Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe
Resource
win10-en-20211208
General
-
Target
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe
-
Size
333KB
-
MD5
64fd1b8745308047478159df6b39bbb7
-
SHA1
1a711ed0e2877482db4d08fe1e11e366b844d20b
-
SHA256
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af
-
SHA512
8b8ae98392ae8b97984c02bfa00473e448e77a6a88108bff6be193eab26a81cb8b801e3b4d8ff3d162036d25b398269b9205e1317314514e5b0718986355482d
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Executes dropped EXE 1 IoCs
Processes:
ithesabpid process 516 ithesab -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2892 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1292 3712 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exeithesabdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ithesab Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ithesab Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ithesab Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 1044 ipconfig.exe 1532 NETSTAT.EXE 1780 NETSTAT.EXE 1944 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0683F0DF-7E7E-11EC-9231-46FD2288E782} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exepid process 2572 f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe 2572 f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 2892 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2892 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exeithesabexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2572 f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe 516 ithesab 2892 2892 2892 2892 2892 2892 2972 explorer.exe 2972 explorer.exe 2892 2892 3600 explorer.exe 3600 explorer.exe 2892 2892 720 explorer.exe 720 explorer.exe 2892 2892 1656 explorer.exe 1656 explorer.exe 2892 2892 2844 explorer.exe 2844 explorer.exe 2892 2892 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe 2572 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1272 WMIC.exe Token: SeSecurityPrivilege 1272 WMIC.exe Token: SeTakeOwnershipPrivilege 1272 WMIC.exe Token: SeLoadDriverPrivilege 1272 WMIC.exe Token: SeSystemProfilePrivilege 1272 WMIC.exe Token: SeSystemtimePrivilege 1272 WMIC.exe Token: SeProfSingleProcessPrivilege 1272 WMIC.exe Token: SeIncBasePriorityPrivilege 1272 WMIC.exe Token: SeCreatePagefilePrivilege 1272 WMIC.exe Token: SeBackupPrivilege 1272 WMIC.exe Token: SeRestorePrivilege 1272 WMIC.exe Token: SeShutdownPrivilege 1272 WMIC.exe Token: SeDebugPrivilege 1272 WMIC.exe Token: SeSystemEnvironmentPrivilege 1272 WMIC.exe Token: SeRemoteShutdownPrivilege 1272 WMIC.exe Token: SeUndockPrivilege 1272 WMIC.exe Token: SeManageVolumePrivilege 1272 WMIC.exe Token: 33 1272 WMIC.exe Token: 34 1272 WMIC.exe Token: 35 1272 WMIC.exe Token: 36 1272 WMIC.exe Token: SeIncreaseQuotaPrivilege 1272 WMIC.exe Token: SeSecurityPrivilege 1272 WMIC.exe Token: SeTakeOwnershipPrivilege 1272 WMIC.exe Token: SeLoadDriverPrivilege 1272 WMIC.exe Token: SeSystemProfilePrivilege 1272 WMIC.exe Token: SeSystemtimePrivilege 1272 WMIC.exe Token: SeProfSingleProcessPrivilege 1272 WMIC.exe Token: SeIncBasePriorityPrivilege 1272 WMIC.exe Token: SeCreatePagefilePrivilege 1272 WMIC.exe Token: SeBackupPrivilege 1272 WMIC.exe Token: SeRestorePrivilege 1272 WMIC.exe Token: SeShutdownPrivilege 1272 WMIC.exe Token: SeDebugPrivilege 1272 WMIC.exe Token: SeSystemEnvironmentPrivilege 1272 WMIC.exe Token: SeRemoteShutdownPrivilege 1272 WMIC.exe Token: SeUndockPrivilege 1272 WMIC.exe Token: SeManageVolumePrivilege 1272 WMIC.exe Token: 33 1272 WMIC.exe Token: 34 1272 WMIC.exe Token: 35 1272 WMIC.exe Token: 36 1272 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: 36 584 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4036 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4036 iexplore.exe 4036 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2892 wrote to memory of 4024 2892 cmd.exe PID 2892 wrote to memory of 4024 2892 cmd.exe PID 4024 wrote to memory of 1272 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1272 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 584 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 584 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 720 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 720 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 716 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 716 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1696 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1696 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2884 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2884 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2888 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2888 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3016 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3016 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1908 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1908 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1548 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1548 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1336 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1336 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3652 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3652 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3232 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 3232 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2236 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 2236 4024 cmd.exe WMIC.exe PID 4024 wrote to memory of 1044 4024 cmd.exe ipconfig.exe PID 4024 wrote to memory of 1044 4024 cmd.exe ipconfig.exe PID 4024 wrote to memory of 3928 4024 cmd.exe ROUTE.EXE PID 4024 wrote to memory of 3928 4024 cmd.exe ROUTE.EXE PID 4024 wrote to memory of 2816 4024 cmd.exe netsh.exe PID 4024 wrote to memory of 2816 4024 cmd.exe netsh.exe PID 4024 wrote to memory of 3920 4024 cmd.exe systeminfo.exe PID 4024 wrote to memory of 3920 4024 cmd.exe systeminfo.exe PID 4024 wrote to memory of 3752 4024 cmd.exe tasklist.exe PID 4024 wrote to memory of 3752 4024 cmd.exe tasklist.exe PID 4024 wrote to memory of 3612 4024 cmd.exe net.exe PID 4024 wrote to memory of 3612 4024 cmd.exe net.exe PID 3612 wrote to memory of 1964 3612 net.exe net1.exe PID 3612 wrote to memory of 1964 3612 net.exe net1.exe PID 4024 wrote to memory of 2408 4024 cmd.exe net.exe PID 4024 wrote to memory of 2408 4024 cmd.exe net.exe PID 2408 wrote to memory of 704 2408 net.exe net1.exe PID 2408 wrote to memory of 704 2408 net.exe net1.exe PID 4024 wrote to memory of 1272 4024 cmd.exe net.exe PID 4024 wrote to memory of 1272 4024 cmd.exe net.exe PID 1272 wrote to memory of 672 1272 net.exe net1.exe PID 1272 wrote to memory of 672 1272 net.exe net1.exe PID 4024 wrote to memory of 584 4024 cmd.exe net.exe PID 4024 wrote to memory of 584 4024 cmd.exe net.exe PID 584 wrote to memory of 920 584 net.exe net1.exe PID 584 wrote to memory of 920 584 net.exe net1.exe PID 4024 wrote to memory of 716 4024 cmd.exe net.exe PID 4024 wrote to memory of 716 4024 cmd.exe net.exe PID 4024 wrote to memory of 1228 4024 cmd.exe net.exe PID 4024 wrote to memory of 1228 4024 cmd.exe net.exe PID 1228 wrote to memory of 1936 1228 net.exe net1.exe PID 1228 wrote to memory of 1936 1228 net.exe net1.exe PID 4024 wrote to memory of 2352 4024 cmd.exe net.exe PID 4024 wrote to memory of 2352 4024 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3712 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe"C:\Users\Admin\AppData\Local\Temp\f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\ithesabC:\Users\Admin\AppData\Roaming\ithesab1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ithesabMD5
64fd1b8745308047478159df6b39bbb7
SHA11a711ed0e2877482db4d08fe1e11e366b844d20b
SHA256f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af
SHA5128b8ae98392ae8b97984c02bfa00473e448e77a6a88108bff6be193eab26a81cb8b801e3b4d8ff3d162036d25b398269b9205e1317314514e5b0718986355482d
-
C:\Users\Admin\AppData\Roaming\ithesabMD5
64fd1b8745308047478159df6b39bbb7
SHA11a711ed0e2877482db4d08fe1e11e366b844d20b
SHA256f22145535bbed47f46e49c44373b9d7827b5ab2e6e25da4bff6a4396be0485af
SHA5128b8ae98392ae8b97984c02bfa00473e448e77a6a88108bff6be193eab26a81cb8b801e3b4d8ff3d162036d25b398269b9205e1317314514e5b0718986355482d
-
memory/516-125-0x0000000000570000-0x00000000006BA000-memory.dmpFilesize
1.3MB
-
memory/516-126-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/720-142-0x0000000003270000-0x0000000003279000-memory.dmpFilesize
36KB
-
memory/720-141-0x0000000003280000-0x0000000003285000-memory.dmpFilesize
20KB
-
memory/916-134-0x0000000000A70000-0x0000000000AE5000-memory.dmpFilesize
468KB
-
memory/916-135-0x0000000000A00000-0x0000000000A6B000-memory.dmpFilesize
428KB
-
memory/1292-154-0x0000016368630000-0x0000016368631000-memory.dmpFilesize
4KB
-
memory/1656-143-0x00000000008E0000-0x00000000008E6000-memory.dmpFilesize
24KB
-
memory/1656-144-0x00000000008D0000-0x00000000008DC000-memory.dmpFilesize
48KB
-
memory/2360-149-0x000001D820310000-0x000001D820311000-memory.dmpFilesize
4KB
-
memory/2380-150-0x000002745C290000-0x000002745C291000-memory.dmpFilesize
4KB
-
memory/2484-151-0x00000230BAAB0000-0x00000230BAAB1000-memory.dmpFilesize
4KB
-
memory/2484-153-0x00000230BADF0000-0x00000230BADF1000-memory.dmpFilesize
4KB
-
memory/2572-148-0x00000000004B0000-0x00000000004BD000-memory.dmpFilesize
52KB
-
memory/2572-115-0x0000000000740000-0x000000000076A000-memory.dmpFilesize
168KB
-
memory/2572-117-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2572-116-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/2572-147-0x00000000004C0000-0x00000000004C7000-memory.dmpFilesize
28KB
-
memory/2844-145-0x0000000003280000-0x0000000003286000-memory.dmpFilesize
24KB
-
memory/2844-146-0x0000000003270000-0x000000000327B000-memory.dmpFilesize
44KB
-
memory/2892-129-0x0000000003030000-0x0000000003046000-memory.dmpFilesize
88KB
-
memory/2892-123-0x0000000001170000-0x0000000002F50000-memory.dmpFilesize
29.9MB
-
memory/2892-118-0x0000000000F50000-0x0000000000F66000-memory.dmpFilesize
88KB
-
memory/2968-136-0x0000000000DC0000-0x0000000000DCC000-memory.dmpFilesize
48KB
-
memory/2972-138-0x0000000000500000-0x000000000050B000-memory.dmpFilesize
44KB
-
memory/2972-137-0x0000000000510000-0x0000000000517000-memory.dmpFilesize
28KB
-
memory/3472-152-0x0000023716EF0000-0x0000023716EF1000-memory.dmpFilesize
4KB
-
memory/3600-140-0x0000000000DC0000-0x0000000000DCE000-memory.dmpFilesize
56KB
-
memory/3600-139-0x0000000000DD0000-0x0000000000DD9000-memory.dmpFilesize
36KB