Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 05:12
Static task
static1
Behavioral task
behavioral1
Sample
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe
Resource
win10-en-20211208
General
-
Target
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe
-
Size
239KB
-
MD5
b683d3c9f84ab47199db9ac37701452f
-
SHA1
fa8c4e3b8104b48908d79d90ae714e97c6ba2b4c
-
SHA256
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71
-
SHA512
245ba76a7731836ccaa9e80e0c4650fd5abc062dc29158b4a1e57b6b36c2cba08a2cba4e07df1b039af03a6207ed17a4884ea83c41e88c4a7ce3b977396b7d42
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2896 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2844 3924 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2836 ipconfig.exe 1284 NETSTAT.EXE 1528 NETSTAT.EXE 3104 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D215F58E-5A1B-11EC-876A-D241B17F579F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exepid process 380 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe 380 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 2896 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2896 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 380 95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe 2896 2896 2896 2896 2896 2896 3872 explorer.exe 3872 explorer.exe 2896 2896 1276 explorer.exe 1276 explorer.exe 2896 2896 1512 explorer.exe 1512 explorer.exe 2896 2896 432 explorer.exe 432 explorer.exe 2896 2896 520 explorer.exe 520 explorer.exe 2896 2896 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe Token: SeSecurityPrivilege 2232 WMIC.exe Token: SeTakeOwnershipPrivilege 2232 WMIC.exe Token: SeLoadDriverPrivilege 2232 WMIC.exe Token: SeSystemProfilePrivilege 2232 WMIC.exe Token: SeSystemtimePrivilege 2232 WMIC.exe Token: SeProfSingleProcessPrivilege 2232 WMIC.exe Token: SeIncBasePriorityPrivilege 2232 WMIC.exe Token: SeCreatePagefilePrivilege 2232 WMIC.exe Token: SeBackupPrivilege 2232 WMIC.exe Token: SeRestorePrivilege 2232 WMIC.exe Token: SeShutdownPrivilege 2232 WMIC.exe Token: SeDebugPrivilege 2232 WMIC.exe Token: SeSystemEnvironmentPrivilege 2232 WMIC.exe Token: SeRemoteShutdownPrivilege 2232 WMIC.exe Token: SeUndockPrivilege 2232 WMIC.exe Token: SeManageVolumePrivilege 2232 WMIC.exe Token: 33 2232 WMIC.exe Token: 34 2232 WMIC.exe Token: 35 2232 WMIC.exe Token: 36 2232 WMIC.exe Token: SeIncreaseQuotaPrivilege 2232 WMIC.exe Token: SeSecurityPrivilege 2232 WMIC.exe Token: SeTakeOwnershipPrivilege 2232 WMIC.exe Token: SeLoadDriverPrivilege 2232 WMIC.exe Token: SeSystemProfilePrivilege 2232 WMIC.exe Token: SeSystemtimePrivilege 2232 WMIC.exe Token: SeProfSingleProcessPrivilege 2232 WMIC.exe Token: SeIncBasePriorityPrivilege 2232 WMIC.exe Token: SeCreatePagefilePrivilege 2232 WMIC.exe Token: SeBackupPrivilege 2232 WMIC.exe Token: SeRestorePrivilege 2232 WMIC.exe Token: SeShutdownPrivilege 2232 WMIC.exe Token: SeDebugPrivilege 2232 WMIC.exe Token: SeSystemEnvironmentPrivilege 2232 WMIC.exe Token: SeRemoteShutdownPrivilege 2232 WMIC.exe Token: SeUndockPrivilege 2232 WMIC.exe Token: SeManageVolumePrivilege 2232 WMIC.exe Token: 33 2232 WMIC.exe Token: 34 2232 WMIC.exe Token: 35 2232 WMIC.exe Token: 36 2232 WMIC.exe Token: SeIncreaseQuotaPrivilege 1404 WMIC.exe Token: SeSecurityPrivilege 1404 WMIC.exe Token: SeTakeOwnershipPrivilege 1404 WMIC.exe Token: SeLoadDriverPrivilege 1404 WMIC.exe Token: SeSystemProfilePrivilege 1404 WMIC.exe Token: SeSystemtimePrivilege 1404 WMIC.exe Token: SeProfSingleProcessPrivilege 1404 WMIC.exe Token: SeIncBasePriorityPrivilege 1404 WMIC.exe Token: SeCreatePagefilePrivilege 1404 WMIC.exe Token: SeBackupPrivilege 1404 WMIC.exe Token: SeRestorePrivilege 1404 WMIC.exe Token: SeShutdownPrivilege 1404 WMIC.exe Token: SeDebugPrivilege 1404 WMIC.exe Token: SeSystemEnvironmentPrivilege 1404 WMIC.exe Token: SeRemoteShutdownPrivilege 1404 WMIC.exe Token: SeUndockPrivilege 1404 WMIC.exe Token: SeManageVolumePrivilege 1404 WMIC.exe Token: 33 1404 WMIC.exe Token: 34 1404 WMIC.exe Token: 35 1404 WMIC.exe Token: 36 1404 WMIC.exe Token: SeIncreaseQuotaPrivilege 1404 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1720 iexplore.exe 1720 iexplore.exe 1880 IEXPLORE.EXE 1880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2896 wrote to memory of 3980 2896 cmd.exe PID 2896 wrote to memory of 3980 2896 cmd.exe PID 3980 wrote to memory of 2232 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2232 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1404 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1404 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3272 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3272 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 652 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 652 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2768 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2768 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2860 