Analysis
-
max time kernel
166s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 16:25
Static task
static1
Behavioral task
behavioral1
Sample
9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe
Resource
win10v2004-en-20220112
General
-
Target
9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe
-
Size
188KB
-
MD5
147a520cda06d08b58f84abbed5381b6
-
SHA1
6e6f39764b253c7e02b2c533463199d59ab6517f
-
SHA256
9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937
-
SHA512
6a2b7e1e612ed8e96ae09b21d1db9cb1ebddc630a14e7dc16ad249271f68bae4e4f9f491ec305c5cc799f3d90855dc19ed2d13974facd128300a3d8b9e117d3d
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 2392 created 2808 2392 WerFault.exe explorer.exe PID 3880 created 2736 3880 WerFault.exe DllHost.exe PID 3348 created 3320 3348 WerFault.exe DllHost.exe PID 368 created 784 368 WerFault.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
wgewejcpid process 3452 wgewejc -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 1 IoCs
Processes:
TiWorker.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3972 2808 WerFault.exe explorer.exe 1280 2736 WerFault.exe DllHost.exe 3648 3320 WerFault.exe DllHost.exe 3596 784 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wgewejc9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wgewejc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wgewejc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wgewejc -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2092 ipconfig.exe 1388 NETSTAT.EXE 1440 NETSTAT.EXE 3412 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3064944644" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30938019" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3064944644" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30938019" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3111351016" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30938019" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E1A3AE99-7F96-11EC-82D0-CA03E3C25406} = "0" iexplore.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exepid process 1184 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe 1184 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2420 -
Suspicious behavior: MapViewOfSection 60 IoCs
Processes:
9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exewgewejcexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1184 9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe 3452 wgewejc 2420 2420 2420 2420 2420 2420 1284 explorer.exe 1284 explorer.exe 2420 2420 3792 explorer.exe 3792 explorer.exe 2420 2420 2932 explorer.exe 2932 explorer.exe 2420 2420 1672 explorer.exe 1672 explorer.exe 2420 2420 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 1952 explorer.exe 2420 2420 1952 explorer.exe 1952 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe 220 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 772 WMIC.exe Token: SeSecurityPrivilege 772 WMIC.exe Token: SeTakeOwnershipPrivilege 772 WMIC.exe Token: SeLoadDriverPrivilege 772 WMIC.exe Token: SeSystemProfilePrivilege 772 WMIC.exe Token: SeSystemtimePrivilege 772 WMIC.exe Token: SeProfSingleProcessPrivilege 772 WMIC.exe Token: SeIncBasePriorityPrivilege 772 WMIC.exe Token: SeCreatePagefilePrivilege 772 WMIC.exe Token: SeBackupPrivilege 772 WMIC.exe Token: SeRestorePrivilege 772 WMIC.exe Token: SeShutdownPrivilege 772 WMIC.exe Token: SeDebugPrivilege 772 WMIC.exe Token: SeSystemEnvironmentPrivilege 772 WMIC.exe Token: SeRemoteShutdownPrivilege 772 WMIC.exe Token: SeUndockPrivilege 772 WMIC.exe Token: SeManageVolumePrivilege 772 WMIC.exe Token: 33 772 WMIC.exe Token: 34 772 WMIC.exe Token: 35 772 WMIC.exe Token: 36 772 WMIC.exe Token: SeIncreaseQuotaPrivilege 772 WMIC.exe Token: SeSecurityPrivilege 772 WMIC.exe Token: SeTakeOwnershipPrivilege 772 WMIC.exe Token: SeLoadDriverPrivilege 772 WMIC.exe Token: SeSystemProfilePrivilege 772 WMIC.exe Token: SeSystemtimePrivilege 772 WMIC.exe Token: SeProfSingleProcessPrivilege 772 WMIC.exe Token: SeIncBasePriorityPrivilege 772 WMIC.exe Token: SeCreatePagefilePrivilege 772 WMIC.exe Token: SeBackupPrivilege 772 WMIC.exe Token: SeRestorePrivilege 772 WMIC.exe Token: SeShutdownPrivilege 772 WMIC.exe Token: SeDebugPrivilege 772 WMIC.exe Token: SeSystemEnvironmentPrivilege 772 WMIC.exe Token: SeRemoteShutdownPrivilege 772 WMIC.exe Token: SeUndockPrivilege 772 WMIC.exe Token: SeManageVolumePrivilege 772 WMIC.exe Token: 33 772 WMIC.exe Token: 34 772 WMIC.exe Token: 35 772 WMIC.exe Token: 36 772 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeSecurityPrivilege 2892 WMIC.exe Token: SeTakeOwnershipPrivilege 2892 WMIC.exe Token: SeLoadDriverPrivilege 2892 WMIC.exe Token: SeSystemProfilePrivilege 2892 WMIC.exe Token: SeSystemtimePrivilege 2892 WMIC.exe Token: SeProfSingleProcessPrivilege 2892 WMIC.exe Token: SeIncBasePriorityPrivilege 2892 WMIC.exe Token: SeCreatePagefilePrivilege 2892 WMIC.exe Token: SeBackupPrivilege 2892 WMIC.exe Token: SeRestorePrivilege 2892 WMIC.exe Token: SeShutdownPrivilege 2892 WMIC.exe Token: SeDebugPrivilege 2892 WMIC.exe Token: SeSystemEnvironmentPrivilege 2892 WMIC.exe Token: SeRemoteShutdownPrivilege 2892 WMIC.exe Token: SeUndockPrivilege 2892 WMIC.exe Token: SeManageVolumePrivilege 2892 WMIC.exe Token: 33 2892 WMIC.exe Token: 34 2892 WMIC.exe Token: 35 2892 WMIC.exe Token: 36 2892 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3764 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3764 iexplore.exe 3764 iexplore.exe 3288 IEXPLORE.EXE 3288 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2420 wrote to memory of 2872 2420 cmd.exe PID 2420 wrote to memory of 2872 2420 cmd.exe PID 2872 wrote to memory of 772 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 772 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2104 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2104 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2892 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2892 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3744 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3744 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2576 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2576 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 4024 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 4024 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 1840 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 1840 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 456 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 456 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 740 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 740 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3304 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3304 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3648 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3648 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 716 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 716 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3752 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3752 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2860 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2860 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 2092 2872 cmd.exe ipconfig.exe PID 2872 wrote to memory of 2092 2872 cmd.exe ipconfig.exe PID 2872 wrote to memory of 2440 2872 cmd.exe ROUTE.EXE PID 2872 wrote to memory of 2440 2872 cmd.exe ROUTE.EXE PID 2872 wrote to memory of 2288 2872 cmd.exe netsh.exe PID 2872 wrote to memory of 2288 2872 cmd.exe netsh.exe PID 2872 wrote to memory of 2932 2872 cmd.exe systeminfo.exe PID 2872 wrote to memory of 2932 2872 cmd.exe systeminfo.exe PID 2872 wrote to memory of 3492 2872 cmd.exe tasklist.exe PID 2872 wrote to memory of 3492 2872 cmd.exe tasklist.exe PID 2872 wrote to memory of 1496 2872 cmd.exe net.exe PID 2872 wrote to memory of 1496 2872 cmd.exe net.exe PID 1496 wrote to memory of 1164 1496 net.exe net1.exe PID 1496 wrote to memory of 1164 1496 net.exe net1.exe PID 2872 wrote to memory of 1536 2872 cmd.exe net.exe PID 2872 wrote to memory of 1536 2872 cmd.exe net.exe PID 1536 wrote to memory of 1500 1536 net.exe net1.exe PID 1536 wrote to memory of 1500 1536 net.exe net1.exe PID 2872 wrote to memory of 2188 2872 cmd.exe net.exe PID 2872 wrote to memory of 2188 2872 cmd.exe net.exe PID 2188 wrote to memory of 1108 2188 net.exe net1.exe PID 2188 wrote to memory of 1108 2188 net.exe net1.exe PID 2872 wrote to memory of 3160 2872 cmd.exe net.exe PID 2872 wrote to memory of 3160 2872 cmd.exe net.exe PID 3160 wrote to memory of 2796 3160 net.exe net1.exe PID 3160 wrote to memory of 2796 3160 net.exe net1.exe PID 2872 wrote to memory of 3276 2872 cmd.exe net.exe PID 2872 wrote to memory of 3276 2872 cmd.exe net.exe PID 2872 wrote to memory of 1448 2872 cmd.exe net.exe PID 2872 wrote to memory of 1448 2872 cmd.exe net.exe PID 1448 wrote to memory of 2244 1448 net.exe net1.exe PID 1448 wrote to memory of 2244 1448 net.exe net1.exe PID 2872 wrote to memory of 1900 2872 cmd.exe net.exe PID 2872 wrote to memory of 1900 2872 cmd.exe net.