Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe
Resource
win10-en-20211208
General
-
Target
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe
-
Size
317KB
-
MD5
fbae031469cbd507a050b883c31d00e9
-
SHA1
3867f0fcffa7a8e26545155e2086b617276b9923
-
SHA256
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1
-
SHA512
cae9878d39fdf7e2d16dab4884fcdbdf689b76f86e518c1587012820860471d179931ded9edec27b0102085cd77a3c85e22124464bbcaaa2ababc1644f6a38ca
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
C0BC.exewcgwswgpid process 1440 C0BC.exe 3224 wcgwswg -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 3768 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exeC0BC.exewcgwswgdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C0BC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wcgwswg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wcgwswg Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C0BC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C0BC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wcgwswg -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2100 ipconfig.exe 628 NETSTAT.EXE 2440 NETSTAT.EXE 1340 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E9D0937-5A9A-11EC-876A-CAC7FE7A08DC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exepid process 2060 c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe 2060 c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 49 IoCs
Processes:
c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exeC0BC.exewcgwswgexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2060 c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe 1440 C0BC.exe 3224 wcgwswg 3064 3064 3064 3064 3064 3064 3480 explorer.exe 3480 explorer.exe 3064 3064 3860 explorer.exe 3860 explorer.exe 3064 3064 2624 explorer.exe 2624 explorer.exe 3064 3064 3908 explorer.exe 3908 explorer.exe 3064 3064 3940 explorer.exe 3940 explorer.exe 3064 3064 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe Token: SeSecurityPrivilege 1724 WMIC.exe Token: SeTakeOwnershipPrivilege 1724 WMIC.exe Token: SeLoadDriverPrivilege 1724 WMIC.exe Token: SeSystemProfilePrivilege 1724 WMIC.exe Token: SeSystemtimePrivilege 1724 WMIC.exe Token: SeProfSingleProcessPrivilege 1724 WMIC.exe Token: SeIncBasePriorityPrivilege 1724 WMIC.exe Token: SeCreatePagefilePrivilege 1724 WMIC.exe Token: SeBackupPrivilege 1724 WMIC.exe Token: SeRestorePrivilege 1724 WMIC.exe Token: SeShutdownPrivilege 1724 WMIC.exe Token: SeDebugPrivilege 1724 WMIC.exe Token: SeSystemEnvironmentPrivilege 1724 WMIC.exe Token: SeRemoteShutdownPrivilege 1724 WMIC.exe Token: SeUndockPrivilege 1724 WMIC.exe Token: SeManageVolumePrivilege 1724 WMIC.exe Token: 33 1724 WMIC.exe Token: 34 1724 WMIC.exe Token: 35 1724 WMIC.exe Token: 36 1724 WMIC.exe Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe Token: SeSecurityPrivilege 1724 WMIC.exe Token: SeTakeOwnershipPrivilege 1724 WMIC.exe Token: SeLoadDriverPrivilege 1724 WMIC.exe Token: SeSystemProfilePrivilege 1724 WMIC.exe Token: SeSystemtimePrivilege 1724 WMIC.exe Token: SeProfSingleProcessPrivilege 1724 WMIC.exe Token: SeIncBasePriorityPrivilege 1724 WMIC.exe Token: SeCreatePagefilePrivilege 1724 WMIC.exe Token: SeBackupPrivilege 1724 WMIC.exe Token: SeRestorePrivilege 1724 WMIC.exe Token: SeShutdownPrivilege 1724 WMIC.exe Token: SeDebugPrivilege 1724 WMIC.exe Token: SeSystemEnvironmentPrivilege 1724 WMIC.exe Token: SeRemoteShutdownPrivilege 1724 WMIC.exe Token: SeUndockPrivilege 1724 WMIC.exe Token: SeManageVolumePrivilege 1724 WMIC.exe Token: 33 1724 WMIC.exe Token: 34 1724 WMIC.exe Token: 35 1724 WMIC.exe Token: 36 1724 WMIC.exe Token: SeIncreaseQuotaPrivilege 1512 WMIC.exe Token: SeSecurityPrivilege 1512 WMIC.exe Token: SeTakeOwnershipPrivilege 1512 WMIC.exe Token: SeLoadDriverPrivilege 1512 WMIC.exe Token: SeSystemProfilePrivilege 1512 WMIC.exe Token: SeSystemtimePrivilege 1512 WMIC.exe Token: SeProfSingleProcessPrivilege 1512 WMIC.exe Token: SeIncBasePriorityPrivilege 1512 WMIC.exe Token: SeCreatePagefilePrivilege 1512 WMIC.exe Token: SeBackupPrivilege 1512 WMIC.exe Token: SeRestorePrivilege 1512 WMIC.exe Token: SeShutdownPrivilege 1512 WMIC.exe Token: SeDebugPrivilege 1512 WMIC.exe Token: SeSystemEnvironmentPrivilege 1512 WMIC.exe Token: SeRemoteShutdownPrivilege 1512 WMIC.exe Token: SeUndockPrivilege 1512 WMIC.exe Token: SeManageVolumePrivilege 1512 WMIC.exe Token: 33 1512 WMIC.exe Token: 34 1512 WMIC.exe Token: 35 1512 WMIC.exe Token: 36 1512 WMIC.exe Token: SeIncreaseQuotaPrivilege 1512 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2404 iexplore.exe 2404 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3064 wrote to memory of 1440 3064 C0BC.exe PID 3064 wrote to memory of 1440 3064 C0BC.exe PID 3064 wrote to memory of 1440 3064 C0BC.exe PID 3064 wrote to memory of 736 3064 cmd.exe PID 3064 wrote to memory of 736 3064 cmd.exe PID 736 wrote to memory of 1724 736 cmd.exe WMIC.exe PID 736 wrote to memory of 1724 736 cmd.exe WMIC.exe PID 736 wrote to memory of 1512 736 cmd.exe WMIC.exe PID 736 wrote to memory of 1512 736 cmd.exe WMIC.exe PID 736 wrote to memory of 60 736 cmd.exe WMIC.exe PID 736 wrote to memory of 60 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2132 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2132 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2508 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2508 736 cmd.exe WMIC.exe PID 736 wrote to memory of 956 736 cmd.exe WMIC.exe PID 736 wrote to memory of 956 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3640 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3640 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3624 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3624 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3148 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3148 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3428 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3428 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3480 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3480 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3656 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3656 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2624 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2624 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3876 736 cmd.exe WMIC.exe PID 736 wrote to memory of 3876 736 cmd.exe WMIC.exe PID 736 wrote to memory of 2100 736 cmd.exe ipconfig.exe PID 736 wrote to memory of 2100 736 cmd.exe ipconfig.exe PID 736 wrote to memory of 3208 736 cmd.exe ROUTE.EXE PID 736 wrote to memory of 3208 736 cmd.exe ROUTE.EXE PID 736 wrote to memory of 2060 736 cmd.exe netsh.exe PID 736 wrote to memory of 2060 736 cmd.exe netsh.exe PID 736 wrote to memory of 1192 736 cmd.exe systeminfo.exe PID 736 wrote to memory of 1192 736 cmd.exe systeminfo.exe PID 736 wrote to memory of 3152 736 cmd.exe tasklist.exe PID 736 wrote to memory of 3152 736 cmd.exe tasklist.exe PID 736 wrote to memory of 3704 736 cmd.exe net.exe PID 736 wrote to memory of 3704 736 cmd.exe net.exe PID 3704 wrote to memory of 3368 3704 net.exe net1.exe PID 3704 wrote to memory of 3368 3704 net.exe net1.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 736 wrote to memory of 1732 736 cmd.exe net.exe PID 1732 wrote to memory of 2824 1732 net.exe net1.exe PID 1732 wrote to memory of 2824 1732 net.exe net1.exe PID 736 wrote to memory of 1588 736 cmd.exe net.exe PID 736 wrote to memory of 1588 736 cmd.exe net.exe PID 1588 wrote to memory of 2836 1588 net.exe net1.exe PID 1588 wrote to memory of 2836 1588 net.exe net1.exe PID 736 wrote to memory of 3960 736 cmd.exe net.exe PID 736 wrote to memory of 3960 736 cmd.exe net.exe PID 3960 wrote to memory of 2400 3960 net.exe net1.exe PID 3960 wrote to memory of 2400 3960 net.exe net1.exe PID 736 wrote to memory of 2312 736 cmd.exe net.exe PID 736 wrote to memory of 2312 736 cmd.exe net.exe PID 736 wrote to memory of 4020 736 cmd.exe net.exe PID 736 wrote to memory of 4020 736 cmd.exe net.exe PID 4020 wrote to memory of 2380 4020 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2372
