Analysis
-
max time kernel
160s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 20:50
Static task
static1
Behavioral task
behavioral1
Sample
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe
Resource
win10-en-20211208
General
-
Target
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe
-
Size
316KB
-
MD5
144f3b39f333e19e50d9b1fdd79ccc69
-
SHA1
0be1677f2d5b95b87588563d87a8a7b31aaf9e9e
-
SHA256
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008
-
SHA512
da2a721d78a86c371434bb42565e55a79bd542c14357ec9315af9c694e23180ccefb890b9ca451a64edc6fd924d87877d74982b6b2fdfe749e3878bc02b417c1
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1756 3824 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 2008 ipconfig.exe 1284 ipconfig.exe 1888 NETSTAT.EXE 3640 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{260C1640-59B1-11EC-876A-76BAEE31784E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exepid process 3244 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe 3244 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3244 42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe 3064 3064 3064 3064 3064 3064 3352 explorer.exe 3352 explorer.exe 3064 3064 3284 explorer.exe 3284 explorer.exe 3064 3064 2420 explorer.exe 2420 explorer.exe 3064 3064 1456 explorer.exe 1456 explorer.exe 3064 3064 2068 explorer.exe 2068 explorer.exe 3064 3064 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: 36 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: 36 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe Token: SeSecurityPrivilege 1716 WMIC.exe Token: SeTakeOwnershipPrivilege 1716 WMIC.exe Token: SeLoadDriverPrivilege 1716 WMIC.exe Token: SeSystemProfilePrivilege 1716 WMIC.exe Token: SeSystemtimePrivilege 1716 WMIC.exe Token: SeProfSingleProcessPrivilege 1716 WMIC.exe Token: SeIncBasePriorityPrivilege 1716 WMIC.exe Token: SeCreatePagefilePrivilege 1716 WMIC.exe Token: SeBackupPrivilege 1716 WMIC.exe Token: SeRestorePrivilege 1716 WMIC.exe Token: SeShutdownPrivilege 1716 WMIC.exe Token: SeDebugPrivilege 1716 WMIC.exe Token: SeSystemEnvironmentPrivilege 1716 WMIC.exe Token: SeRemoteShutdownPrivilege 1716 WMIC.exe Token: SeUndockPrivilege 1716 WMIC.exe Token: SeManageVolumePrivilege 1716 WMIC.exe Token: 33 1716 WMIC.exe Token: 34 1716 WMIC.exe Token: 35 1716 WMIC.exe Token: 36 1716 WMIC.exe Token: SeIncreaseQuotaPrivilege 1716 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2176 iexplore.exe 2176 iexplore.exe 3088 IEXPLORE.EXE 3088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3064 wrote to memory of 2880 3064 cmd.exe PID 3064 wrote to memory of 2880 3064 cmd.exe PID 2880 wrote to memory of 1456 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1456 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1716 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1716 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 312 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 312 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3236 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3236 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3300 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3300 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2072 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2072 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2096 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2096 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2284 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2284 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2268 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2268 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3556 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3556 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3708 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 3708 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 884 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 884 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1356 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1356 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2104 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 2104 2880 cmd.exe WMIC.exe PID 2880 wrote to memory of 1284 2880 cmd.exe ipconfig.exe PID 2880 wrote to memory of 1284 2880 cmd.exe ipconfig.exe PID 2880 wrote to memory of 3844 2880 cmd.exe ROUTE.EXE PID 2880 wrote to memory of 3844 2880 cmd.exe ROUTE.EXE PID 2880 wrote to memory of 1836 2880 cmd.exe netsh.exe PID 2880 wrote to memory of 1836 2880 cmd.exe netsh.exe PID 2880 wrote to memory of 2864 2880 cmd.exe systeminfo.exe PID 2880 wrote to memory of 2864 2880 cmd.exe systeminfo.exe PID 2880 wrote to memory of 2676 2880 cmd.exe tasklist.exe PID 2880 wrote to memory of 2676 2880 cmd.exe tasklist.exe PID 2880 wrote to memory of 3632 2880 cmd.exe net.exe PID 2880 wrote to memory of 3632 2880 cmd.exe net.exe PID 3632 wrote to memory of 616 3632 net.exe net1.exe PID 3632 wrote to memory of 616 3632 net.exe net1.exe PID 2880 wrote to memory of 3260 2880 cmd.exe net.exe PID 2880 wrote to memory of 3260 2880 cmd.exe net.exe PID 3260 wrote to memory of 392 3260 net.exe net1.exe PID 3260 wrote to memory of 392 3260 net.exe net1.exe PID 2880 wrote to memory of 700 2880 cmd.exe net.exe PID 2880 wrote to memory of 700 2880 cmd.exe net.exe PID 700 wrote to memory of 3092 700 net.exe net1.exe PID 700 wrote to memory of 3092 700 net.exe net1.exe PID 2880 wrote to memory of 632 2880 cmd.exe net.exe PID 2880 wrote to memory of 632 2880 cmd.exe net.exe PID 632 wrote to memory of 1056 632 net.exe net1.exe PID 632 wrote to memory of 1056 632 net.exe net1.exe PID 2880 wrote to memory of 2100 2880 cmd.exe net.exe PID 2880 wrote to memory of 2100 2880 cmd.exe net.exe PID 2880 wrote to memory of 1180 2880 cmd.exe net.exe PID 2880 wrote to memory of 1180 2880 cmd.exe net.exe PID 1180 wrote to memory of 1320 1180 net.exe net1.exe PID 1180 wrote to memory of 1320 1180 net.exe net1.exe PID 2880 wrote to memory of 2356 2880 cmd.exe net.exe PID 2880 wrote to memory of 2356 2880 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3824 -s 9122⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe"C:\Users\Admin\AppData\Local\Temp\42e38af11a40afb62d84ea7a6f1be3e0b7660fcdf56ba047d990847696286008.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1008-133-0x0000000000BF0000-0x0000000000BFC000-memory.dmpFilesize
48KB
-
memory/1456-141-0x0000000000330000-0x000000000033C000-memory.dmpFilesize
48KB
-
memory/1456-140-0x0000000000340000-0x0000000000346000-memory.dmpFilesize
24KB
-
memory/1756-151-0x000001D4741A0000-0x000001D4741A1000-memory.dmpFilesize
4KB
-
memory/1756-150-0x000001D474050000-0x000001D474051000-memory.dmpFilesize
4KB
-
memory/2068-142-0x0000000000710000-0x0000000000716000-memory.dmpFilesize
24KB
-
memory/2068-143-0x0000000000700000-0x000000000070B000-memory.dmpFilesize
44KB
-
memory/2368-146-0x000001DCEE5A0000-0x000001DCEE5A1000-memory.dmpFilesize
4KB
-
memory/2380-147-0x000002C08AA20000-0x000002C08AA21000-memory.dmpFilesize
4KB
-
memory/2420-138-0x0000000003260000-0x0000000003265000-memory.dmpFilesize
20KB
-
memory/2420-139-0x0000000003250000-0x0000000003259000-memory.dmpFilesize
36KB
-
memory/2468-132-0x0000000002E40000-0x0000000002EAB000-memory.dmpFilesize
428KB
-
memory/2468-131-0x0000000002EB0000-0x0000000002F25000-memory.dmpFilesize
468KB
-
memory/2472-148-0x0000023C663E0000-0x0000023C663E1000-memory.dmpFilesize
4KB
-
memory/3064-121-0x0000000000870000-0x0000000000886000-memory.dmpFilesize
88KB
-
memory/3064-124-0x0000000002260000-0x000000000226F000-memory.dmpFilesize
60KB
-
memory/3220-144-0x0000000000910000-0x0000000000917000-memory.dmpFilesize
28KB
-
memory/3220-145-0x0000000000900000-0x000000000090D000-memory.dmpFilesize
52KB
-
memory/3244-118-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/3244-120-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/3244-119-0x0000000000580000-0x00000000006CA000-memory.dmpFilesize
1.3MB
-
memory/3284-137-0x00000000006E0000-0x00000000006EE000-memory.dmpFilesize
56KB
-
memory/3284-136-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/3352-134-0x0000000003240000-0x0000000003247000-memory.dmpFilesize
28KB
-
memory/3352-135-0x0000000003230000-0x000000000323B000-memory.dmpFilesize
44KB
-
memory/3528-149-0x000001F833A10000-0x000001F833A11000-memory.dmpFilesize
4KB