Analysis
-
max time kernel
171s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 18:27
Static task
static1
Behavioral task
behavioral1
Sample
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe
Resource
win10-en-20211208
General
-
Target
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe
-
Size
334KB
-
MD5
85429f6f1f1fa17bcaed0e740472b428
-
SHA1
08bc8f0aa7d94c2906e94f0a68aa5b6340ce6883
-
SHA256
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02
-
SHA512
9c2c96ce4e5be3f4bca057904b81cc02e16e494592f4a7b5ec910311665e5a142d90e1f567dc473f61b1fef42f64cfe34fa155207f7a690d3245719f77b515a6
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
2C6.exepid process 872 2C6.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2072 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3936 3772 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe2C6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2C6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2C6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2C6.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3848 ipconfig.exe 2712 NETSTAT.EXE 2080 NETSTAT.EXE 1208 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B4FE4BD-5B13-11EC-876A-E63C55DA7BCE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exepid process 2524 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe 2524 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 2072 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2072 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe2C6.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2524 6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe 872 2C6.exe 2072 2072 2072 2072 2072 2072 1312 explorer.exe 1312 explorer.exe 2072 2072 3572 explorer.exe 3572 explorer.exe 2072 2072 3196 explorer.exe 3196 explorer.exe 2072 2072 2160 explorer.exe 2160 explorer.exe 2072 2072 3796 explorer.exe 3796 explorer.exe 2072 2072 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 612 WMIC.exe Token: SeSecurityPrivilege 612 WMIC.exe Token: SeTakeOwnershipPrivilege 612 WMIC.exe Token: SeLoadDriverPrivilege 612 WMIC.exe Token: SeSystemProfilePrivilege 612 WMIC.exe Token: SeSystemtimePrivilege 612 WMIC.exe Token: SeProfSingleProcessPrivilege 612 WMIC.exe Token: SeIncBasePriorityPrivilege 612 WMIC.exe Token: SeCreatePagefilePrivilege 612 WMIC.exe Token: SeBackupPrivilege 612 WMIC.exe Token: SeRestorePrivilege 612 WMIC.exe Token: SeShutdownPrivilege 612 WMIC.exe Token: SeDebugPrivilege 612 WMIC.exe Token: SeSystemEnvironmentPrivilege 612 WMIC.exe Token: SeRemoteShutdownPrivilege 612 WMIC.exe Token: SeUndockPrivilege 612 WMIC.exe Token: SeManageVolumePrivilege 612 WMIC.exe Token: 33 612 WMIC.exe Token: 34 612 WMIC.exe Token: 35 612 WMIC.exe Token: 36 612 WMIC.exe Token: SeIncreaseQuotaPrivilege 612 WMIC.exe Token: SeSecurityPrivilege 612 WMIC.exe Token: SeTakeOwnershipPrivilege 612 WMIC.exe Token: SeLoadDriverPrivilege 612 WMIC.exe Token: SeSystemProfilePrivilege 612 WMIC.exe Token: SeSystemtimePrivilege 612 WMIC.exe Token: SeProfSingleProcessPrivilege 612 WMIC.exe Token: SeIncBasePriorityPrivilege 612 WMIC.exe Token: SeCreatePagefilePrivilege 612 WMIC.exe Token: SeBackupPrivilege 612 WMIC.exe Token: SeRestorePrivilege 612 WMIC.exe Token: SeShutdownPrivilege 612 WMIC.exe Token: SeDebugPrivilege 612 WMIC.exe Token: SeSystemEnvironmentPrivilege 612 WMIC.exe Token: SeRemoteShutdownPrivilege 612 WMIC.exe Token: SeUndockPrivilege 612 WMIC.exe Token: SeManageVolumePrivilege 612 WMIC.exe Token: 33 612 WMIC.exe Token: 34 612 WMIC.exe Token: 35 612 WMIC.exe Token: 36 612 WMIC.exe Token: SeIncreaseQuotaPrivilege 1348 WMIC.exe Token: SeSecurityPrivilege 1348 WMIC.exe Token: SeTakeOwnershipPrivilege 1348 WMIC.exe Token: SeLoadDriverPrivilege 1348 WMIC.exe Token: SeSystemProfilePrivilege 1348 WMIC.exe