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2352
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2484
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3280
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3504
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3296
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3768
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3768 -s 9242⤵
- Program crash
PID:2988
-
C:\Users\Admin\AppData\Local\Temp\c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe"C:\Users\Admin\AppData\Local\Temp\c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2060
-
C:\Users\Admin\AppData\Local\Temp\C0BC.exeC:\Users\Admin\AppData\Local\Temp\C0BC.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1440
-
C:\Users\Admin\AppData\Roaming\wcgwswgC:\Users\Admin\AppData\Roaming\wcgwswg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3224
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵PID:60
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵PID:2132
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵PID:2508
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵PID:956
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵PID:3640
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵PID:3624
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵PID:3148
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵PID:3428
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵PID:3480
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵PID:3656
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵PID:2624
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵PID:3876
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
PID:2100 -
C:\Windows\system32\ROUTE.EXEroute print2⤵PID:3208
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵PID:2060
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:1192 -
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
PID:3152 -
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵PID:3368
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵PID:2824
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵PID:2836
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵PID:2400
-
C:\Windows\system32\net.exenet use2⤵PID:2312
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵PID:2380
-
C:\Windows\system32\net.exenet localgroup2⤵PID:1820
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵PID:2448
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
PID:628 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵PID:440
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵PID:1580
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
PID:2440 -
C:\Windows\system32\schtasks.exeschtasks /query2⤵PID:964
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:1340
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:1704
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2784
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1768
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3480
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:2624
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3908
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3940
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:3856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\C0BC.exeMD5
469e391a2cade8cac9a0ca180ee3c51d
SHA106e2492ffe14cbc47a85d112e556d32403c7c53b
SHA256cf9d2a1e77247986e1879c701c9e12347fda167fd26ce3bf32df8f4c4eb0594b
