Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe
Resource
win10-en-20211208
General
-
Target
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe
-
Size
333KB
-
MD5
3c94f37cc82083233ba1979aeee6202a
-
SHA1
47e078dfee64241c93cebcd876dbada5f106c609
-
SHA256
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62
-
SHA512
6641689980445a393f4b054af031aa458339ba684e14de9c443a6b6d54ff98d7c404920b0adbe9ec041643baf4bdd885ba5c78c729f7901003d03f414102525b
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
D492.exepid process 3468 D492.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2984 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exeD492.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D492.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D492.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D492.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 2672 ipconfig.exe 3992 ipconfig.exe 2372 NETSTAT.EXE 3040 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62E4ED07-5B13-11EC-876A-DACFD5B38F3B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exepid process 508 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe 508 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2984 -
Suspicious behavior: MapViewOfSection 22 IoCs
Processes:
78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exeD492.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 508 78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe 3468 D492.exe 2984 2984 2984 2984 2984 2984 1920 explorer.exe 1920 explorer.exe 2984 2984 1876 explorer.exe 1876 explorer.exe 2984 2984 3564 explorer.exe 3564 explorer.exe 2984 2984 3576 explorer.exe 3576 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3296 WMIC.exe Token: SeSecurityPrivilege 3296 WMIC.exe Token: SeTakeOwnershipPrivilege 3296 WMIC.exe Token: SeLoadDriverPrivilege 3296 WMIC.exe Token: SeSystemProfilePrivilege 3296 WMIC.exe Token: SeSystemtimePrivilege 3296 WMIC.exe Token: SeProfSingleProcessPrivilege 3296 WMIC.exe Token: SeIncBasePriorityPrivilege 3296 WMIC.exe Token: SeCreatePagefilePrivilege 3296 WMIC.exe Token: SeBackupPrivilege 3296 WMIC.exe Token: SeRestorePrivilege 3296 WMIC.exe Token: SeShutdownPrivilege 3296 WMIC.exe Token: SeDebugPrivilege 3296 WMIC.exe Token: SeSystemEnvironmentPrivilege 3296 WMIC.exe Token: SeRemoteShutdownPrivilege 3296 WMIC.exe Token: SeUndockPrivilege 3296 WMIC.exe Token: SeManageVolumePrivilege 3296 WMIC.exe Token: 33 3296 WMIC.exe Token: 34 3296 WMIC.exe Token: 35 3296 WMIC.exe Token: 36 3296 WMIC.exe Token: SeIncreaseQuotaPrivilege 3296 WMIC.exe Token: SeSecurityPrivilege 3296 WMIC.exe Token: SeTakeOwnershipPrivilege 3296 WMIC.exe Token: SeLoadDriverPrivilege 3296 WMIC.exe Token: SeSystemProfilePrivilege 3296 WMIC.exe Token: SeSystemtimePrivilege 3296 WMIC.exe Token: SeProfSingleProcessPrivilege 3296 WMIC.exe Token: SeIncBasePriorityPrivilege 3296 WMIC.exe Token: SeCreatePagefilePrivilege 3296 WMIC.exe Token: SeBackupPrivilege 3296 WMIC.exe Token: SeRestorePrivilege 3296 WMIC.exe Token: SeShutdownPrivilege 3296 WMIC.exe Token: SeDebugPrivilege 3296 WMIC.exe Token: SeSystemEnvironmentPrivilege 3296 WMIC.exe Token: SeRemoteShutdownPrivilege 3296 WMIC.exe Token: SeUndockPrivilege 3296 WMIC.exe Token: SeManageVolumePrivilege 3296 WMIC.exe Token: 33 3296 WMIC.exe Token: 34 3296 WMIC.exe Token: 35 3296 WMIC.exe Token: 36 3296 WMIC.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe Token: SeSecurityPrivilege 1664 WMIC.exe Token: SeTakeOwnershipPrivilege 1664 WMIC.exe Token: SeLoadDriverPrivilege 1664 WMIC.exe Token: SeSystemProfilePrivilege 1664 WMIC.exe Token: SeSystemtimePrivilege 1664 WMIC.exe Token: SeProfSingleProcessPrivilege 1664 WMIC.exe Token: SeIncBasePriorityPrivilege 1664 WMIC.exe Token: SeCreatePagefilePrivilege 1664 WMIC.exe Token: SeBackupPrivilege 1664 WMIC.exe Token: SeRestorePrivilege 1664 WMIC.exe Token: SeShutdownPrivilege 1664 WMIC.exe Token: SeDebugPrivilege 1664 WMIC.exe Token: SeSystemEnvironmentPrivilege 1664 WMIC.exe Token: SeRemoteShutdownPrivilege 1664 WMIC.exe Token: SeUndockPrivilege 1664 WMIC.exe Token: SeManageVolumePrivilege 1664 WMIC.exe Token: 33 1664 WMIC.exe Token: 34 1664 WMIC.exe Token: 35 1664 WMIC.exe Token: 36 1664 WMIC.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2312 iexplore.exe 2312 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2984 wrote to memory of 3468 2984 D492.exe PID 2984 wrote to memory of 3468 2984 D492.exe PID 2984 wrote to memory of 3468 2984 D492.exe PID 2984 wrote to memory of 3876 2984 cmd.exe PID 2984 wrote to memory of 3876 2984 cmd.exe PID 3876 wrote to memory of 3296 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3296 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1664 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1664 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1224 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1224 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 680 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 