Analysis
-
max time kernel
158s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 01:55
Static task
static1
Behavioral task
behavioral1
Sample
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe
Resource
win10-en-20211208
General
-
Target
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe
-
Size
241KB
-
MD5
120bfcda4022367bbe1e56b3308acdf8
-
SHA1
ff591145be5a1da563ea6c0e21c2e2216857583a
-
SHA256
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9
-
SHA512
284417ed1c7226dcdf3ab9887b394aa639804d830afe488877bc3f90bf8c951beabd38aa56d3a887d3bd2f9c4df3cd2491670138509d72d8dd84f53fcf20c68b
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
6E66.exepid process 3984 6E66.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3320 3680 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe6E66.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6E66.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6E66.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6E66.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXENETSTAT.EXEipconfig.exeipconfig.exepid process 1924 NETSTAT.EXE 3800 NETSTAT.EXE 3224 ipconfig.exe 2700 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAAF3C80-7EE2-11EC-9231-F22DA63300E1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exepid process 2716 db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe 2716 db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe6E66.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2716 db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe 3984 6E66.exe 3032 3032 3032 3032 3032 3032 3208 explorer.exe 3208 explorer.exe 3032 3032 2160 explorer.exe 2160 explorer.exe 3032 3032 3844 explorer.exe 3844 explorer.exe 3032 3032 3944 explorer.exe 3944 explorer.exe 3032 3032 3900 explorer.exe 3900 explorer.exe 3032 3032 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe 3488 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 864 WMIC.exe Token: SeSecurityPrivilege 864 WMIC.exe Token: SeTakeOwnershipPrivilege 864 WMIC.exe Token: SeLoadDriverPrivilege 864 WMIC.exe Token: SeSystemProfilePrivilege 864 WMIC.exe Token: SeSystemtimePrivilege 864 WMIC.exe Token: SeProfSingleProcessPrivilege 864 WMIC.exe Token: SeIncBasePriorityPrivilege 864 WMIC.exe Token: SeCreatePagefilePrivilege 864 WMIC.exe Token: SeBackupPrivilege 864 WMIC.exe Token: SeRestorePrivilege 864 WMIC.exe Token: SeShutdownPrivilege 864 WMIC.exe Token: SeDebugPrivilege 864 WMIC.exe Token: SeSystemEnvironmentPrivilege 864 WMIC.exe Token: SeRemoteShutdownPrivilege 864 WMIC.exe Token: SeUndockPrivilege 864 WMIC.exe Token: SeManageVolumePrivilege 864 WMIC.exe Token: 33 864 WMIC.exe Token: 34 864 WMIC.exe Token: 35 864 WMIC.exe Token: 36 864 WMIC.exe Token: SeIncreaseQuotaPrivilege 864 WMIC.exe Token: SeSecurityPrivilege 864 WMIC.exe Token: SeTakeOwnershipPrivilege 864 WMIC.exe Token: SeLoadDriverPrivilege 864 WMIC.exe Token: SeSystemProfilePrivilege 864 WMIC.exe Token: SeSystemtimePrivilege 864 WMIC.exe Token: SeProfSingleProcessPrivilege 864 WMIC.exe Token: SeIncBasePriorityPrivilege 864 WMIC.exe Token: SeCreatePagefilePrivilege 864 WMIC.exe Token: SeBackupPrivilege 864 WMIC.exe Token: SeRestorePrivilege 864 WMIC.exe Token: SeShutdownPrivilege 864 WMIC.exe Token: SeDebugPrivilege 864 WMIC.exe Token: SeSystemEnvironmentPrivilege 864 WMIC.exe Token: SeRemoteShutdownPrivilege 864 WMIC.exe Token: SeUndockPrivilege 864 WMIC.exe Token: SeManageVolumePrivilege 864 WMIC.exe Token: 33 864 WMIC.exe Token: 34 864 WMIC.exe Token: 35 864 WMIC.exe Token: 36 864 WMIC.exe Token: SeIncreaseQuotaPrivilege 3476 WMIC.exe Token: SeSecurityPrivilege 3476 WMIC.exe