Analysis
-
max time kernel
160s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 19:27
Static task
static1
Behavioral task
behavioral1
Sample
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe
Resource
win10-en-20211208
General
-
Target
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe
-
Size
333KB
-
MD5
68882216ae0d8fa14b811ba7be22160e
-
SHA1
a7a93d970edd4aad35ac305eeba88e738f813b32
-
SHA256
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f
-
SHA512
730760cb0fd8dd30344168b1536537c21b1fb01e2dcab1dcda7b04833e892089f3c000d93b82e7a3c0a1ecb4861c26166c40015065350698949cde3c55750186
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
BE3B.exepid process 1656 BE3B.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2928 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3712 3748 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exeBE3B.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE3B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE3B.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE3B.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3180 ipconfig.exe 1264 NETSTAT.EXE 2096 NETSTAT.EXE 964 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD85A7A2-7EDE-11EC-9231-CEA71B6B4E68} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exepid process 3520 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe 3520 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2928 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exeBE3B.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3520 185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe 1656 BE3B.exe 2928 2928 2928 2928 2928 2928 3896 explorer.exe 3896 explorer.exe 2928 2928 1388 explorer.exe 1388 explorer.exe 2928 2928 1192 explorer.exe 1192 explorer.exe 2928 2928 1856 explorer.exe 1856 explorer.exe 2928 2928 3588 explorer.exe 3588 explorer.exe 2928 2928 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe 1320 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2456 WMIC.exe Token: SeSecurityPrivilege 2456 WMIC.exe Token: SeTakeOwnershipPrivilege 2456 WMIC.exe Token: SeLoadDriverPrivilege 2456 WMIC.exe Token: SeSystemProfilePrivilege 2456 WMIC.exe Token: SeSystemtimePrivilege 2456 WMIC.exe Token: SeProfSingleProcessPrivilege 2456 WMIC.exe Token: SeIncBasePriorityPrivilege 2456 WMIC.exe Token: SeCreatePagefilePrivilege 2456 WMIC.exe Token: SeBackupPrivilege 2456 WMIC.exe Token: SeRestorePrivilege 2456 WMIC.exe Token: SeShutdownPrivilege 2456 WMIC.exe Token: SeDebugPrivilege 2456 WMIC.exe Token: SeSystemEnvironmentPrivilege 2456 WMIC.exe Token: SeRemoteShutdownPrivilege 2456 WMIC.exe Token: SeUndockPrivilege 2456 WMIC.exe Token: SeManageVolumePrivilege 2456 WMIC.exe Token: 33 2456 WMIC.exe Token: 34 2456 WMIC.exe Token: 35 2456 WMIC.exe Token: 36 2456 WMIC.exe Token: SeIncreaseQuotaPrivilege 2456 WMIC.exe Token: SeSecurityPrivilege 2456 WMIC.exe Token: SeTakeOwnershipPrivilege 2456 WMIC.exe Token: SeLoadDriverPrivilege 2456 WMIC.exe Token: SeSystemProfilePrivilege 2456 WMIC.exe Token: SeSystemtimePrivilege 2456 WMIC.exe Token: SeProfSingleProcessPrivilege 2456 WMIC.exe Token: SeIncBasePriorityPrivilege 2456 WMIC.exe Token: SeCreatePagefilePrivilege 2456 WMIC.exe Token: SeBackupPrivilege 2456 WMIC.exe Token: SeRestorePrivilege 2456 WMIC.exe Token: SeShutdownPrivilege 2456 WMIC.exe Token: SeDebugPrivilege 2456 WMIC.exe Token: SeSystemEnvironmentPrivilege 2456 WMIC.exe Token: SeRemoteShutdownPrivilege 2456 WMIC.exe Token: SeUndockPrivilege 2456 WMIC.exe Token: SeManageVolumePrivilege 2456 WMIC.exe Token: 33 2456 WMIC.exe Token: 34 2456 WMIC.exe Token: 35 2456 WMIC.exe Token: 36 2456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe Token: SeSecurityPrivilege 1168 WMIC.exe Token: SeTakeOwnershipPrivilege 1168 WMIC.exe Token: SeLoadDriverPrivilege 1168 WMIC.exe Token: