Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe
Resource
win10-en-20211208
General
-
Target
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe
-
Size
189KB
-
MD5
c3b4a9fd21b8e20ab3f360d0a5232d4c
-
SHA1
8fe43427972ac95784356647f11ad2d701adf760
-
SHA256
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3
-
SHA512
1c03cfb9ad7e8c9adda017266ed4816ce34dfae390611b8dece672e2732e2db5bd269c1278864a582bb72a60ad930d00da8bc66c79a38032c6c4c3f800df0fd7
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2364 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1764 3752 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3236 ipconfig.exe 608 NETSTAT.EXE 2644 NETSTAT.EXE 3940 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{614098B7-7F6A-11EC-876A-DE070294B4D8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exepid process 2584 e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe 2584 e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2364 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2584 e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe 2364 2364 2364 2364 2364 2364 3180 explorer.exe 3180 explorer.exe 2364 2364 3768 explorer.exe 3768 explorer.exe 2364 2364 3500 explorer.exe 3500 explorer.exe 2364 2364 1328 explorer.exe 1328 explorer.exe 2364 2364 3104 explorer.exe 3104 explorer.exe 2364 2364 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe 1104 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3604 WMIC.exe Token: SeSecurityPrivilege 3604 WMIC.exe Token: SeTakeOwnershipPrivilege 3604 WMIC.exe Token: SeLoadDriverPrivilege 3604 WMIC.exe Token: SeSystemProfilePrivilege 3604 WMIC.exe Token: SeSystemtimePrivilege 3604 WMIC.exe Token: SeProfSingleProcessPrivilege 3604 WMIC.exe Token: SeIncBasePriorityPrivilege 3604 WMIC.exe Token: SeCreatePagefilePrivilege 3604 WMIC.exe Token: SeBackupPrivilege 3604 WMIC.exe Token: SeRestorePrivilege 3604 WMIC.exe Token: SeShutdownPrivilege 3604 WMIC.exe Token: SeDebugPrivilege 3604 WMIC.exe Token: SeSystemEnvironmentPrivilege 3604 WMIC.exe Token: SeRemoteShutdownPrivilege 3604 WMIC.exe Token: SeUndockPrivilege 3604 WMIC.exe Token: SeManageVolumePrivilege 3604 WMIC.exe Token: 33 3604 WMIC.exe Token: 34 3604 WMIC.exe Token: 35 3604 WMIC.exe Token: 36 3604 WMIC.exe Token: SeIncreaseQuotaPrivilege 3604 WMIC.exe Token: SeSecurityPrivilege 3604 WMIC.exe Token: SeTakeOwnershipPrivilege 3604 WMIC.exe Token: SeLoadDriverPrivilege 3604 WMIC.exe Token: SeSystemProfilePrivilege 3604 WMIC.exe Token: SeSystemtimePrivilege 3604 WMIC.exe Token: SeProfSingleProcessPrivilege 3604 WMIC.exe Token: SeIncBasePriorityPrivilege 3604 WMIC.exe Token: SeCreatePagefilePrivilege 3604 WMIC.exe Token: SeBackupPrivilege 3604 WMIC.exe Token: SeRestorePrivilege 3604 WMIC.exe Token: SeShutdownPrivilege 3604 WMIC.exe Token: SeDebugPrivilege 3604 WMIC.exe Token: SeSystemEnvironmentPrivilege 3604 WMIC.exe Token: SeRemoteShutdownPrivilege 3604 WMIC.exe Token: SeUndockPrivilege 3604 WMIC.exe Token: SeManageVolumePrivilege 3604 WMIC.exe Token: 33 3604 WMIC.exe Token: 34 3604 WMIC.exe Token: 35 3604 WMIC.exe Token: 36 3604 WMIC.exe Token: SeIncreaseQuotaPrivilege 660 WMIC.exe Token: SeSecurityPrivilege 660 WMIC.exe Token: SeTakeOwnershipPrivilege 660 WMIC.exe Token: SeLoadDriverPrivilege 660 WMIC.exe Token: SeSystemProfilePrivilege 660 WMIC.exe Token: SeSystemtimePrivilege 660 WMIC.exe Token: SeProfSingleProcessPrivilege 660 WMIC.exe Token: SeIncBasePriorityPrivilege 660 WMIC.exe Token: SeCreatePagefilePrivilege 660 WMIC.exe Token: SeBackupPrivilege 660 WMIC.exe Token: SeRestorePrivilege 660 WMIC.exe Token: SeShutdownPrivilege 660 WMIC.exe Token: SeDebugPrivilege 660 WMIC.exe Token: SeSystemEnvironmentPrivilege 660 WMIC.exe Token: SeRemoteShutdownPrivilege 660 WMIC.exe Token: SeUndockPrivilege 660 WMIC.exe Token: SeManageVolumePrivilege 660 WMIC.exe Token: 33 660 WMIC.exe Token: 34 660 WMIC.exe Token: 35 660 WMIC.exe Token: 36 660 WMIC.exe Token: SeIncreaseQuotaPrivilege 660 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3312 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3312 iexplore.exe 3312 iexplore.exe 3932 IEXPLORE.EXE 3932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2364 wrote to memory of 1480 2364 cmd.exe PID 2364 wrote to memory of 1480 2364 cmd.exe PID 1480 wrote to memory of 3604 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3604 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 660 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 660 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2708 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2708 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1336 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1336 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2052 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2052 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2100 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2100 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 4040 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 4040 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 4008 