Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 02:55
Static task
static1
Behavioral task
behavioral1
Sample
4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe
Resource
win10-en-20211208
General
-
Target
4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe
-
Size
240KB
-
MD5
c04847618a2ce3ab3d2e772157340d48
-
SHA1
f00fca96dfc403f5292105abc92195075eaf33ff
-
SHA256
4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60
-
SHA512
69fda5d895db56e2a9da4ef52904374631bdb46859f8ae6a301929136e28beb416cf9222ded28f379940c41b23abd2ebe59057876d9c9dd89bd825089edabb27
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
99AC.exepid process 520 99AC.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3220 3736 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
99AC.exe4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99AC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99AC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99AC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3944 ipconfig.exe 1116 NETSTAT.EXE 2744 NETSTAT.EXE 3668 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6513191-7F1C-11EC-876A-EEE0EE18725B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2877802126" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2877802126" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30937897" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937897" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exepid process 2496 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe 2496 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 44 IoCs
Processes:
4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe99AC.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2496 4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe 520 99AC.exe 3032 3032 3032 3032 3032 3032 3588 explorer.exe 3588 explorer.exe 3032 3032 3312 explorer.exe 3312 explorer.exe 3032 3032 2188 explorer.exe 2188 explorer.exe 3032 3032 1164 explorer.exe 1164 explorer.exe 3032 3032 2728 explorer.exe 2728 explorer.exe 3032 3032 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe 3156 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 404 WMIC.exe Token: SeSecurityPrivilege 404 WMIC.exe Token: SeTakeOwnershipPrivilege 404 WMIC.exe Token: SeLoadDriverPrivilege 404 WMIC.exe Token: SeSystemProfilePrivilege 404 WMIC.exe Token: SeSystemtimePrivilege 404 WMIC.exe Token: SeProfSingleProcessPrivilege 404 WMIC.exe Token: SeIncBasePriorityPrivilege 404 WMIC.exe Token: SeCreatePagefilePrivilege 404 WMIC.exe Token: SeBackupPrivilege 404 WMIC.exe Token: SeRestorePrivilege 404 WMIC.exe Token: SeShutdownPrivilege 404 WMIC.exe Token: SeDebugPrivilege 404 WMIC.exe Token: SeSystemEnvironmentPrivilege 404 WMIC.exe Token: SeRemoteShutdownPrivilege 404 WMIC.exe Token: SeUndockPrivilege 404 WMIC.exe Token: SeManageVolumePrivilege 404 WMIC.exe Token: 33 404 WMIC.exe Token: 34 404 WMIC.exe Token: 35 404 WMIC.exe Token: 36 404 WMIC.exe Token: SeIncreaseQuotaPrivilege 404 WMIC.exe Token: SeSecurityPrivilege 404 WMIC.exe Token: SeTakeOwnershipPrivilege 404 WMIC.exe Token: SeLoadDriverPrivilege 404 WMIC.exe Token: SeSystemProfilePrivilege 404 WMIC.exe Token: SeSystemtimePrivilege 404 WMIC.exe Token: SeProfSingleProcessPrivilege 404 WMIC.exe Token: SeIncBasePriorityPrivilege 404 WMIC.exe Token: SeCreatePagefilePrivilege 404 WMIC.exe Token: SeBackupPrivilege 404 WMIC.exe Token: SeRestorePrivilege 404 WMIC.exe Token: SeShutdownPrivilege 404 WMIC.exe Token: SeDebugPrivilege 404 WMIC.exe Token: SeSystemEnvironmentPrivilege 404 WMIC.exe Token: SeRemoteShutdownPrivilege 404 WMIC.exe Token: SeUndockPrivilege 404 WMIC.exe Token: SeManageVolumePrivilege 404 WMIC.exe Token: 33 404 WMIC.exe Token: 34 404 WMIC.exe Token: 35 404 WMIC.exe Token: 36 404 WMIC.exe Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe Token: SeSecurityPrivilege 2744 WMIC.exe Token: SeTakeOwnershipPrivilege 2744 WMIC.exe Token: SeLoadDriverPrivilege 2744 WMIC.exe Token: SeSystemProfilePrivilege 2744 WMIC.exe Token: SeSystemtimePrivilege 2744 WMIC.exe Token: SeProfSingleProcessPrivilege 2744 WMIC.exe Token: SeIncBasePriorityPrivilege 2744 WMIC.exe Token: SeCreatePagefilePrivilege 2744 WMIC.exe Token: SeBackupPrivilege 2744 WMIC.exe Token: SeRestorePrivilege 2744 WMIC.exe Token: SeShutdownPrivilege 2744 WMIC.exe Token: SeDebugPrivilege 2744 WMIC.exe Token: SeSystemEnvironmentPrivilege 2744 WMIC.exe Token: SeRemoteShutdownPrivilege 2744 WMIC.exe Token: SeUndockPrivilege 2744 WMIC.exe Token: SeManageVolumePrivilege 2744 WMIC.exe Token: 33 2744 WMIC.exe Token: 34 2744 WMIC.exe Token: 35 2744 WMIC.exe Token: 36 2744 WMIC.exe Token: SeIncreaseQuotaPrivilege 2744 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3952 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3952 iexplore.exe 3952 iexplore.exe 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3032 wrote to memory of 520 3032 99AC.exe PID 3032 wrote to memory of 520 3032 99AC.exe PID 3032 wrote to memory of 520 3032 99AC.exe PID 3032 wrote to memory of 1052 3032 cmd.exe PID 3032 wrote to memory of 1052 3032 cmd.exe PID 1052 wrote to memory of 404 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 404 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2744 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2744 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1316 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1316 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1420 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1420 