SeSystemProfilePrivilege 1168 WMIC.exe Token: SeSystemtimePrivilege 1168 WMIC.exe Token: SeProfSingleProcessPrivilege 1168 WMIC.exe Token: SeIncBasePriorityPrivilege 1168 WMIC.exe Token: SeCreatePagefilePrivilege 1168 WMIC.exe Token: SeBackupPrivilege 1168 WMIC.exe Token: SeRestorePrivilege 1168 WMIC.exe Token: SeShutdownPrivilege 1168 WMIC.exe Token: SeDebugPrivilege 1168 WMIC.exe Token: SeSystemEnvironmentPrivilege 1168 WMIC.exe Token: SeRemoteShutdownPrivilege 1168 WMIC.exe Token: SeUndockPrivilege 1168 WMIC.exe Token: SeManageVolumePrivilege 1168 WMIC.exe Token: 33 1168 WMIC.exe Token: 34 1168 WMIC.exe Token: 35 1168 WMIC.exe Token: 36 1168 WMIC.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1952 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1952 iexplore.exe 1952 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2928 wrote to memory of 1656 2928 BE3B.exe PID 2928 wrote to memory of 1656 2928 BE3B.exe PID 2928 wrote to memory of 1656 2928 BE3B.exe PID 2928 wrote to memory of 1220 2928 cmd.exe PID 2928 wrote to memory of 1220 2928 cmd.exe PID 1220 wrote to memory of 2456 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 2456 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1168 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1168 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1192 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1192 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 2304 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 2304 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1748 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1748 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 360 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 360 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3068 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3068 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3996 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3996 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1624 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1624 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 2604 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 2604 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1460 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1460 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3896 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3896 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3756 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3756 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1600 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 1600 1220 cmd.exe WMIC.exe PID 1220 wrote to memory of 3180 1220 cmd.exe ipconfig.exe PID 1220 wrote to memory of 3180 1220 cmd.exe ipconfig.exe PID 1220 wrote to memory of 3964 1220 cmd.exe ROUTE.EXE PID 1220 wrote to memory of 3964 1220 cmd.exe ROUTE.EXE PID 1220 wrote to memory of 2240 1220 cmd.exe netsh.exe PID 1220 wrote to memory of 2240 1220 cmd.exe netsh.exe PID 1220 wrote to memory of 1876 1220 cmd.exe systeminfo.exe PID 1220 wrote to memory of 1876 1220 cmd.exe systeminfo.exe PID 1220 wrote to memory of 1720 1220 cmd.exe tasklist.exe PID 1220 wrote to memory of 1720 1220 cmd.exe tasklist.exe PID 1220 wrote to memory of 3336 1220 cmd.exe net.exe PID 1220 wrote to memory of 3336 1220 cmd.exe net.exe PID 3336 wrote to memory of 2192 3336 net.exe net1.exe PID 3336 wrote to memory of 2192 3336 net.exe net1.exe PID 1220 wrote to memory of 1436 1220 cmd.exe net.exe PID 1220 wrote to memory of 1436 1220 cmd.exe net.exe PID 1436 wrote to memory of 788 1436 net.exe net1.exe PID 1436 wrote to memory of 788 1436 net.exe net1.exe PID 1220 wrote to memory of 2884 1220 cmd.exe net.exe PID 1220 wrote to memory of 2884 1220 cmd.exe net.exe PID 2884 wrote to