Token: SeTakeOwnershipPrivilege 3476 WMIC.exe Token: SeLoadDriverPrivilege 3476 WMIC.exe Token: SeSystemProfilePrivilege 3476 WMIC.exe Token: SeSystemtimePrivilege 3476 WMIC.exe Token: SeProfSingleProcessPrivilege 3476 WMIC.exe Token: SeIncBasePriorityPrivilege 3476 WMIC.exe Token: SeCreatePagefilePrivilege 3476 WMIC.exe Token: SeBackupPrivilege 3476 WMIC.exe Token: SeRestorePrivilege 3476 WMIC.exe Token: SeShutdownPrivilege 3476 WMIC.exe Token: SeDebugPrivilege 3476 WMIC.exe Token: SeSystemEnvironmentPrivilege 3476 WMIC.exe Token: SeRemoteShutdownPrivilege 3476 WMIC.exe Token: SeUndockPrivilege 3476 WMIC.exe Token: SeManageVolumePrivilege 3476 WMIC.exe Token: 33 3476 WMIC.exe Token: 34 3476 WMIC.exe Token: 35 3476 WMIC.exe Token: 36 3476 WMIC.exe Token: SeIncreaseQuotaPrivilege 3476 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3276 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3276 iexplore.exe 3276 iexplore.exe 3928 IEXPLORE.EXE 3928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3032 wrote to memory of 3984 3032 6E66.exe PID 3032 wrote to memory of 3984 3032 6E66.exe PID 3032 wrote to memory of 3984 3032 6E66.exe PID 3032 wrote to memory of 944 3032 cmd.exe PID 3032 wrote to memory of 944 3032 cmd.exe PID 944 wrote to memory of 864 944 cmd.exe WMIC.exe PID 944 wrote to memory of 864 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3476 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3476 944 cmd.exe WMIC.exe PID 944 wrote to memory of 344 944 cmd.exe WMIC.exe PID 944 wrote to memory of 344 944 cmd.exe WMIC.exe PID 944 wrote to memory of 960 944 cmd.exe WMIC.exe PID 944 wrote to memory of 960 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3948 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3948 944 cmd.exe WMIC.exe PID 944 wrote to memory of 2156 944 cmd.exe WMIC.exe PID 944 wrote to memory of 2156 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1608 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1608 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3616 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3616 944 cmd.exe WMIC.exe PID 944 wrote to memory of 2480 944 cmd.exe WMIC.exe PID 944 wrote to memory of 2480 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3176 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3176 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3692 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3692 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1776 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1776 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1016 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1016 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3900 944 cmd.exe WMIC.exe PID 944 wrote to memory of 3900 944 cmd.exe WMIC.exe PID 944 wrote to memory of 2700 944 cmd.exe ipconfig.exe PID 944 wrote to memory of 2700 944 cmd.exe ipconfig.exe PID 944 wrote to memory of 3488 944 cmd.exe ROUTE.EXE PID 944 wrote to memory of 3488 944 cmd.exe ROUTE.EXE PID 944 wrote to memory of 3956 944 cmd.exe netsh.exe PID 944 wrote to memory of 3956 944 cmd.exe netsh.exe PID 944 wrote to memory of 3988 944 cmd.exe systeminfo.exe PID 944 wrote to memory of 3988 944 cmd.exe systeminfo.exe PID 944 wrote to memory of 812 944 cmd.exe tasklist.exe PID 944 wrote to memory of 812 944 cmd.exe tasklist.exe PID 944 wrote to memory of 2264 944 cmd.exe net.exe PID 944 wrote to memory of 2264 944 cmd.exe net.exe PID 2264 wrote to memory of 2076 2264 net.exe net1.exe PID 2264 wrote to memory of 2076 2264 net.exe net1.exe PID 944 wrote to memory of 1280 944 cmd.exe net.exe