Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 13:29
Static task
static1
Behavioral task
behavioral1
Sample
a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe
Resource
win10-en-20211208
General
-
Target
a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe
-
Size
333KB
-
MD5
1e320b4f6676b09a3886632b653edd3f
-
SHA1
1c3174d4f9df6049491da0a0ec2525688e3cc850
-
SHA256
a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21
-
SHA512
97381e742d0e10cabeedf606a49b170a8d720fa66856b5a2d02bbe888b28f5d88b899f9b14e1c63f3c2d92e2663b72a30ad8c8a7e51871406bb982a77c981a3c
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
A6AC.exepid process 1148 A6AC.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1716 3704 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
A6AC.exea2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A6AC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A6AC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A6AC.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3848 ipconfig.exe 2564 NETSTAT.EXE 1136 NETSTAT.EXE 1072 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47429165-7EAC-11EC-876A-56FDD8C5D9AA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exepid process 3372 a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe 3372 a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exeA6AC.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3372 a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe 1148 A6AC.exe 396 396 396 396 396 396 3544 explorer.exe 3544 explorer.exe 396 396 2376 explorer.exe 2376 explorer.exe 396 396 2128 explorer.exe 2128 explorer.exe 396 396 3200 explorer.exe 3200 explorer.exe 396 396 2124 explorer.exe 2124 explorer.exe 396 396 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe 428 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 676 WMIC.exe Token: SeSecurityPrivilege 676 WMIC.exe Token: SeTakeOwnershipPrivilege 676 WMIC.exe Token: SeLoadDriverPrivilege 676 WMIC.exe Token: SeSystemProfilePrivilege 676 WMIC.exe Token: SeSystemtimePrivilege 676 WMIC.exe Token: SeProfSingleProcessPrivilege 676 WMIC.exe Token: SeIncBasePriorityPrivilege 676 WMIC.exe Token: SeCreatePagefilePrivilege 676 WMIC.exe Token: SeBackupPrivilege 676 WMIC.exe Token: SeRestorePrivilege 676 WMIC.exe Token: SeShutdownPrivilege 676 WMIC.exe Token: SeDebugPrivilege 676 WMIC.exe Token: SeSystemEnvironmentPrivilege 676 WMIC.exe Token: SeRemoteShutdownPrivilege 676 WMIC.exe Token: SeUndockPrivilege 676 WMIC.exe Token: SeManageVolumePrivilege 676 WMIC.exe Token: 33 676 WMIC.exe Token: 34 676 WMIC.exe Token: 35 676 WMIC.exe Token: 36 676 WMIC.exe Token: SeIncreaseQuotaPrivilege 676 WMIC.exe Token: SeSecurityPrivilege 676 WMIC.exe Token: SeTakeOwnershipPrivilege 676 WMIC.exe Token: SeLoadDriverPrivilege 676 WMIC.exe Token: SeSystemProfilePrivilege 676 WMIC.exe Token: SeSystemtimePrivilege 676 WMIC.exe Token: SeProfSingleProcessPrivilege 676 WMIC.exe Token: SeIncBasePriorityPrivilege 676 WMIC.exe Token: SeCreatePagefilePrivilege 676 WMIC.exe Token: SeBackupPrivilege 676 WMIC.exe Token: SeRestorePrivilege 676 WMIC.exe Token: SeShutdownPrivilege 676 WMIC.exe Token: SeDebugPrivilege 676 WMIC.exe Token: SeSystemEnvironmentPrivilege 676 WMIC.exe Token: SeRemoteShutdownPrivilege 676 WMIC.exe Token: SeUndockPrivilege 676 WMIC.exe Token: SeManageVolumePrivilege 676 WMIC.exe Token: 33 676 WMIC.exe Token: 34 676 WMIC.exe Token: 35 676 WMIC.exe Token: 36 676 WMIC.exe Token: SeIncreaseQuotaPrivilege 704 WMIC.exe Token: SeSecurityPrivilege 704 WMIC.exe Token: SeTakeOwnershipPrivilege 704 WMIC.exe Token: SeLoadDriverPrivilege 704 WMIC.exe Token: SeSystemProfilePrivilege 704 WMIC.exe Token: SeSystemtimePrivilege 704 WMIC.exe Token: SeProfSingleProcessPrivilege 704 WMIC.exe Token: SeIncBasePriorityPrivilege 