SHA512c5f9e9a878b186fafe9da4390c1164186bf0c6de534345ef4bddcdbd3638e30e15af5599d632c03fa0c24d56484520f3b057b73903c23953732f99e323ec788f
-
C:\Users\Admin\AppData\Local\Temp\C0BC.exeMD5
469e391a2cade8cac9a0ca180ee3c51d
SHA106e2492ffe14cbc47a85d112e556d32403c7c53b
SHA256cf9d2a1e77247986e1879c701c9e12347fda167fd26ce3bf32df8f4c4eb0594b
SHA512c5f9e9a878b186fafe9da4390c1164186bf0c6de534345ef4bddcdbd3638e30e15af5599d632c03fa0c24d56484520f3b057b73903c23953732f99e323ec788f
-
C:\Users\Admin\AppData\Roaming\wcgwswgMD5
fbae031469cbd507a050b883c31d00e9
SHA13867f0fcffa7a8e26545155e2086b617276b9923
SHA256c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1
SHA512cae9878d39fdf7e2d16dab4884fcdbdf689b76f86e518c1587012820860471d179931ded9edec27b0102085cd77a3c85e22124464bbcaaa2ababc1644f6a38ca
-
C:\Users\Admin\AppData\Roaming\wcgwswgMD5
fbae031469cbd507a050b883c31d00e9
SHA13867f0fcffa7a8e26545155e2086b617276b9923
SHA256c91c20fd0a9958c98beaa8b55958a10e29726e5b3a0a085f00911a833244bee1
SHA512cae9878d39fdf7e2d16dab4884fcdbdf689b76f86e518c1587012820860471d179931ded9edec27b0102085cd77a3c85e22124464bbcaaa2ababc1644f6a38ca
-
memory/1440-121-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/1440-122-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/1440-123-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1768-140-0x00000000003F0000-0x00000000003F7000-memory.dmpFilesize
28KB
-
memory/1768-142-0x00000000003E0000-0x00000000003EC000-memory.dmpFilesize
48KB
-
memory/2060-117-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2060-115-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2060-116-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/2352-155-0x000001DF04970000-0x000001DF04971000-memory.dmpFilesize
4KB
-
memory/2372-156-0x000001EB062F0000-0x000001EB062F1000-memory.dmpFilesize
4KB
-
memory/2484-157-0x000001D91EB30000-0x000001D91EB31000-memory.dmpFilesize
4KB
-
memory/2484-161-0x000001D91EE70000-0x000001D91EE71000-memory.dmpFilesize
4KB
-
memory/2624-148-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/2624-147-0x00000000005B0000-0x00000000005B5000-memory.dmpFilesize
20KB
-
memory/2784-139-0x0000000000A00000-0x0000000000A75000-memory.dmpFilesize
468KB
-
memory/2784-141-0x0000000000790000-0x00000000007FB000-memory.dmpFilesize
428KB
-
memory/2988-162-0x000001A7030D0000-0x000001A7033C9000-memory.dmpFilesize
3.0MB
-
memory/2988-160-0x000001A7030D0000-0x000001A7033C9000-memory.dmpFilesize
3.0MB
-
memory/2988-159-0x000001A7030D0000-0x000001A7033C9000-memory.dmpFilesize
3.0MB
-
memory/3064-132-0x00000000048A0000-0x00000000048AF000-memory.dmpFilesize
60KB
-
memory/3064-129-0x00000000030C0000-0x00000000030D6000-memory.dmpFilesize
88KB
-
memory/3064-126-0x0000000002C90000-0x0000000002EE0000-memory.dmpFilesize
2.3MB
-
memory/3064-118-0x0000000000F80000-0x0000000000F96000-memory.dmpFilesize
88KB
-
memory/3224-128-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3224-127-0x0000000000460000-0x000000000050E000-memory.dmpFilesize
696KB
-
memory/3480-143-0x0000000000610000-0x0000000000617000-memory.dmpFilesize
28KB
-
memory/3480-144-0x0000000000600000-0x000000000060B000-memory.dmpFilesize
44KB
-
memory/3504-158-0x0000023E36EA0000-0x0000023E36EA1000-memory.dmpFilesize
4KB
-
memory/3856-153-0x0000000000320000-0x0000000000327000-memory.dmpFilesize
28KB
-
memory/3856-154-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/3860-146-0x00000000012B0000-0x00000000012BE000-memory.dmpFilesize
56KB
-
memory/3860-145-0x00000000012C0000-0x00000000012C9000-memory.dmpFilesize
36KB
-
memory/3908-150-0x0000000000F20000-0x0000000000F2C000-memory.dmpFilesize
48KB
-
memory/3908-149-0x0000000000F30000-0x0000000000F36000-memory.dmpFilesize
24KB
-
memory/3940-152-0x0000000000B10000-0x0000000000B1B000-memory.dmpFilesize
44KB
-
memory/3940-151-0x0000000000B20000-0x0000000000B26000-memory.dmpFilesize
24KB