PID 944 wrote to memory of 1280 944 cmd.exe net.exe PID 1280 wrote to memory of 2492 1280 net.exe net1.exe PID 1280 wrote to memory of 2492 1280 net.exe net1.exe PID 944 wrote to memory of 1000 944 cmd.exe net.exe PID 944 wrote to memory of 1000 944 cmd.exe net.exe PID 1000 wrote to memory of 3552 1000 net.exe net1.exe PID 1000 wrote to memory of 3552 1000 net.exe net1.exe PID 944 wrote to memory of 1140 944 cmd.exe net.exe PID 944 wrote to memory of 1140 944 cmd.exe net.exe PID 1140 wrote to memory of 1412 1140 net.exe net1.exe PID 1140 wrote to memory of 1412 1140 net.exe net1.exe PID 944 wrote to memory of 3916 944 cmd.exe net.exe PID 944 wrote to memory of 3916 944 cmd.exe net.exe PID 944 wrote to memory of 364 944 cmd.exe net.exe PID 944 wrote to memory of 364 944 cmd.exe net.exe PID 364 wrote to memory of 3952 364 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3680 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe"C:\Users\Admin\AppData\Local\Temp\db5ea894beb5c55f094286d26409297ed69628a29003eb69d6c57e2f9bf569b9.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6E66.exeC:\Users\Admin\AppData\Local\Temp\6E66.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3276 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6E66.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
C:\Users\Admin\AppData\Local\Temp\6E66.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
memory/2160-140-0x0000000000F10000-0x0000000000F1E000-memory.dmpFilesize
56KB
-
memory/2160-139-0x0000000000F20000-0x0000000000F29000-memory.dmpFilesize
36KB
-
memory/2348-149-0x000001A8997C0000-0x000001A8997C1000-memory.dmpFilesize
4KB
-
memory/2360-150-0x0000023CE0EE0000-0x0000023CE0EE1000-memory.dmpFilesize
4KB
-
memory/2716-117-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2716-116-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/2740-153-0x00000252F3780000-0x00000252F3781000-memory.dmpFilesize
4KB
-
memory/2740-151-0x00000252F3440000-0x00000252F3441000-memory.dmpFilesize
4KB
-
memory/2820-134-0x0000000000C70000-0x0000000000CE5000-memory.dmpFilesize
468KB
-
memory/2820-135-0x0000000000C00000-0x0000000000C6B000-memory.dmpFilesize
428KB
-
memory/3032-127-0x0000000004980000-0x000000000498F000-memory.dmpFilesize
60KB
-
memory/3032-124-0x0000000002E80000-0x0000000002E96000-memory.dmpFilesize
88KB
-
memory/3032-118-0x00000000010E0000-0x00000000010F6000-memory.dmpFilesize
88KB
-
memory/3068-136-0x0000000000360000-0x000000000036C000-memory.dmpFilesize
48KB
-
memory/3208-138-0x00000000034C0000-0x00000000034CB000-memory.dmpFilesize
44KB
-
memory/3208-137-0x00000000034D0000-0x00000000034D7000-memory.dmpFilesize
28KB
-
memory/3320-154-0x0000029B71460000-0x0000029B71461000-memory.dmpFilesize
4KB
-
memory/3452-152-0x00000201AF870000-0x00000201AF871000-memory.dmpFilesize
4KB
-
memory/3488-148-0x0000000000D80000-0x0000000000D8D000-memory.dmpFilesize
52KB
-
memory/3488-147-0x0000000000D90000-0x0000000000D97000-memory.dmpFilesize
28KB
-
memory/3844-141-0x0000000000190000-0x0000000000195000-memory.dmpFilesize
20KB
-
memory/3844-142-0x0000000000180000-0x0000000000189000-memory.dmpFilesize
36KB
-
memory/3900-145-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/3900-146-0x00000000001E0000-0x00000000001EB000-memory.dmpFilesize
44KB
-
memory/3944-144-0x0000000000960000-0x000000000096C000-memory.dmpFilesize
48KB
-
memory/3944-143-0x0000000000970000-0x0000000000976000-memory.dmpFilesize
24KB
-
memory/3984-123-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3984-122-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/3984-121-0x0000000000660000-0x0000000000683000-memory.dmpFilesize
140KB