704 WMIC.exe Token: SeCreatePagefilePrivilege 704 WMIC.exe Token: SeBackupPrivilege 704 WMIC.exe Token: SeRestorePrivilege 704 WMIC.exe Token: SeShutdownPrivilege 704 WMIC.exe Token: SeDebugPrivilege 704 WMIC.exe Token: SeSystemEnvironmentPrivilege 704 WMIC.exe Token: SeRemoteShutdownPrivilege 704 WMIC.exe Token: SeUndockPrivilege 704 WMIC.exe Token: SeManageVolumePrivilege 704 WMIC.exe Token: 33 704 WMIC.exe Token: 34 704 WMIC.exe Token: 35 704 WMIC.exe Token: 36 704 WMIC.exe Token: SeIncreaseQuotaPrivilege 704 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1964 iexplore.exe 1964 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 396 wrote to memory of 1148 396 A6AC.exe PID 396 wrote to memory of 1148 396 A6AC.exe PID 396 wrote to memory of 1148 396 A6AC.exe PID 396 wrote to memory of 1844 396 cmd.exe PID 396 wrote to memory of 1844 396 cmd.exe PID 1844 wrote to memory of 676 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 676 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 704 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 704 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 884 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 884 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3908 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3908 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 936 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 936 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3024 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3024 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3228 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3228 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3560 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3560 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1468 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1468 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1788 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1788 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 2376 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 2376 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 8 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 8 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3200 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3200 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 2832 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 2832 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 3848 1844 cmd.exe ipconfig.exe PID 1844 wrote to memory of 3848 1844 cmd.exe ipconfig.exe PID 1844 wrote to memory of 3540 1844 cmd.exe ROUTE.EXE PID 1844 wrote to memory of 3540 1844 cmd.exe ROUTE.EXE PID 1844 wrote to memory of 1588 1844 cmd.exe netsh.exe PID 1844 wrote to memory of 1588 1844 cmd.exe netsh.exe PID 1844 wrote to memory of 4008 1844 cmd.exe systeminfo.exe PID 1844 wrote to memory of 4008 1844 cmd.exe systeminfo.exe PID 1844 wrote to memory of 1184 1844 cmd.exe tasklist.exe PID 1844 wrote to memory of 1184 1844 cmd.exe tasklist.exe PID 1844 wrote to memory of 1748 1844 cmd.exe net.exe PID 1844 wrote to memory of 1748 1844 cmd.exe net.exe PID 1748 wrote to memory of 776 1748 net.exe net1.exe PID 1748 wrote to memory of 776 1748 net.exe net1.exe PID 1844 wrote to memory of 3056 1844 cmd.exe net.exe PID 1844 wrote to memory of 3056 1844 cmd.exe net.exe PID 3056 wrote to memory of 1492 3056 net.exe net1.exe PID 3056 wrote to memory of 1492 3056 net.exe net1.exe PID 1844 wrote to memory of 3064 1844 cmd.exe net.exe PID 1844 wrote to memory of 3064 1844 cmd.exe net.exe PID 3064 wrote to memory of 1760 3064 net.exe net1.exe PID 3064 wrote to memory of 1760 3064 net.exe net1.exe PID 1844 wrote to memory of 3940 1844 cmd.exe net.exe PID 