Analysis
-
max time kernel
161s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe
Resource
win10-en-20211208
General
-
Target
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe
-
Size
334KB
-
MD5
a7055a234da95ac729201f384482b135
-
SHA1
c0c843d8a1f05265e846db8ad67a6417c11f73dc
-
SHA256
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422
-
SHA512
b97a4167afedc3aef605155f8d30acdb1bbf41ec0d926de895e6f60655b273d6ee2ea596bf01ad39c376375b99e35c1b3be475d4faa7fe37e20a01ad5619f437
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
35A2.exepid process 3592 35A2.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2540 3768 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe35A2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35A2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35A2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 35A2.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3268 ipconfig.exe 4084 NETSTAT.EXE 2968 NETSTAT.EXE 1808 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5794042C-7EA0-11EC-9231-56FDD8C5D9AA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exepid process 2444 ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe 2444 ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe35A2.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2444 ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe 3592 35A2.exe 3004 3004 3004 3004 3004 3004 2232 explorer.exe 2232 explorer.exe 3004 3004 2060 explorer.exe 2060 explorer.exe 3004 3004 2988 explorer.exe 2988 explorer.exe 3004 3004 3296 explorer.exe 3296 explorer.exe 3004 3004 3260 explorer.exe 3260 explorer.exe 3004 3004 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe 1804 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 600 WMIC.exe Token: SeSecurityPrivilege 600 WMIC.exe Token: SeTakeOwnershipPrivilege 600 WMIC.exe Token: SeLoadDriverPrivilege 600 WMIC.exe Token: SeSystemProfilePrivilege 600 WMIC.exe Token: SeSystemtimePrivilege 600 WMIC.exe Token: SeProfSingleProcessPrivilege 600 WMIC.exe Token: SeIncBasePriorityPrivilege 600 WMIC.exe Token: SeCreatePagefilePrivilege 600 WMIC.exe Token: SeBackupPrivilege 600 WMIC.exe Token: SeRestorePrivilege 600 WMIC.exe Token: SeShutdownPrivilege 600 WMIC.exe Token: SeDebugPrivilege 600 WMIC.exe Token: SeSystemEnvironmentPrivilege 600 WMIC.exe Token: SeRemoteShutdownPrivilege 600 WMIC.exe Token: SeUndockPrivilege 600 WMIC.exe Token: SeManageVolumePrivilege 600 WMIC.exe Token: 33 600 WMIC.exe Token: 34 600 WMIC.exe Token: 35 600 WMIC.exe Token: 36 600 WMIC.exe Token: SeIncreaseQuotaPrivilege 600 WMIC.exe Token: SeSecurityPrivilege 600 WMIC.exe Token: SeTakeOwnershipPrivilege 600 WMIC.exe Token: SeLoadDriverPrivilege 600 WMIC.exe Token: SeSystemProfilePrivilege 600 WMIC.exe Token: SeSystemtimePrivilege 600 WMIC.exe Token: SeProfSingleProcessPrivilege 600 WMIC.exe Token: SeIncBasePriorityPrivilege 600 WMIC.exe Token: SeCreatePagefilePrivilege 600 WMIC.exe Token: SeBackupPrivilege 600 WMIC.exe Token: SeRestorePrivilege 600 WMIC.exe Token: SeShutdownPrivilege 600 WMIC.exe Token: SeDebugPrivilege 600 WMIC.exe Token: SeSystemEnvironmentPrivilege 600 WMIC.exe Token: SeRemoteShutdownPrivilege 600 WMIC.exe Token: SeUndockPrivilege 600 WMIC.exe Token: SeManageVolumePrivilege 600 WMIC.exe Token: 33 600 WMIC.exe Token: 34 600 WMIC.exe Token: 35 600 WMIC.exe Token: 36 600 WMIC.exe Token: SeIncreaseQuotaPrivilege 1060 WMIC.exe Token: SeSecurityPrivilege 1060 WMIC.exe Token: SeTakeOwnershipPrivilege 1060 WMIC.exe Token: SeLoadDriverPrivilege 1060 WMIC.exe Token: SeSystemProfilePrivilege 1060 WMIC.exe Token: SeSystemtimePrivilege 1060 WMIC.exe Token: SeProfSingleProcessPrivilege 1060 WMIC.exe Token: SeIncBasePriorityPrivilege 1060 WMIC.exe Token: SeCreatePagefilePrivilege 1060 WMIC.exe Token: SeBackupPrivilege 1060 WMIC.exe Token: SeRestorePrivilege 1060 WMIC.exe Token: SeShutdownPrivilege 1060 WMIC.exe Token: SeDebugPrivilege 1060 WMIC.exe Token: SeSystemEnvironmentPrivilege 1060 WMIC.exe Token: SeRemoteShutdownPrivilege 1060 WMIC.exe Token: SeUndockPrivilege 1060 WMIC.exe Token: SeManageVolumePrivilege 1060 WMIC.exe Token: 33 1060 WMIC.exe Token: 34 1060 WMIC.exe Token: 35 1060 WMIC.exe Token: 36 1060 WMIC.exe Token: SeIncreaseQuotaPrivilege 1060 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1904 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1904 iexplore.exe 1904 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3004 wrote to memory of 3592 3004 35A2.exe PID 3004 wrote to memory of 3592 3004 35A2.exe PID 3004 wrote to memory of 3592 3004 35A2.exe PID 3004 wrote to memory of 216 3004 cmd.exe PID 3004 wrote to memory of 216 3004 cmd.exe PID 216 wrote to memory of 600 216 cmd.exe WMIC.exe PID 216 wrote to memory of 600 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1060 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1060 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1084 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1084 216 cmd.exe WMIC.exe PID 216 wrote to memory of 4032 216 cmd.exe WMIC.exe PID 216 wrote to memory of 4032 216 cmd.exe WMIC.exe PID 216 wrote to memory of 860 216 cmd.exe WMIC.exe PID 216 wrote to memory of 860 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2120 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2120 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3304 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3304 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2780 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2780 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2916 216 cmd.exe WMIC.exe PID 216 wrote to memory of 2916 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3848 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3848 216 cmd.exe WMIC.exe PID 216 wrote to memory of 904 216 cmd.exe WMIC.exe PID 216 wrote to memory of 904 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1516 216 cmd.exe WMIC.exe PID 216 wrote to memory of 1516 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3672 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3672 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3756 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3756 216 cmd.exe WMIC.exe PID 216 wrote to memory of 3268 216 cmd.exe ipconfig.exe PID 216 wrote to memory of 3268 216 cmd.exe ipconfig.exe PID 216 wrote to memory of 1792 216 cmd.exe ROUTE.EXE PID 216 wrote to memory of 1792 216 cmd.exe ROUTE.EXE PID 216 wrote to memory of 2160 216 cmd.exe netsh.exe PID 216 wrote to memory of 2160 216 cmd.exe netsh.exe PID 216 wrote to memory of 3864 216 cmd.exe systeminfo.exe PID 216 wrote to memory of 3864 216 cmd.exe systeminfo.exe PID 216 wrote to memory of 3704 216 cmd.exe tasklist.exe PID 216 wrote to memory of 3704 216 cmd.exe tasklist.exe PID 216 wrote to memory of 3592 216 cmd.exe net.exe PID 216 wrote to memory of 3592 216 cmd.exe net.exe PID 3592 wrote to memory of 3124 3592 net.exe net1.exe PID 3592 wrote to memory of 3124 3592 net.exe net1.exe PID 216 wrote to memory of 992 216 cmd.exe net.exe PID 216 wrote to memory of 992 216 cmd.exe net.exe PID 992 wrote to