memory of 3432 2884 net.exe net1.exe PID 2884 wrote to memory of 3432 2884 net.exe net1.exe PID 1220 wrote to memory of 1168 1220 cmd.exe net.exe PID 1220 wrote to memory of 1168 1220 cmd.exe net.exe PID 1168 wrote to memory of 1780 1168 net.exe net1.exe PID 1168 wrote to memory of 1780 1168 net.exe net1.exe PID 1220 wrote to memory of 2304 1220 cmd.exe net.exe PID 1220 wrote to memory of 2304 1220 cmd.exe net.exe PID 1220 wrote to memory of 2384 1220 cmd.exe net.exe PID 1220 wrote to memory of 2384 1220 cmd.exe net.exe PID 2384 wrote to memory of 3088 2384 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3748 -s 9122⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe"C:\Users\Admin\AppData\Local\Temp\185f31c8b72589a82fd2487b4fc5c55df08aa0f9e981a69022395ec57c2ae44f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BE3B.exeC:\Users\Admin\AppData\Local\Temp\BE3B.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BE3B.exeMD5
b25b80e4ba8d5f18c6149b1a6d19c23f
SHA1a58db136992751701407918c288f2d803259e96c
SHA2563e4c2ba23a7ae1d14cd8cc5ece2038ef5085567d1ea2c20dac16a3233db90541
SHA51279dafeb8c37140f53f5645373c2d9f20295e3a8ba92d524a76b68efb5e7c91bb8eb7c9795e345e08755cee5546a506ebe3393172261a3a5dccc54fb200e8978e
-
C:\Users\Admin\AppData\Local\Temp\BE3B.exeMD5
b25b80e4ba8d5f18c6149b1a6d19c23f
SHA1a58db136992751701407918c288f2d803259e96c
SHA2563e4c2ba23a7ae1d14cd8cc5ece2038ef5085567d1ea2c20dac16a3233db90541
SHA51279dafeb8c37140f53f5645373c2d9f20295e3a8ba92d524a76b68efb5e7c91bb8eb7c9795e345e08755cee5546a506ebe3393172261a3a5dccc54fb200e8978e
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1192-143-0x00000000007E0000-0x00000000007E9000-memory.dmpFilesize
36KB
-
memory/1192-142-0x00000000007F0000-0x00000000007F5000-memory.dmpFilesize
20KB
-
memory/1320-149-0x00000000004C0000-0x00000000004CD000-memory.dmpFilesize
52KB
-
memory/1320-148-0x00000000004D0000-0x00000000004D7000-memory.dmpFilesize
28KB
-
memory/1388-140-0x0000000000C10000-0x0000000000C19000-memory.dmpFilesize
36KB
-
memory/1388-141-0x0000000000C00000-0x0000000000C0E000-memory.dmpFilesize
56KB
-
memory/1656-123-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1656-122-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/1856-145-0x0000000000B50000-0x0000000000B5C000-memory.dmpFilesize
48KB
-
memory/1856-144-0x0000000000B60000-0x0000000000B66000-memory.dmpFilesize
24KB
-
memory/2200-135-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/2200-136-0x0000000000120000-0x000000000018B000-memory.dmpFilesize
428KB
-
memory/2336-150-0x000001F14CDF0000-0x000001F14CDF1000-memory.dmpFilesize
4KB
-
memory/2348-151-0x0000028563A10000-0x0000028563A11000-memory.dmpFilesize
4KB
-
memory/2436-152-0x000001EF82620000-0x000001EF82621000-memory.dmpFilesize
4KB
-
memory/2436-154-0x000001EF82960000-0x000001EF82961000-memory.dmpFilesize
4KB
-
memory/2928-118-0x0000000000680000-0x0000000000696000-memory.dmpFilesize
88KB
-
memory/2928-127-0x0000000002720000-0x000000000272F000-memory.dmpFilesize
60KB
-
memory/2928-124-0x0000000001FE0000-0x00000000020F8000-memory.dmpFilesize
1.1MB
-
memory/3496-153-0x000002E181BE0000-0x000002E181BE1000-memory.dmpFilesize
4KB
-
memory/3520-116-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/3520-117-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3520-115-0x0000000000780000-0x00000000007AA000-memory.dmpFilesize
168KB
-
memory/3588-147-0x0000000000C60000-0x0000000000C6B000-memory.dmpFilesize
44KB
-
memory/3588-146-0x0000000000C70000-0x0000000000C76000-memory.dmpFilesize
24KB
-
memory/3712-155-0x0000029740FB0000-0x0000029740FB1000-memory.dmpFilesize
4KB
-
memory/3768-137-0x00000000010A0000-0x00000000010AC000-memory.dmpFilesize
48KB
-
memory/3896-139-0x0000000000B70000-0x0000000000B7B000-memory.dmpFilesize
44KB
-
memory/3896-138-0x0000000000B80000-0x0000000000B87000-memory.dmpFilesize
28KB