Token: SeSystemtimePrivilege 1348 WMIC.exe Token: SeProfSingleProcessPrivilege 1348 WMIC.exe Token: SeIncBasePriorityPrivilege 1348 WMIC.exe Token: SeCreatePagefilePrivilege 1348 WMIC.exe Token: SeBackupPrivilege 1348 WMIC.exe Token: SeRestorePrivilege 1348 WMIC.exe Token: SeShutdownPrivilege 1348 WMIC.exe Token: SeDebugPrivilege 1348 WMIC.exe Token: SeSystemEnvironmentPrivilege 1348 WMIC.exe Token: SeRemoteShutdownPrivilege 1348 WMIC.exe Token: SeUndockPrivilege 1348 WMIC.exe Token: SeManageVolumePrivilege 1348 WMIC.exe Token: 33 1348 WMIC.exe Token: 34 1348 WMIC.exe Token: 35 1348 WMIC.exe Token: 36 1348 WMIC.exe Token: SeIncreaseQuotaPrivilege 1348 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 956 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 956 iexplore.exe 956 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2072 wrote to memory of 872 2072 2C6.exe PID 2072 wrote to memory of 872 2072 2C6.exe PID 2072 wrote to memory of 872 2072 2C6.exe PID 2072 wrote to memory of 3340 2072 cmd.exe PID 2072 wrote to memory of 3340 2072 cmd.exe PID 3340 wrote to memory of 612 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 612 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1348 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1348 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 676 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 676 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1268 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1268 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3804 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3804 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3252 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3252 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 4040 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 4040 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1544 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1544 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1088 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1088 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 2880 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 2880 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1692 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 1692 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3576 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3576 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3188 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3188 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 2204 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 2204 3340 cmd.exe WMIC.exe PID 3340 wrote to memory of 3848 3340 cmd.exe ipconfig.exe PID 3340 wrote to memory of 3848 3340 cmd.exe ipconfig.exe PID 3340 wrote to memory of 1868 3340 cmd.exe ROUTE.EXE PID 3340 wrote to memory of 1868 3340 cmd.exe ROUTE.EXE PID 3340 wrote to memory of 4020 3340 cmd.exe netsh.exe PID 3340 wrote to memory of 4020 3340 cmd.exe netsh.exe PID 3340 wrote to memory of 784 3340 cmd.exe systeminfo.exe PID 3340 wrote to memory of 784 3340 cmd.exe systeminfo.exe PID 3340 wrote to memory of 2788 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 2788 3340 cmd.exe tasklist.exe PID 3340 wrote to memory of 3928 3340 cmd.exe net.exe PID 3340 wrote to memory of 3928 3340 cmd.exe net.exe PID 3928 wrote to memory of 428 3928 net.exe net1.exe PID 3928 wrote to memory of 428 3928 net.exe net1.exe PID 3340 wrote to memory of 1840 3340 cmd.exe net.exe PID 3340 wrote to memory of 1840 3340 cmd.exe net.exe PID 1840 wrote to memory of 3444 1840 net.exe net1.exe PID 1840 wrote to memory of 3444 1840 net.exe net1.exe PID 3340 wrote to memory of 2660 3340 cmd.exe net.exe PID 3340 wrote to memory of 2660 3340 cmd.exe net.exe