1844 wrote to memory of 3940 1844 cmd.exe net.exe PID 3940 wrote to memory of 3340 3940 net.exe net1.exe PID 3940 wrote to memory of 3340 3940 net.exe net1.exe PID 1844 wrote to memory of 1420 1844 cmd.exe net.exe PID 1844 wrote to memory of 1420 1844 cmd.exe net.exe PID 1844 wrote to memory of 2864 1844 cmd.exe net.exe PID 1844 wrote to memory of 2864 1844 cmd.exe net.exe PID 2864 wrote to memory of 1424 2864 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3704 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe"C:\Users\Admin\AppData\Local\Temp\a2cba104b1534f954247483b77c3511f74b721e27a835502671cf1d935414e21.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A6AC.exeC:\Users\Admin\AppData\Local\Temp\A6AC.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A6AC.exeMD5
9346bf0c07dfbb8587c0ee3eaaad88f6
SHA12ee8e4cee87b7d187e1c56a761ebe1d8cf0c53c0
SHA256c226814ae19db524044c01641093716c32cf5bc763e52fc750aa919b74e68593
SHA512c6fffa6c95fb3e49bc349a4c508109c17b8d5b2a4d2b6b03402861bfb3d36b75c2762811a7348ec0d9fadb071ea34a2dc037fec1219f4ec49b7d486d9a62be40
-
C:\Users\Admin\AppData\Local\Temp\A6AC.exeMD5
9346bf0c07dfbb8587c0ee3eaaad88f6
SHA12ee8e4cee87b7d187e1c56a761ebe1d8cf0c53c0
SHA256c226814ae19db524044c01641093716c32cf5bc763e52fc750aa919b74e68593
SHA512c6fffa6c95fb3e49bc349a4c508109c17b8d5b2a4d2b6b03402861bfb3d36b75c2762811a7348ec0d9fadb071ea34a2dc037fec1219f4ec49b7d486d9a62be40
-
memory/396-118-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/396-124-0x0000000002A10000-0x0000000002A26000-memory.dmpFilesize
88KB
-
memory/396-127-0x0000000004390000-0x000000000439F000-memory.dmpFilesize
60KB
-
memory/428-148-0x00000000001D0000-0x00000000001D7000-memory.dmpFilesize
28KB
-
memory/428-149-0x00000000001C0000-0x00000000001CD000-memory.dmpFilesize
52KB
-
memory/1148-121-0x0000000000640000-0x0000000000669000-memory.dmpFilesize
164KB
-
memory/1148-122-0x00000000004E0000-0x000000000062A000-memory.dmpFilesize
1.3MB
-
memory/1148-123-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1716-154-0x0000025CE7A50000-0x0000025CE7A51000-memory.dmpFilesize
4KB
-
memory/2124-147-0x0000000000800000-0x000000000080B000-memory.dmpFilesize
44KB
-
memory/2124-146-0x0000000000810000-0x0000000000816000-memory.dmpFilesize
24KB
-
memory/2128-142-0x0000000000540000-0x0000000000545000-memory.dmpFilesize
20KB
-
memory/2128-143-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/2376-140-0x0000000000B50000-0x0000000000B59000-memory.dmpFilesize
36KB
-
memory/2376-141-0x0000000000B40000-0x0000000000B4E000-memory.dmpFilesize
56KB
-
memory/2476-150-0x000001F1BE570000-0x000001F1BE571000-memory.dmpFilesize
4KB
-
memory/2484-151-0x000001E9ED290000-0x000001E9ED291000-memory.dmpFilesize
4KB
-
memory/2732-155-0x0000024DB9BC0000-0x0000024DB9BC1000-memory.dmpFilesize
4KB
-
memory/2732-152-0x0000024DB9880000-0x0000024DB9881000-memory.dmpFilesize
4KB
-
memory/3200-145-0x0000000000B10000-0x0000000000B1C000-memory.dmpFilesize
48KB
-
memory/3200-144-0x0000000000B20000-0x0000000000B26000-memory.dmpFilesize
24KB
-
memory/3228-137-0x00000000010A0000-0x00000000010AC000-memory.dmpFilesize
48KB
-
memory/3228-136-0x00000000010B0000-0x00000000010B7000-memory.dmpFilesize
28KB
-
memory/3372-115-0x0000000000620000-0x000000000064A000-memory.dmpFilesize
168KB
-
memory/3372-117-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3372-116-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/3440-153-0x0000028D5DA50000-0x0000028D5DA51000-memory.dmpFilesize
4KB
-
memory/3544-139-0x0000000000B80000-0x0000000000B8B000-memory.dmpFilesize
44KB
-
memory/3544-138-0x0000000000B90000-0x0000000000B97000-memory.dmpFilesize
28KB
-
memory/3892-135-0x0000000000970000-0x00000000009DB000-memory.dmpFilesize
428KB
-
memory/3892-134-0x0000000000C00000-0x0000000000C75000-memory.dmpFilesize
468KB