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2212 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2212 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2128 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2128 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1476 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1476 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2052 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2052 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2388 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 2388 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3212 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3212 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3584 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3584 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3164 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3164 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1904 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1904 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1196 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 1196 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 3944 1052 cmd.exe ipconfig.exe PID 1052 wrote to memory of 3944 1052 cmd.exe ipconfig.exe PID 1052 wrote to memory of 2180 1052 cmd.exe ROUTE.EXE PID 1052 wrote to memory of 2180 1052 cmd.exe ROUTE.EXE PID 1052 wrote to memory of 2836 1052 cmd.exe netsh.exe PID 1052 wrote to memory of 2836 1052 cmd.exe netsh.exe PID 1052 wrote to memory of 1244 1052 cmd.exe systeminfo.exe PID 1052 wrote to memory of 1244 1052 cmd.exe systeminfo.exe PID 1052 wrote to memory of 2620 1052 cmd.exe tasklist.exe PID 1052 wrote to memory of 2620 1052 cmd.exe tasklist.exe PID 1052 wrote to memory of 656 1052 cmd.exe net.exe PID 1052 wrote to memory of 656 1052 cmd.exe net.exe PID 656 wrote to memory of 1792 656 net.exe net1.exe PID 656 wrote to memory of 1792 656 net.exe net1.exe PID 1052 wrote to memory of 664 1052 cmd.exe net.exe PID 1052 wrote to memory of 664 1052 cmd.exe net.exe PID 664 wrote to memory of 3992 664 net.exe net1.exe PID 664 wrote to memory of 3992 664 net.exe net1.exe PID 1052 wrote to memory of 3640 1052 cmd.exe net.exe PID 1052 wrote to memory of 3640 1052 cmd.exe net.exe PID 3640 wrote to memory of 3152 3640 net.exe net1.exe PID 3640 wrote to memory of 3152 3640 net.exe net1.exe PID 1052 wrote to memory of 3948 1052 cmd.exe net.exe PID 1052 wrote to memory of 3948 1052 cmd.exe net.exe PID 3948 wrote to memory of 2508 3948 net.exe net1.exe PID 3948 wrote to memory of 2508 3948 net.exe net1.exe PID 1052 wrote to memory of 3936 1052 cmd.exe net.exe PID 1052 wrote to memory of 3936 1052 cmd.exe net.exe PID 1052 wrote to memory of 3328 1052 cmd.exe net.exe PID 1052 wrote to memory of 3328 1052 cmd.exe net.exe PID 3328 wrote to memory of 680 3328 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3736 -s 9242⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe"C:\Users\Admin\AppData\Local\Temp\4e5d804077ba8a7c49ee9a6a8840333c0a0c3245792145c47c7a1fbce7d00f60.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\99AC.exeC:\Users\Admin\AppData\Local\Temp\99AC.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3952 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\99AC.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
C:\Users\Admin\AppData\Local\Temp\99AC.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
memory/520-122-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/520-123-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1164-143-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/1164-144-0x00000000008A0000-0x00000000008AC000-memory.dmpFilesize
48KB
-
memory/1736-136-0x0000000000E00000-0x0000000000E6B000-memory.dmpFilesize
428KB
-
memory/1736-135-0x0000000000E70000-0x0000000000EE5000-memory.dmpFilesize
468KB
-
memory/2188-141-0x0000000000A80000-0x0000000000A85000-memory.dmpFilesize
20KB
-
memory/2188-142-0x0000000000A70000-0x0000000000A79000-memory.dmpFilesize
36KB
-
memory/2344-149-0x000002A016180000-0x000002A016181000-memory.dmpFilesize
4KB
-
memory/2360-150-0x000001D017E70000-0x000001D017E71000-memory.dmpFilesize
4KB
-
memory/2496-115-0x00000000006D0000-0x00000000006F3000-memory.dmpFilesize
140KB
-
memory/2496-117-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2496-116-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/2532-151-0x00000263D3C40000-0x00000263D3C41000-memory.dmpFilesize
4KB
-
memory/2728-145-0x0000000000C70000-0x0000000000C76000-memory.dmpFilesize
24KB
-
memory/2728-146-0x0000000000C60000-0x0000000000C6B000-memory.dmpFilesize
44KB
-
memory/3032-127-0x0000000003350000-0x000000000335F000-memory.dmpFilesize
60KB
-
memory/3032-124-0x0000000002D10000-0x0000000002D26000-memory.dmpFilesize
88KB
-
memory/3032-118-0x0000000001050000-0x0000000001066000-memory.dmpFilesize
88KB
-
memory/3100-134-0x0000000000D50000-0x0000000000D5C000-memory.dmpFilesize
48KB
-
memory/3156-147-0x00000000001E0000-0x00000000001E7000-memory.dmpFilesize
28KB
-
memory/3156-148-0x00000000001D0000-0x00000000001DD000-memory.dmpFilesize
52KB
-
memory/3312-140-0x0000000001200000-0x000000000120E000-memory.dmpFilesize
56KB
-
memory/3312-139-0x0000000001210000-0x0000000001219000-memory.dmpFilesize
36KB
-
memory/3456-152-0x000001D061B80000-0x000001D061B81000-memory.dmpFilesize
4KB
-
memory/3588-138-0x0000000000120000-0x000000000012B000-memory.dmpFilesize
44KB
-
memory/3588-137-0x0000000000130000-0x0000000000137000-memory.dmpFilesize
28KB