PID 2660 wrote to memory of 3364 2660 net.exe net1.exe PID 2660 wrote to memory of 3364 2660 net.exe net1.exe PID 3340 wrote to memory of 384 3340 cmd.exe net.exe PID 3340 wrote to memory of 384 3340 cmd.exe net.exe PID 384 wrote to memory of 732 384 net.exe net1.exe PID 384 wrote to memory of 732 384 net.exe net1.exe PID 3340 wrote to memory of 648 3340 cmd.exe net.exe PID 3340 wrote to memory of 648 3340 cmd.exe net.exe PID 3340 wrote to memory of 2848 3340 cmd.exe net.exe PID 3340 wrote to memory of 2848 3340 cmd.exe net.exe PID 2848 wrote to memory of 1456 2848 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3772 -s 9202⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe"C:\Users\Admin\AppData\Local\Temp\6c32bc53645e49a7bdca77272e00e44ec5d38e561fe8c600a3425324a9641a02.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2C6.exeC:\Users\Admin\AppData\Local\Temp\2C6.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2C6.exeMD5
b25b80e4ba8d5f18c6149b1a6d19c23f
SHA1a58db136992751701407918c288f2d803259e96c
SHA2563e4c2ba23a7ae1d14cd8cc5ece2038ef5085567d1ea2c20dac16a3233db90541
SHA51279dafeb8c37140f53f5645373c2d9f20295e3a8ba92d524a76b68efb5e7c91bb8eb7c9795e345e08755cee5546a506ebe3393172261a3a5dccc54fb200e8978e
-
C:\Users\Admin\AppData\Local\Temp\2C6.exeMD5
b25b80e4ba8d5f18c6149b1a6d19c23f
SHA1a58db136992751701407918c288f2d803259e96c
SHA2563e4c2ba23a7ae1d14cd8cc5ece2038ef5085567d1ea2c20dac16a3233db90541
SHA51279dafeb8c37140f53f5645373c2d9f20295e3a8ba92d524a76b68efb5e7c91bb8eb7c9795e345e08755cee5546a506ebe3393172261a3a5dccc54fb200e8978e
-
memory/872-125-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/872-126-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1312-146-0x0000000002EE0000-0x0000000002EEB000-memory.dmpFilesize
44KB
-
memory/1312-144-0x0000000002EF0000-0x0000000002EF7000-memory.dmpFilesize
28KB
-
memory/1324-141-0x0000000002D00000-0x0000000002D75000-memory.dmpFilesize
468KB
-
memory/1324-142-0x0000000002C90000-0x0000000002CFB000-memory.dmpFilesize
428KB
-
memory/1392-143-0x00000000005F0000-0x00000000005FC000-memory.dmpFilesize
48KB
-
memory/2072-127-0x0000000002BD0000-0x0000000002BE6000-memory.dmpFilesize
88KB
-
memory/2072-121-0x00000000009B0000-0x00000000009C6000-memory.dmpFilesize
88KB
-
memory/2072-130-0x0000000003090000-0x000000000309F000-memory.dmpFilesize
60KB
-
memory/2160-150-0x0000000000B90000-0x0000000000B96000-memory.dmpFilesize
24KB
-
memory/2160-151-0x0000000000B80000-0x0000000000B8C000-memory.dmpFilesize
48KB
-
memory/2428-156-0x00000218823D0000-0x00000218823D1000-memory.dmpFilesize
4KB
-
memory/2464-157-0x00000296F0AD0000-0x00000296F0AD1000-memory.dmpFilesize
4KB
-
memory/2524-119-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/2524-118-0x0000000000660000-0x000000000068A000-memory.dmpFilesize
168KB
-
memory/2524-120-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/2720-160-0x00000212E5160000-0x00000212E5161000-memory.dmpFilesize
4KB
-
memory/2720-158-0x00000212E4E20000-0x00000212E4E21000-memory.dmpFilesize
4KB
-
memory/3196-148-0x0000000003210000-0x0000000003215000-memory.dmpFilesize
20KB
-
memory/3196-149-0x0000000003200000-0x0000000003209000-memory.dmpFilesize
36KB
-
memory/3516-159-0x000002EA652F0000-0x000002EA652F1000-memory.dmpFilesize
4KB
-
memory/3572-145-0x0000000000760000-0x0000000000769000-memory.dmpFilesize
36KB
-
memory/3572-147-0x0000000000750000-0x000000000075E000-memory.dmpFilesize
56KB
-
memory/3780-155-0x0000000000500000-0x000000000050D000-memory.dmpFilesize
52KB
-
memory/3780-154-0x0000000000510000-0x0000000000517000-memory.dmpFilesize
28KB
-
memory/3796-153-0x0000000002A70000-0x0000000002A7B000-memory.dmpFilesize
44KB
-
memory/3796-152-0x0000000002A80000-0x0000000002A86000-memory.dmpFilesize
24KB
-
memory/3936-161-0x000002382EE00000-0x000002382EE01000-memory.dmpFilesize
4KB