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 4008 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2904 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 2904 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3544 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3544 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 652 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 652 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1820 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1820 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1980 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 1980 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3456 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3456 1480 cmd.exe WMIC.exe PID 1480 wrote to memory of 3236 1480 cmd.exe ipconfig.exe PID 1480 wrote to memory of 3236 1480 cmd.exe ipconfig.exe PID 1480 wrote to memory of 2184 1480 cmd.exe ROUTE.EXE PID 1480 wrote to memory of 2184 1480 cmd.exe ROUTE.EXE PID 1480 wrote to memory of 672 1480 cmd.exe netsh.exe PID 1480 wrote to memory of 672 1480 cmd.exe netsh.exe PID 1480 wrote to memory of 3800 1480 cmd.exe systeminfo.exe PID 1480 wrote to memory of 3800 1480 cmd.exe systeminfo.exe PID 1480 wrote to memory of 3104 1480 cmd.exe tasklist.exe PID 1480 wrote to memory of 3104 1480 cmd.exe tasklist.exe PID 1480 wrote to memory of 1336 1480 cmd.exe net.exe PID 1480 wrote to memory of 1336 1480 cmd.exe net.exe PID 1336 wrote to memory of 4004 1336 net.exe net1.exe PID 1336 wrote to memory of 4004 1336 net.exe net1.exe PID 1480 wrote to memory of 2880 1480 cmd.exe net.exe PID 1480 wrote to memory of 2880 1480 cmd.exe net.exe PID 2880 wrote to memory of 1868 2880 net.exe net1.exe PID 2880 wrote to memory of 1868 2880 net.exe net1.exe PID 1480 wrote to memory of 1424 1480 cmd.exe net.exe PID 1480 wrote to memory of 1424 1480 cmd.exe net.exe PID 1424 wrote to memory of 920 1424 net.exe net1.exe PID 1424 wrote to memory of 920 1424 net.exe net1.exe PID 1480 wrote to memory of 2812 1480 cmd.exe net.exe PID 1480 wrote to memory of 2812 1480 cmd.exe net.exe PID 2812 wrote to memory of 2008 2812 net.exe net1.exe PID 2812 wrote to memory of 2008 2812 net.exe net1.exe PID 1480 wrote to memory of 2740 1480 cmd.exe net.exe PID 1480 wrote to memory of 2740 1480 cmd.exe net.exe PID 1480 wrote to memory of 1764 1480 cmd.exe net.exe PID 1480 wrote to memory of 1764 1480 cmd.exe net.exe PID 1764 wrote to memory of 2988 1764 net.exe net1.exe PID 1764 wrote to memory of 2988 1764 net.exe net1.exe PID 1480 wrote to memory of 1948 1480 cmd.exe net.exe PID 1480 wrote to memory of 1948 1480 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3752 -s 9162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe"C:\Users\Admin\AppData\Local\Temp\e3f2ff1f550f8d48e6b9617b3733195bf4dd296f472c0da57461ca5070b1a8e3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3312 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-158-0x0000000000C30000-0x0000000000C3D000-memory.dmpFilesize
52KB
-
memory/1104-157-0x0000000000C40000-0x0000000000C47000-memory.dmpFilesize
28KB
-
memory/1328-154-0x0000000000FD0000-0x0000000000FDC000-memory.dmpFilesize
48KB
-
memory/1328-153-0x0000000000FE0000-0x0000000000FE6000-memory.dmpFilesize
24KB
-
memory/1764-167-0x000001976E890000-0x000001976EB89000-memory.dmpFilesize
3.0MB
-
memory/1764-165-0x000001976E890000-0x000001976EB89000-memory.dmpFilesize
3.0MB
-
memory/1764-164-0x000001976E890000-0x000001976EB89000-memory.dmpFilesize
3.0MB
-
memory/1912-143-0x00000000032A0000-0x0000000003315000-memory.dmpFilesize
468KB
-
memory/1912-144-0x0000000000DE0000-0x0000000000E4B000-memory.dmpFilesize
428KB
-
memory/2364-121-0x00000000010A0000-0x00000000010AF000-memory.dmpFilesize
60KB
-
memory/2364-118-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB
-
memory/2584-116-0x00000000004E0000-0x000000000058E000-memory.dmpFilesize
696KB
-
memory/2584-117-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2668-159-0x000002C72EF20000-0x000002C72EF21000-memory.dmpFilesize
4KB
-
memory/2696-160-0x000001CAEE9F0000-0x000001CAEE9F1000-memory.dmpFilesize
4KB
-
memory/2872-161-0x000001FAE0370000-0x000001FAE0371000-memory.dmpFilesize
4KB
-
memory/2872-166-0x000001FAE06B0000-0x000001FAE06B1000-memory.dmpFilesize
4KB
-
memory/3104-155-0x0000000000680000-0x0000000000686000-memory.dmpFilesize
24KB
-
memory/3104-156-0x0000000000670000-0x000000000067B000-memory.dmpFilesize
44KB
-
memory/3180-147-0x00000000007D0000-0x00000000007D7000-memory.dmpFilesize
28KB
-
memory/3180-148-0x00000000007C0000-0x00000000007CB000-memory.dmpFilesize
44KB
-
memory/3488-162-0x0000028705280000-0x0000028705281000-memory.dmpFilesize
4KB
-
memory/3500-151-0x0000000000B50000-0x0000000000B55000-memory.dmpFilesize
20KB
-
memory/3500-152-0x0000000000B40000-0x0000000000B49000-memory.dmpFilesize
36KB
-
memory/3768-149-0x0000000000490000-0x0000000000499000-memory.dmpFilesize
36KB
-
memory/3768-150-0x0000000000480000-0x000000000048E000-memory.dmpFilesize
56KB
-
memory/3808-146-0x00000000005F0000-0x00000000005FC000-memory.dmpFilesize
48KB
-
memory/3808-145-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB