd542c14357ec9315af9c694e23180ccefb890b9ca451a64edc6fd924d87877d74982b6b2fdfe749e3878bc02b417c1
-
memory/1040-154-0x000001BF1DD00000-0x000001BF1DD01000-memory.dmpFilesize
4KB
-
memory/1352-146-0x0000000000170000-0x000000000017B000-memory.dmpFilesize
44KB
-
memory/1352-145-0x0000000000180000-0x0000000000186000-memory.dmpFilesize
24KB
-
memory/1664-137-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB
-
memory/1664-138-0x00000000005F0000-0x00000000005FB000-memory.dmpFilesize
44KB
-
memory/2096-141-0x0000000000DE0000-0x0000000000DE5000-memory.dmpFilesize
20KB
-
memory/2096-142-0x0000000000DD0000-0x0000000000DD9000-memory.dmpFilesize
36KB
-
memory/2332-144-0x0000000000960000-0x000000000096C000-memory.dmpFilesize
48KB
-
memory/2332-143-0x0000000000970000-0x0000000000976000-memory.dmpFilesize
24KB
-
memory/2352-149-0x0000022AD85C0000-0x0000022AD85C1000-memory.dmpFilesize
4KB
-
memory/2368-150-0x0000029045B80000-0x0000029045B81000-memory.dmpFilesize
4KB
-
memory/2700-115-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2700-117-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2700-116-0x0000000000540000-0x000000000068A000-memory.dmpFilesize
1.3MB
-
memory/2728-153-0x000002D4FECB0000-0x000002D4FECB1000-memory.dmpFilesize
4KB
-
memory/2728-151-0x000002D4FE970000-0x000002D4FE971000-memory.dmpFilesize
4KB
-
memory/3068-118-0x0000000001120000-0x0000000001136000-memory.dmpFilesize
88KB
-
memory/3068-127-0x0000000004C20000-0x0000000004C2F000-memory.dmpFilesize
60KB
-
memory/3068-124-0x0000000003020000-0x0000000003036000-memory.dmpFilesize
88KB
-
memory/3140-136-0x0000000000150000-0x000000000015C000-memory.dmpFilesize
48KB
-
memory/3228-148-0x00000000012D0000-0x00000000012DD000-memory.dmpFilesize
52KB
-
memory/3228-147-0x00000000012E0000-0x00000000012E7000-memory.dmpFilesize
28KB
-
memory/3404-152-0x00000285E3910000-0x00000285E3911000-memory.dmpFilesize
4KB
-
memory/3484-123-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3484-122-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/3484-121-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/3528-135-0x0000000000C60000-0x0000000000CCB000-memory.dmpFilesize
428KB
-
memory/3528-134-0x0000000000CD0000-0x0000000000D45000-memory.dmpFilesize
468KB
-
memory/3860-140-0x00000000006A0000-0x00000000006AE000-memory.dmpFilesize
56KB
-
memory/3860-139-0x00000000006B0000-0x00000000006B9000-memory.dmpFilesize
36KB