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2860 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1572 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1572 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1724 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1724 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1948 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 1948 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2892 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2892 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3052 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3052 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3076 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3076 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3964 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3964 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3312 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 3312 3980 cmd.exe WMIC.exe PID 3980 wrote to memory of 2836 3980 cmd.exe ipconfig.exe PID 3980 wrote to memory of 2836 3980 cmd.exe ipconfig.exe PID 3980 wrote to memory of 2496 3980 cmd.exe ROUTE.EXE PID 3980 wrote to memory of 2496 3980 cmd.exe ROUTE.EXE PID 3980 wrote to memory of 4032 3980 cmd.exe netsh.exe PID 3980 wrote to memory of 4032 3980 cmd.exe netsh.exe PID 3980 wrote to memory of 492 3980 cmd.exe systeminfo.exe PID 3980 wrote to memory of 492 3980 cmd.exe systeminfo.exe PID 3980 wrote to memory of 3292 3980 cmd.exe tasklist.exe PID 3980 wrote to memory of 3292 3980 cmd.exe tasklist.exe PID 3980 wrote to memory of 3212 3980 cmd.exe net.exe PID 3980 wrote to memory of 3212 3980 cmd.exe net.exe PID 3212 wrote to memory of 3276 3212 net.exe net1.exe PID 3212 wrote to memory of 3276 3212 net.exe net1.exe PID 3980 wrote to memory of 1660 3980 cmd.exe net.exe PID 3980 wrote to memory of 1660 3980 cmd.exe net.exe PID 1660 wrote to memory of 520 1660 net.exe net1.exe PID 1660 wrote to memory of 520 1660 net.exe net1.exe PID 3980 wrote to memory of 1772 3980 cmd.exe net.exe PID 3980 wrote to memory of 1772 3980 cmd.exe net.exe PID 1772 wrote to memory of 344 1772 net.exe net1.exe PID 1772 wrote to memory of 344 1772 net.exe net1.exe PID 3980 wrote to memory of 2792 3980 cmd.exe net.exe PID 3980 wrote to memory of 2792 3980 cmd.exe net.exe PID 2792 wrote to memory of 396 2792 net.exe net1.exe PID 2792 wrote to memory of 396 2792 net.exe net1.exe PID 3980 wrote to memory of 1540 3980 cmd.exe net.exe PID 3980 wrote to memory of 1540 3980 cmd.exe net.exe PID 3980 wrote to memory of 364 3980 cmd.exe net.exe PID 3980 wrote to memory of 364 3980 cmd.exe net.exe PID 364 wrote to memory of 940 364 net.exe net1.exe PID 364 wrote to memory of 940 364 net.exe net1.exe PID 3980 wrote to memory of 1648 3980 cmd.exe net.exe PID 3980 wrote to memory of 1648 3980 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3924 -s 9042⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe"C:\Users\Admin\AppData\Local\Temp\95d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-116-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/380-117-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/432-137-0x0000000000D60000-0x0000000000D66000-memory.dmpFilesize
24KB
-
memory/432-138-0x0000000000D50000-0x0000000000D5C000-memory.dmpFilesize
48KB
-
memory/520-139-0x0000000000670000-0x0000000000676000-memory.dmpFilesize
24KB
-
memory/520-140-0x0000000000660000-0x000000000066B000-memory.dmpFilesize
44KB
-
memory/1276-133-0x00000000008F0000-0x00000000008F9000-memory.dmpFilesize
36KB
-
memory/1276-134-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB
-
memory/1512-135-0x0000000000AB0000-0x0000000000AB5000-memory.dmpFilesize
20KB
-
memory/1512-136-0x0000000000AA0000-0x0000000000AA9000-memory.dmpFilesize
36KB
-
memory/2340-143-0x0000021074920000-0x0000021074921000-memory.dmpFilesize
4KB
-
memory/2360-144-0x000001A6B28E0000-0x000001A6B28E1000-memory.dmpFilesize
4KB
-
memory/2476-145-0x000001E6BE640000-0x000001E6BE641000-memory.dmpFilesize
4KB
-
memory/2476-147-0x000001E6BE980000-0x000001E6BE981000-memory.dmpFilesize
4KB
-
memory/2484-130-0x0000000000800000-0x000000000086B000-memory.dmpFilesize
428KB
-
memory/2484-129-0x0000000000870000-0x00000000008E5000-memory.dmpFilesize
468KB
-
memory/2844-148-0x00000184EAF20000-0x00000184EAF21000-memory.dmpFilesize
4KB
-
memory/2896-121-0x0000000000B10000-0x0000000000B1F000-memory.dmpFilesize
60KB
-
memory/2896-118-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/3060-141-0x0000000000DE0000-0x0000000000DE7000-memory.dmpFilesize
28KB
-
memory/3060-142-0x0000000000DD0000-0x0000000000DDD000-memory.dmpFilesize
52KB
-
memory/3644-146-0x0000025EE7E40000-0x0000025EE7E41000-memory.dmpFilesize
4KB
-
memory/3872-132-0x0000000003430000-0x000000000343B000-memory.dmpFilesize
44KB
-
memory/3872-131-0x0000000003440000-0x0000000003447000-memory.dmpFilesize
28KB
-
memory/3896-128-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB