Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 06:29
Static task
static1
Behavioral task
behavioral1
Sample
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe
Resource
win10-en-20211208
General
-
Target
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe
-
Size
241KB
-
MD5
2bb802612298fc592a0f79ebc3181bbf
-
SHA1
1985dbcd6dcdb1ad0ba6b0f0a238e9f61f021c97
-
SHA256
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31
-
SHA512
c34212c60a10d6b122199502f115cec843e9cccdb7af21a1cad7680dd73ba38142c1783a639369deb64e51ec7d0216cbc2aa73990becba0210a478d030c95bf2
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
16BB.exepid process 2864 16BB.exe -
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2720 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1904 3796 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe16BB.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 16BB.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 16BB.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 16BB.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2164 ipconfig.exe 3640 NETSTAT.EXE 4032 NETSTAT.EXE 1376 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5044D706-59B1-11EC-876A-F22DA63300E1} = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exepid process 2224 f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe 2224 f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 2720 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2720 -
Suspicious behavior: MapViewOfSection 48 IoCs
Processes:
f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe16BB.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2224 f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe 2864 16BB.exe 2720 2720 2720 2720 2720 2720 2216 explorer.exe 2216 explorer.exe 2720 2720 740 explorer.exe 740 explorer.exe 2720 2720 2336 explorer.exe 2336 explorer.exe 2720 2720 1048 explorer.exe 1048 explorer.exe 2720 2720 2224 explorer.exe 2224 explorer.exe 2720 2720 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1072 WMIC.exe Token: SeSecurityPrivilege 1072 WMIC.exe Token: SeTakeOwnershipPrivilege 1072 WMIC.exe Token: SeLoadDriverPrivilege 1072 WMIC.exe Token: SeSystemProfilePrivilege 1072 WMIC.exe Token: SeSystemtimePrivilege 1072 WMIC.exe Token: SeProfSingleProcessPrivilege 1072 WMIC.exe Token: SeIncBasePriorityPrivilege 1072 WMIC.exe Token: SeCreatePagefilePrivilege 1072 WMIC.exe Token: SeBackupPrivilege 1072 WMIC.exe Token: SeRestorePrivilege 1072 WMIC.exe Token: SeShutdownPrivilege 1072 WMIC.exe Token: SeDebugPrivilege 1072 WMIC.exe Token: SeSystemEnvironmentPrivilege 1072 WMIC.exe Token: SeRemoteShutdownPrivilege 1072 WMIC.exe Token: SeUndockPrivilege 1072 WMIC.exe Token: SeManageVolumePrivilege 1072 WMIC.exe Token: 33 1072 WMIC.exe Token: 34 1072 WMIC.exe Token: 35 1072 WMIC.exe Token: 36 1072 WMIC.exe Token: SeIncreaseQuotaPrivilege 1072 WMIC.exe Token: SeSecurityPrivilege 1072 WMIC.exe Token: SeTakeOwnershipPrivilege 1072 WMIC.exe Token: SeLoadDriverPrivilege 1072 WMIC.exe Token: SeSystemProfilePrivilege 1072 WMIC.exe Token: SeSystemtimePrivilege 1072 WMIC.exe Token: SeProfSingleProcessPrivilege 1072 WMIC.exe Token: SeIncBasePriorityPrivilege 1072 WMIC.exe Token: SeCreatePagefilePrivilege 1072 WMIC.exe Token: SeBackupPrivilege 1072 WMIC.exe Token: SeRestorePrivilege 1072 WMIC.exe Token: SeShutdownPrivilege 1072 WMIC.exe Token: SeDebugPrivilege 1072 WMIC.exe Token: SeSystemEnvironmentPrivilege 1072 WMIC.exe Token: SeRemoteShutdownPrivilege 1072 WMIC.exe Token: SeUndockPrivilege 1072 WMIC.exe Token: SeManageVolumePrivilege 1072 WMIC.exe Token: 33 1072 WMIC.exe Token: 34 1072 WMIC.exe Token: 35 1072 WMIC.exe Token: 36 1072 WMIC.exe Token: SeIncreaseQuotaPrivilege 896 WMIC.exe Token: SeSecurityPrivilege 896 WMIC.exe Token: SeTakeOwnershipPrivilege 896 WMIC.exe Token: SeLoadDriverPrivilege 896 WMIC.exe Token: SeSystemProfilePrivilege 896 WMIC.exe Token: SeSystemtimePrivilege 896 WMIC.exe Token: SeProfSingleProcessPrivilege 896 WMIC.exe Token: SeIncBasePriorityPrivilege 896 WMIC.exe Token: SeCreatePagefilePrivilege 896 WMIC.exe Token: SeBackupPrivilege 896 WMIC.exe Token: SeRestorePrivilege 896 WMIC.exe Token: SeShutdownPrivilege 896 WMIC.exe Token: SeDebugPrivilege 896 WMIC.exe Token: SeSystemEnvironmentPrivilege 896 WMIC.exe Token: SeRemoteShutdownPrivilege 896 WMIC.exe Token: SeUndockPrivilege 896 WMIC.exe Token: SeManageVolumePrivilege 896 WMIC.exe Token: 33 896 WMIC.exe Token: 34 896 WMIC.exe Token: 35 896 WMIC.exe Token: 36 896 WMIC.exe Token: SeIncreaseQuotaPrivilege 896 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2176 iexplore.exe 2176 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2720 wrote to memory of 2864 2720 16BB.exe PID 2720 wrote to memory of 2864 2720 16BB.exe PID 2720 wrote to memory of 2864 2720 16BB.exe PID 2720 wrote to memory of 4052 2720 cmd.exe PID 2720 wrote to memory of 4052 2720 cmd.exe PID 4052 wrote to memory of 1072 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1072 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 896 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 896 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1048 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1048 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3312 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3312 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 624 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 624 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 4080 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 4080 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3580 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3580 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 4056 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 4056 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3964 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3964 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1688 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1688 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1520 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 1520 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3868 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3868 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 2796 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 2796 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3912 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 3912 4052 cmd.exe WMIC.exe PID 4052 wrote to memory of 2164 4052 cmd.exe ipconfig.exe PID 4052 wrote to memory of 2164 4052 cmd.exe ipconfig.exe PID 4052 wrote to memory of 2224 4052 cmd.exe ROUTE.EXE PID 4052 wrote to memory of 2224 4052 cmd.exe ROUTE.EXE PID 4052 wrote to memory of 3620 4052 cmd.exe netsh.exe PID 4052 wrote to memory of 3620 4052 cmd.exe netsh.exe PID 4052 wrote to memory of 1664 4052 cmd.exe systeminfo.exe PID 4052 wrote to memory of 1664 4052 cmd.exe systeminfo.exe PID 4052 wrote to memory of 2388 4052 cmd.exe tasklist.exe PID 4052 wrote to memory of 2388 4052 cmd.exe tasklist.exe PID 4052 wrote to memory of 2868 4052 cmd.exe net.exe PID 4052 wrote to memory of 2868 4052 cmd.exe net.exe PID 2868 wrote to memory of 3200 2868 net.exe net1.exe PID 2868 wrote to memory of 3200 2868 net.exe net1.exe PID 4052 wrote to memory of 3028 4052 cmd.exe net.exe PID 4052 wrote to memory of 3028 4052 cmd.exe net.exe PID 3028 wrote to memory of 1788 3028 net.exe net1.exe PID 3028 wrote to memory of 1788 3028 net.exe net1.exe PID 4052 wrote to memory of 3168 4052 cmd.exe net.exe PID 4052 wrote to memory of 3168 4052 cmd.exe net.exe PID 3168 wrote to memory of 1208 3168 net.exe net1.exe PID 3168 wrote to memory of 1208 3168 net.exe net1.exe PID 4052 wrote to memory of 2872 4052 cmd.exe net.exe PID 4052 wrote to memory of 2872 4052 cmd.exe net.exe PID 2872 wrote to memory of 1920 2872 net.exe net1.exe PID 2872 wrote to memory of 1920 2872 net.exe net1.exe PID 4052 wrote to memory of 1092 4052 cmd.exe net.exe PID 4052 wrote to memory of 1092 4052 cmd.exe net.exe PID 4052 wrote to memory of 3280 4052 cmd.exe net.exe PID 4052 wrote to memory of 3280 4052 cmd.exe net.exe PID 3280 wrote to memory of 2172 3280 net.exe net1.