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 9802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe"C:\Users\Admin\AppData\Local\Temp\9e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 3d6c6b0c41438c7434ed3fe7b29a53f0 bXnXmFxU+UWcRzSxoOIL+g.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Admin\AppData\Roaming\wgewejcC:\Users\Admin\AppData\Roaming\wgewejc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3764 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 8762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2808 -ip 28081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 2736 -ip 27361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3320 -s 7562⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 3320 -ip 33201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 784 -s 7762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 504 -p 784 -ip 7841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wgewejcMD5
147a520cda06d08b58f84abbed5381b6
SHA16e6f39764b253c7e02b2c533463199d59ab6517f
SHA2569e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937
SHA5126a2b7e1e612ed8e96ae09b21d1db9cb1ebddc630a14e7dc16ad249271f68bae4e4f9f491ec305c5cc799f3d90855dc19ed2d13974facd128300a3d8b9e117d3d
-
C:\Users\Admin\AppData\Roaming\wgewejcMD5
147a520cda06d08b58f84abbed5381b6
SHA16e6f39764b253c7e02b2c533463199d59ab6517f
SHA2569e6e122e4798d36ef04fa932941a529214294b4707c4c4432b3952efc1297937
SHA5126a2b7e1e612ed8e96ae09b21d1db9cb1ebddc630a14e7dc16ad249271f68bae4e4f9f491ec305c5cc799f3d90855dc19ed2d13974facd128300a3d8b9e117d3d
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/220-180-0x0000000000E80000-0x0000000000E8D000-memory.dmpFilesize
52KB
-
memory/220-179-0x0000000000E90000-0x0000000000E97000-memory.dmpFilesize
28KB
-
memory/784-192-0x0000027665490000-0x0000027665498000-memory.dmpFilesize
32KB
-
memory/1184-132-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1184-131-0x00000000005D0000-0x00000000005D9000-memory.dmpFilesize
36KB
-
memory/1184-130-0x00000000005E0000-0x0000000000608000-memory.dmpFilesize
160KB
-
memory/1284-166-0x0000000002AD0000-0x0000000002AD7000-memory.dmpFilesize
28KB
-
memory/1284-167-0x0000000002AC0000-0x0000000002ACB000-memory.dmpFilesize
44KB
-
memory/1672-173-0x0000000000C20000-0x0000000000C2C000-memory.dmpFilesize
48KB
-
memory/1672-172-0x0000000000C30000-0x0000000000C36000-memory.dmpFilesize
24KB
-
memory/1952-175-0x00000000032B0000-0x00000000032BB000-memory.dmpFilesize
44KB
-
memory/1952-174-0x00000000032C0000-0x00000000032C6000-memory.dmpFilesize
24KB
-
memory/2208-193-0x0000024152580000-0x0000024152581000-memory.dmpFilesize
4KB
-
memory/2208-183-0x0000024152580000-0x0000024152581000-memory.dmpFilesize
4KB
-
memory/2224-184-0x0000022A7CDB0000-0x0000022A7CDB1000-memory.dmpFilesize
4KB
-
memory/2276-185-0x000001F898EC0000-0x000001F898EC1000-memory.dmpFilesize
4KB
-
memory/2384-176-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/2384-177-0x00000000034E0000-0x00000000034EB000-memory.dmpFilesize
44KB
-
memory/2420-147-0x0000000002B20000-0x0000000002B36000-memory.dmpFilesize
88KB
-
memory/2420-134-0x0000000000E50000-0x0000000000E5F000-memory.dmpFilesize
60KB
-
memory/2420-133-0x0000000000D10000-0x0000000000D26000-memory.dmpFilesize
88KB
-
memory/2532-186-0x000001A07C960000-0x000001A07C961000-memory.dmpFilesize
4KB
-
memory/2692-189-0x0000027714E20000-0x0000027714E21000-memory.dmpFilesize
4KB
-
memory/2808-162-0x0000000003270000-0x00000000032E5000-memory.dmpFilesize
468KB
-
memory/2808-163-0x0000000003200000-0x000000000326B000-memory.dmpFilesize
428KB
-
memory/2836-187-0x00000236BB7C0000-0x00000236BB7C1000-memory.dmpFilesize
4KB
-
memory/2904-188-0x00000299D6E80000-0x00000299D6E81000-memory.dmpFilesize
4KB
-
memory/2932-171-0x0000000002580000-0x0000000002589000-memory.dmpFilesize
36KB
-
memory/2932-170-0x0000000002590000-0x0000000002595000-memory.dmpFilesize
20KB
-
memory/3452-146-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3452-145-0x00000000006B0000-0x00000000006D6000-memory.dmpFilesize
152KB
-
memory/3556-191-0x000001A607F10000-0x000001A607F11000-memory.dmpFilesize
4KB
-
memory/3596-164-0x0000000000380000-0x0000000000387000-memory.dmpFilesize
28KB
-
memory/3596-165-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/3792-169-0x0000000000B60000-0x0000000000B6E000-memory.dmpFilesize
56KB
-
memory/3792-168-0x0000000000B70000-0x0000000000B79000-memory.dmpFilesize
36KB
-
memory/3920-190-0x000001884B3B0000-0x000001884B3B1000-memory.dmpFilesize
4KB
-
memory/3972-182-0x0000000005180000-0x0000000005330000-memory.dmpFilesize
1.7MB
-
memory/3972-181-0x0000000005180000-0x0000000005330000-memory.dmpFilesize
1.7MB