memory of 1600 992 net.exe net1.exe PID 992 wrote to memory of 1600 992 net.exe net1.exe PID 216 wrote to memory of 2812 216 cmd.exe net.exe PID 216 wrote to memory of 2812 216 cmd.exe net.exe PID 2812 wrote to memory of 696 2812 net.exe net1.exe PID 2812 wrote to memory of 696 2812 net.exe net1.exe PID 216 wrote to memory of 1332 216 cmd.exe net.exe PID 216 wrote to memory of 1332 216 cmd.exe net.exe PID 1332 wrote to memory of 880 1332 net.exe net1.exe PID 1332 wrote to memory of 880 1332 net.exe net1.exe PID 216 wrote to memory of 600 216 cmd.exe net.exe PID 216 wrote to memory of 600 216 cmd.exe net.exe PID 216 wrote to memory of 480 216 cmd.exe net.exe PID 216 wrote to memory of 480 216 cmd.exe net.exe PID 480 wrote to memory of 1060 480 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3768 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe"C:\Users\Admin\AppData\Local\Temp\ec3b7904889b13ad6e6e91afc91ff8e96140afa73f982cc0b3cd070a97f39422.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\35A2.exeC:\Users\Admin\AppData\Local\Temp\35A2.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\35A2.exeMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
C:\Users\Admin\AppData\Local\Temp\35A2.exeMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
memory/1804-155-0x00000000001C0000-0x00000000001CD000-memory.dmpFilesize
52KB
-
memory/1804-154-0x00000000001D0000-0x00000000001D7000-memory.dmpFilesize
28KB
-
memory/2060-146-0x0000000000B00000-0x0000000000B09000-memory.dmpFilesize
36KB
-
memory/2060-147-0x0000000000AF0000-0x0000000000AFE000-memory.dmpFilesize
56KB
-
memory/2232-144-0x0000000002FE0000-0x0000000002FE7000-memory.dmpFilesize
28KB
-
memory/2232-145-0x0000000002FD0000-0x0000000002FDB000-memory.dmpFilesize
44KB
-
memory/2312-156-0x000002E6B6260000-0x000002E6B6261000-memory.dmpFilesize
4KB
-
memory/2320-157-0x00000269E2EA0000-0x00000269E2EA1000-memory.dmpFilesize
4KB
-
memory/2428-160-0x00000197502E0000-0x00000197502E1000-memory.dmpFilesize
4KB
-
memory/2428-158-0x000001974FFA0000-0x000001974FFA1000-memory.dmpFilesize
4KB
-
memory/2444-118-0x00000000006D0000-0x00000000006F9000-memory.dmpFilesize
164KB
-
memory/2444-119-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/2444-120-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2540-161-0x0000017F214A0000-0x0000017F214A1000-memory.dmpFilesize
4KB
-
memory/2940-141-0x0000000002B60000-0x0000000002BD5000-memory.dmpFilesize
468KB
-
memory/2940-142-0x0000000002AF0000-0x0000000002B5B000-memory.dmpFilesize
428KB
-
memory/2988-148-0x0000000002A20000-0x0000000002A25000-memory.dmpFilesize
20KB
-
memory/2988-149-0x0000000002A10000-0x0000000002A19000-memory.dmpFilesize
36KB
-
memory/3004-127-0x0000000003020000-0x0000000003036000-memory.dmpFilesize
88KB
-
memory/3004-130-0x00000000030C0000-0x00000000030CF000-memory.dmpFilesize
60KB
-
memory/3004-121-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/3260-153-0x0000000002A10000-0x0000000002A1B000-memory.dmpFilesize
44KB
-
memory/3260-152-0x0000000002A20000-0x0000000002A26000-memory.dmpFilesize
24KB
-
memory/3296-151-0x00000000001E0000-0x00000000001EC000-memory.dmpFilesize
48KB
-
memory/3296-150-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/3324-143-0x0000000000E00000-0x0000000000E0C000-memory.dmpFilesize
48KB
-
memory/3528-159-0x000002927A5F0000-0x000002927A5F1000-memory.dmpFilesize
4KB
-
memory/3592-126-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/3592-125-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/3592-124-0x0000000000650000-0x0000000000679000-memory.dmpFilesize
164KB