680 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1956 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1956 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2448 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2448 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2860 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2860 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2912 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2912 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1544 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1544 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1424 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 1424 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3764 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3764 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2920 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 2920 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3120 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3120 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3720 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3720 3876 cmd.exe WMIC.exe PID 3876 wrote to memory of 3992 3876 cmd.exe ipconfig.exe PID 3876 wrote to memory of 3992 3876 cmd.exe ipconfig.exe PID 3876 wrote to memory of 3916 3876 cmd.exe ROUTE.EXE PID 3876 wrote to memory of 3916 3876 cmd.exe ROUTE.EXE PID 3876 wrote to memory of 3884 3876 cmd.exe netsh.exe PID 3876 wrote to memory of 3884 3876 cmd.exe netsh.exe PID 3876 wrote to memory of 4052 3876 cmd.exe systeminfo.exe PID 3876 wrote to memory of 4052 3876 cmd.exe systeminfo.exe PID 3876 wrote to memory of 948 3876 cmd.exe tasklist.exe PID 3876 wrote to memory of 948 3876 cmd.exe tasklist.exe PID 3876 wrote to memory of 3468 3876 cmd.exe net.exe PID 3876 wrote to memory of 3468 3876 cmd.exe net.exe PID 3468 wrote to memory of 1356 3468 net.exe net1.exe PID 3468 wrote to memory of 1356 3468 net.exe net1.exe PID 3876 wrote to memory of 1256 3876 cmd.exe net.exe PID 3876 wrote to memory of 1256 3876 cmd.exe net.exe PID 1256 wrote to memory of 1260 1256 net.exe net1.exe PID 1256 wrote to memory of 1260 1256 net.exe net1.exe PID 3876 wrote to memory of 1012 3876 cmd.exe net.exe PID 3876 wrote to memory of 1012 3876 cmd.exe net.exe PID 1012 wrote to memory of 1540 1012 net.exe net1.exe PID 1012 wrote to memory of 1540 1012 net.exe net1.exe PID 3876 wrote to memory of 64 3876 cmd.exe net.exe PID 3876 wrote to memory of 64 3876 cmd.exe net.exe PID 64 wrote to memory of 2768 64 net.exe net1.exe PID 64 wrote to memory of 2768 64 net.exe net1.exe PID 3876 wrote to memory of 3724 3876 cmd.exe net.exe PID 3876 wrote to memory of 3724 3876 cmd.exe net.exe PID 3876 wrote to memory of 2772 3876 cmd.exe net.exe PID 3876 wrote to memory of 2772 3876 cmd.exe net.exe PID 2772 wrote to memory of 660 2772 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe"C:\Users\Admin\AppData\Local\Temp\78c88525acd3a04c35a845e5d310985ac39e4332124721a5d37590d3cd501b62.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D492.exeC:\Users\Admin\AppData\Local\Temp\D492.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\D492.exeMD5
1c03d828f8851eca3faa34e9fc7fc202
SHA118309ec6c815702007e405e89834e2a06973b0ee
SHA256971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
SHA5125b0e4cadf471a562b3f0df08c6fd3870b4e1c454029bde23186cd6cb2b6dfa8d4278d2fb1c15bb9baa3126df7cf1ea3fb55d6923d6ec486e65ac824269bdee09
-
C:\Users\Admin\AppData\Local\Temp\D492.exeMD5
1c03d828f8851eca3faa34e9fc7fc202
SHA118309ec6c815702007e405e89834e2a06973b0ee
SHA256971926a7aab4443e8be8b6906e2fd25d0347ec61120a7983a786f476783eb849
SHA5125b0e4cadf471a562b3f0df08c6fd3870b4e1c454029bde23186cd6cb2b6dfa8d4278d2fb1c15bb9baa3126df7cf1ea3fb55d6923d6ec486e65ac824269bdee09
-
memory/508-116-0x0000000000660000-0x0000000000669000-memory.dmpFilesize
36KB
-
memory/508-117-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1876-140-0x00000000010C0000-0x00000000010CE000-memory.dmpFilesize
56KB
-
memory/1876-139-0x00000000010D0000-0x00000000010D9000-memory.dmpFilesize
36KB
-
memory/1920-137-0x0000000000860000-0x0000000000867000-memory.dmpFilesize
28KB
-
memory/1920-138-0x0000000000850000-0x000000000085B000-memory.dmpFilesize
44KB
-
memory/2984-124-0x0000000002A90000-0x0000000002AA6000-memory.dmpFilesize
88KB
-
memory/2984-127-0x0000000004300000-0x000000000430F000-memory.dmpFilesize
60KB
-
memory/2984-118-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/3020-134-0x0000000003070000-0x00000000030E5000-memory.dmpFilesize
468KB
-
memory/3020-135-0x0000000003000000-0x000000000306B000-memory.dmpFilesize
428KB
-
memory/3468-123-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3468-122-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/3564-141-0x0000000002DC0000-0x0000000002DC5000-memory.dmpFilesize
20KB
-
memory/3564-142-0x0000000002DB0000-0x0000000002DB9000-memory.dmpFilesize
36KB
-
memory/3920-136-0x0000000000D60000-0x0000000000D6C000-memory.dmpFilesize
48KB