Analysis
-
max time kernel
159s -
max time network
167s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 07:26
Static task
static1
Behavioral task
behavioral1
Sample
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe
Resource
win10-en-20211208
General
-
Target
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe
-
Size
333KB
-
MD5
472e832877e234183aff01d044a48a04
-
SHA1
918a3cde50c5af1310bf2f2b23fdc5c1674beb46
-
SHA256
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363
-
SHA512
495403a8dfce7231ccd38bdb39885a91e705e54b06966da4cdc13f63e6a9245d183fe5aa450ff27bfa24dce82a03f958ed67cf06eaff247c3b0e933d78444ce1
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
2EFB.exepid process 4344 2EFB.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 744 3832 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe2EFB.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2EFB.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2EFB.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2EFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 4872 ipconfig.exe 2784 NETSTAT.EXE 2280 NETSTAT.EXE 1924 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24D90310-59B1-11EC-9231-4A7FAB6426E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exepid process 3416 ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe 3416 ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe2EFB.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3416 ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe 4344 2EFB.exe 396 396 396 396 396 396 3280 explorer.exe 3280 explorer.exe 396 396 2204 explorer.exe 2204 explorer.exe 396 396 5032 explorer.exe 5032 explorer.exe 396 396 2592 explorer.exe 2592 explorer.exe 396 396 3052 explorer.exe 3052 explorer.exe 396 396 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe 4116 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3164 WMIC.exe Token: SeSecurityPrivilege 3164 WMIC.exe Token: SeTakeOwnershipPrivilege 3164 WMIC.exe Token: SeLoadDriverPrivilege 3164 WMIC.exe Token: SeSystemProfilePrivilege 3164 WMIC.exe Token: SeSystemtimePrivilege 3164 WMIC.exe Token: SeProfSingleProcessPrivilege 3164 WMIC.exe Token: SeIncBasePriorityPrivilege 3164 WMIC.exe Token: SeCreatePagefilePrivilege 3164 WMIC.exe Token: SeBackupPrivilege 3164 WMIC.exe Token: SeRestorePrivilege 3164 WMIC.exe Token: SeShutdownPrivilege 3164 WMIC.exe Token: SeDebugPrivilege 3164 WMIC.exe Token: SeSystemEnvironmentPrivilege 3164 WMIC.exe Token: SeRemoteShutdownPrivilege 3164 WMIC.exe Token: SeUndockPrivilege 3164 WMIC.exe Token: SeManageVolumePrivilege 3164 WMIC.exe Token: 33 3164 WMIC.exe Token: 34 3164 WMIC.exe Token: 35 3164 WMIC.exe Token: 36 3164 WMIC.exe Token: SeIncreaseQuotaPrivilege 3164 WMIC.exe Token: SeSecurityPrivilege 3164 WMIC.exe Token: SeTakeOwnershipPrivilege 3164 WMIC.exe Token: SeLoadDriverPrivilege 3164 WMIC.exe Token: SeSystemProfilePrivilege 3164 WMIC.exe Token: SeSystemtimePrivilege 3164 WMIC.exe Token: SeProfSingleProcessPrivilege 3164 WMIC.exe Token: SeIncBasePriorityPrivilege 3164 WMIC.exe Token: SeCreatePagefilePrivilege 3164 WMIC.exe Token: SeBackupPrivilege 3164 WMIC.exe Token: SeRestorePrivilege 3164 WMIC.exe Token: SeShutdownPrivilege 3164 WMIC.exe Token: SeDebugPrivilege 3164 WMIC.exe Token: SeSystemEnvironmentPrivilege 3164 WMIC.exe Token: SeRemoteShutdownPrivilege 3164 WMIC.exe Token: SeUndockPrivilege 3164 WMIC.exe Token: SeManageVolumePrivilege 3164 WMIC.exe Token: 33 3164 WMIC.exe Token: 34 3164 WMIC.exe Token: 35 3164 WMIC.exe Token: 36 3164 WMIC.exe Token: SeIncreaseQuotaPrivilege 3236 WMIC.exe Token: SeSecurityPrivilege 3236 WMIC.exe Token: SeTakeOwnershipPrivilege 3236 WMIC.exe Token: SeLoadDriverPrivilege 3236 WMIC.exe Token: SeSystemProfilePrivilege 