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3796 -s 9162⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe"C:\Users\Admin\AppData\Local\Temp\f2d479abc2342599819945b36cf7f4ee59b02e78cdf458184dc90022f2071f31.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Users\Admin\AppData\Local\Temp\16BB.exeC:\Users\Admin\AppData\Local\Temp\16BB.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\16BB.exeMD5
b683d3c9f84ab47199db9ac37701452f
SHA1fa8c4e3b8104b48908d79d90ae714e97c6ba2b4c
SHA25695d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71
SHA512245ba76a7731836ccaa9e80e0c4650fd5abc062dc29158b4a1e57b6b36c2cba08a2cba4e07df1b039af03a6207ed17a4884ea83c41e88c4a7ce3b977396b7d42
-
C:\Users\Admin\AppData\Local\Temp\16BB.exeMD5
b683d3c9f84ab47199db9ac37701452f
SHA1fa8c4e3b8104b48908d79d90ae714e97c6ba2b4c
SHA25695d8f84527ed99a54d78814885cd6ed270ad3ddf539b40b1f692c4a5bc6cea71
SHA512245ba76a7731836ccaa9e80e0c4650fd5abc062dc29158b4a1e57b6b36c2cba08a2cba4e07df1b039af03a6207ed17a4884ea83c41e88c4a7ce3b977396b7d42
-
memory/740-139-0x0000000000B90000-0x0000000000B99000-memory.dmpFilesize
36KB
-
memory/740-140-0x0000000000B80000-0x0000000000B8E000-memory.dmpFilesize
56KB
-
memory/1048-144-0x0000000000E00000-0x0000000000E0C000-memory.dmpFilesize
48KB
-
memory/1048-143-0x0000000000E10000-0x0000000000E16000-memory.dmpFilesize
24KB
-
memory/1904-154-0x000001E17BE40000-0x000001E17BE41000-memory.dmpFilesize
4KB
-
memory/2216-137-0x0000000000A00000-0x0000000000A07000-memory.dmpFilesize
28KB
-
memory/2216-138-0x00000000007F0000-0x00000000007FB000-memory.dmpFilesize
44KB
-
memory/2224-146-0x00000000009D0000-0x00000000009DB000-memory.dmpFilesize
44KB
-
memory/2224-145-0x00000000009E0000-0x00000000009E6000-memory.dmpFilesize
24KB
-
memory/2224-115-0x0000000000730000-0x0000000000753000-memory.dmpFilesize
140KB
-
memory/2224-117-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2224-116-0x00000000006C0000-0x00000000006C9000-memory.dmpFilesize
36KB
-
memory/2252-147-0x0000000000E20000-0x0000000000E27000-memory.dmpFilesize
28KB
-
memory/2252-148-0x0000000000E10000-0x0000000000E1D000-memory.dmpFilesize
52KB
-
memory/2336-142-0x0000000000110000-0x0000000000119000-memory.dmpFilesize
36KB
-
memory/2336-141-0x0000000000120000-0x0000000000125000-memory.dmpFilesize
20KB
-
memory/2340-149-0x000002C065570000-0x000002C065571000-memory.dmpFilesize
4KB
-
memory/2376-150-0x000001BB79BB0000-0x000001BB79BB1000-memory.dmpFilesize
4KB
-
memory/2500-151-0x0000020F0C1D0000-0x0000020F0C1D1000-memory.dmpFilesize
4KB
-
memory/2500-153-0x0000020F0C510000-0x0000020F0C511000-memory.dmpFilesize
4KB
-
memory/2608-134-0x00000000003E0000-0x00000000003EC000-memory.dmpFilesize
48KB
-
memory/2712-135-0x0000000000600000-0x0000000000675000-memory.dmpFilesize
468KB
-
memory/2712-136-0x0000000000370000-0x00000000003DB000-memory.dmpFilesize
428KB
-
memory/2720-127-0x0000000003510000-0x000000000351F000-memory.dmpFilesize
60KB
-
memory/2720-124-0x00000000031A0000-0x00000000031B6000-memory.dmpFilesize
88KB
-
memory/2720-118-0x0000000001150000-0x0000000001166000-memory.dmpFilesize
88KB
-
memory/2864-123-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2864-122-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/2864-121-0x00000000007C0000-0x00000000007E3000-memory.dmpFilesize
140KB
-
memory/3560-152-0x000001D0CA1E0000-0x000001D0CA1E1000-memory.dmpFilesize
4KB