3236 WMIC.exe Token: SeSystemtimePrivilege 3236 WMIC.exe Token: SeProfSingleProcessPrivilege 3236 WMIC.exe Token: SeIncBasePriorityPrivilege 3236 WMIC.exe Token: SeCreatePagefilePrivilege 3236 WMIC.exe Token: SeBackupPrivilege 3236 WMIC.exe Token: SeRestorePrivilege 3236 WMIC.exe Token: SeShutdownPrivilege 3236 WMIC.exe Token: SeDebugPrivilege 3236 WMIC.exe Token: SeSystemEnvironmentPrivilege 3236 WMIC.exe Token: SeRemoteShutdownPrivilege 3236 WMIC.exe Token: SeUndockPrivilege 3236 WMIC.exe Token: SeManageVolumePrivilege 3236 WMIC.exe Token: 33 3236 WMIC.exe Token: 34 3236 WMIC.exe Token: 35 3236 WMIC.exe Token: 36 3236 WMIC.exe Token: SeIncreaseQuotaPrivilege 3236 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2248 iexplore.exe 2248 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 396 wrote to memory of 4344 396 2EFB.exe PID 396 wrote to memory of 4344 396 2EFB.exe PID 396 wrote to memory of 4344 396 2EFB.exe PID 396 wrote to memory of 4296 396 cmd.exe PID 396 wrote to memory of 4296 396 cmd.exe PID 4296 wrote to memory of 3164 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 3164 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 3236 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 3236 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 644 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 644 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 860 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 860 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 592 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 592 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 2816 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 2816 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 3580 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 3580 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4536 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4536 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 2600 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 2600 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4808 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4808 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 1236 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 1236 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4916 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4916 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4980 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4980 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 1456 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 1456 4296 cmd.exe WMIC.exe PID 4296 wrote to memory of 4872 4296 cmd.exe ipconfig.exe PID 4296 wrote to memory of 4872 4296 cmd.exe ipconfig.exe PID 4296 wrote to memory of 4876 4296 cmd.exe ROUTE.EXE PID 4296 wrote to memory of 4876 4296 cmd.exe ROUTE.EXE PID 4296 wrote to memory of 4912 4296 cmd.exe netsh.exe PID 4296 wrote to memory of 4912 4296 cmd.exe netsh.exe PID 4296 wrote to memory of 4580 4296 cmd.exe systeminfo.exe PID 4296 wrote to memory of 4580 4296 cmd.exe systeminfo.exe PID 4296 wrote to memory of 1076 4296 cmd.exe tasklist.exe PID 4296 wrote to memory of 1076 4296 cmd.exe tasklist.exe PID 4296 wrote to memory of 60 4296 cmd.exe net.exe PID 4296 wrote to memory of 60 4296 cmd.exe net.exe PID 60 wrote to memory of 1160 60 net.exe net1.exe PID 60 wrote to memory of 1160 60 net.exe net1.exe PID 4296 wrote to memory of 1084 4296 cmd.exe net.exe PID 4296 wrote to memory of 1084 4296 cmd.exe net.exe PID 1084 wrote to memory of 5020 1084 net.exe net1.exe PID 1084 wrote to memory of 5020 1084 net.exe net1.exe PID 4296 wrote to memory of 4656 4296 cmd.exe net.exe PID 4296 wrote to memory of 4656 4296 cmd.exe net.exe PID 4656 wrote to memory of 4944 4656 net.exe net1.exe PID 4656 wrote to memory of 4944 4656 net.exe net1.exe PID 4296 wrote to memory of 5036 4296 cmd.exe net.exe PID 4296 wrote to memory of 5036 4296 cmd.exe net.exe PID 5036 wrote to memory of 3748 5036 net.exe net1.exe PID 5036 wrote to memory of 3748 5036 net.exe net1.exe PID 4296 wrote to memory of 1240 4296 cmd.exe net.exe PID 4296 wrote to memory of 1240 4296 cmd.exe net.exe PID 4296 wrote to memory of 4528 4296 cmd.exe net.exe PID 4296 wrote to memory of 4528 4296 cmd.exe net.exe PID 4528 wrote to memory of 1296 4528 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3832 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe"C:\Users\Admin\AppData\Local\Temp\ac8dcde9968f3614f4db0ccd26383366560b3936c5a5905c1d8e10a6a9798363.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2EFB.exeC:\Users\Admin\AppData\Local\Temp\2EFB.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2EFB.exeMD5
005e445db353075922c066d7a792f78f
SHA179aa6671076b491c0b016275161e6145b7a7a7c1
SHA256e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0
SHA512d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a
-
C:\Users\Admin\AppData\Local\Temp\2EFB.exeMD5
005e445db353075922c066d7a792f78f
SHA179aa6671076b491c0b016275161e6145b7a7a7c1
SHA256e073d3debf3ced92c55317b98b6a4d31c8757af4edbddf97c405f555d6d264c0
SHA512d355882916d84b8b848394851bd48f9ed74d6c715f09efe0e25b1e392e1bc148d683dc3ef5bb2aa80654bba7f7361c1d9d541b777c81b3f5e02dce3cd251d29a
-
memory/396-124-0x0000000002B60000-0x0000000002B76000-memory.dmpFilesize
88KB
-
memory/396-127-0x0000000002C50000-0x0000000002C5F000-memory.dmpFilesize
60KB
-
memory/396-118-0x0000000000B20000-0x0000000000B36000-memory.dmpFilesize
88KB
-
memory/744-158-0x000001F497000000-0x000001F497001000-memory.dmpFilesize
4KB
-
memory/2204-144-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/2204-143-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/2344-153-0x0000026932C00000-0x0000026932C01000-memory.dmpFilesize
4KB
-
memory/2360-154-0x0000020109B50000-0x0000020109B51000-memory.dmpFilesize
4KB
-
memory/2424-155-0x000001C5B4850000-0x000001C5B4851000-memory.dmpFilesize
4KB
-
memory/2424-157-0x000001C5B4B90000-0x000001C5B4B91000-memory.dmpFilesize
4KB
-
memory/2592-147-0x0000000000AE0000-0x0000000000AE6000-memory.dmpFilesize
24KB
-
memory/2592-148-0x0000000000AD0000-0x0000000000ADC000-memory.dmpFilesize
48KB
-
memory/3028-138-0x0000000000960000-0x00000000009D5000-memory.dmpFilesize
468KB
-
memory/3028-139-0x00000000008F0000-0x000000000095B000-memory.dmpFilesize
428KB
-
memory/3052-150-0x00000000006B0000-0x00000000006BB000-memory.dmpFilesize
44KB
-
memory/3052-149-0x00000000006C0000-0x00000000006C6000-memory.dmpFilesize
24KB
-
memory/3280-142-0x0000000000CB0000-0x0000000000CBB000-memory.dmpFilesize
44KB
-
memory/3280-141-0x0000000000CC0000-0x0000000000CC7000-memory.dmpFilesize
28KB
-
memory/3416-115-0x0000000000680000-0x00000000006A9000-memory.dmpFilesize
164KB
-
memory/3416-117-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3416-116-0x0000000000480000-0x00000000005CA000-memory.dmpFilesize
1.3MB
-
memory/3540-156-0x000002677C8B0000-0x000002677C8B1000-memory.dmpFilesize
4KB
-
memory/4116-151-0x00000000008E0000-0x00000000008E7000-memory.dmpFilesize
28KB
-
memory/4116-152-0x00000000008D0000-0x00000000008DD000-memory.dmpFilesize
52KB
-
memory/4344-123-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/4344-122-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/4448-140-0x0000000000990000-0x000000000099C000-memory.dmpFilesize
48KB
-
memory/5032-146-0x0000000000350000-0x0000000000359000-memory.dmpFilesize
36KB
-
memory/5032-145-0x0000000000360000-0x0000000000365000-memory.dmpFilesize
20KB