Analysis
-
max time kernel
165s -
max time network
170s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 05:14
Static task
static1
Behavioral task
behavioral1
Sample
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe
Resource
win10-en-20211208
General
-
Target
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe
-
Size
356KB
-
MD5
877c164004c6e8ec3bd14cb80d86bd51
-
SHA1
45d09d51ddc119c3fd17eac7e2e344931278fd1f
-
SHA256
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce
-
SHA512
1157f38c8398d2e9016cbdfea796013e607377b688fc4675713e2868ea0e8cab50d21f8c50b687876edfbf1fe0b62eb48543f6801c9d5659b2ef1bad8896f028
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 404 3648 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2140 ipconfig.exe 1468 NETSTAT.EXE 1428 NETSTAT.EXE 1700 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55333591-7FF9-11EC-876A-621C3C4121D2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exepid process 808 aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe 808 aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 808 aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe 3036 3036 3036 3036 3036 3036 3180 explorer.exe 3180 explorer.exe 3036 3036 1216 explorer.exe 1216 explorer.exe 3036 3036 3352 explorer.exe 3352 explorer.exe 3036 3036 3644 explorer.exe 3644 explorer.exe 3036 3036 3448 explorer.exe 3448 explorer.exe 3036 3036 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 804 WMIC.exe Token: SeSecurityPrivilege 804 WMIC.exe Token: SeTakeOwnershipPrivilege 804 WMIC.exe Token: SeLoadDriverPrivilege 804 WMIC.exe Token: SeSystemProfilePrivilege 804 WMIC.exe Token: SeSystemtimePrivilege 804 WMIC.exe Token: SeProfSingleProcessPrivilege 804 WMIC.exe Token: SeIncBasePriorityPrivilege 804 WMIC.exe Token: SeCreatePagefilePrivilege 804 WMIC.exe Token: SeBackupPrivilege 804 WMIC.exe Token: SeRestorePrivilege 804 WMIC.exe Token: SeShutdownPrivilege 804 WMIC.exe Token: SeDebugPrivilege 804 WMIC.exe Token: SeSystemEnvironmentPrivilege 804 WMIC.exe Token: SeRemoteShutdownPrivilege 804 WMIC.exe Token: SeUndockPrivilege 804 WMIC.exe Token: SeManageVolumePrivilege 804 WMIC.exe Token: 33 804 WMIC.exe Token: 34 804 WMIC.exe Token: 35 804 WMIC.exe Token: 36 804 WMIC.exe Token: SeIncreaseQuotaPrivilege 804 WMIC.exe Token: SeSecurityPrivilege 804 WMIC.exe Token: SeTakeOwnershipPrivilege 804 WMIC.exe Token: SeLoadDriverPrivilege 804 WMIC.exe Token: SeSystemProfilePrivilege 804 WMIC.exe Token: SeSystemtimePrivilege 804 WMIC.exe Token: SeProfSingleProcessPrivilege 804 WMIC.exe Token: SeIncBasePriorityPrivilege 804 WMIC.exe Token: SeCreatePagefilePrivilege 804 WMIC.exe Token: SeBackupPrivilege 804 WMIC.exe Token: SeRestorePrivilege 804 WMIC.exe Token: SeShutdownPrivilege 804 WMIC.exe Token: SeDebugPrivilege 804 WMIC.exe Token: SeSystemEnvironmentPrivilege 804 WMIC.exe Token: SeRemoteShutdownPrivilege 804 WMIC.exe Token: SeUndockPrivilege 804 WMIC.exe Token: SeManageVolumePrivilege 804 WMIC.exe Token: 33 804 WMIC.exe Token: 34 804 WMIC.exe Token: 35 804 WMIC.exe Token: 36 804 WMIC.exe Token: SeIncreaseQuotaPrivilege 1500 WMIC.exe Token: SeSecurityPrivilege 1500 WMIC.exe Token: SeTakeOwnershipPrivilege 1500 WMIC.exe Token: SeLoadDriverPrivilege 1500 WMIC.exe Token: SeSystemProfilePrivilege 1500 WMIC.exe Token: SeSystemtimePrivilege 1500 WMIC.exe Token: SeProfSingleProcessPrivilege 1500 WMIC.exe Token: SeIncBasePriorityPrivilege 1500 WMIC.exe Token: SeCreatePagefilePrivilege 1500 WMIC.exe Token: SeBackupPrivilege 1500 WMIC.exe Token: SeRestorePrivilege 1500 WMIC.exe Token: SeShutdownPrivilege 1500 WMIC.exe Token: SeDebugPrivilege 1500 WMIC.exe Token: SeSystemEnvironmentPrivilege 1500 WMIC.exe Token: SeRemoteShutdownPrivilege 1500 WMIC.exe Token: SeUndockPrivilege 1500 WMIC.exe Token: SeManageVolumePrivilege 1500 WMIC.exe Token: 33 1500 WMIC.exe Token: 34 1500 WMIC.exe Token: 35 1500 WMIC.exe Token: 36 1500 WMIC.exe Token: SeIncreaseQuotaPrivilege 1500 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1948 iexplore.exe 1948 iexplore.exe 3552 IEXPLORE.EXE 3552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3036 wrote to memory of 728 3036 cmd.exe PID 3036 wrote to memory of 728 3036 cmd.exe PID 728 wrote to memory of 804 728 cmd.exe WMIC.exe PID 728 wrote to memory of 804 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1500 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1500 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1372 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1372 728 cmd.exe WMIC.exe PID 728 wrote to memory of 956 728 cmd.exe WMIC.exe PID 728 wrote to memory of 956 728 cmd.exe WMIC.exe PID 728 wrote to memory of 596 728 cmd.exe WMIC.exe PID 728 wrote to memory of 596 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2152 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2152 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2124 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2124 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2292 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2292 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2692 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2692 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2936 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2936 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1584 728 cmd.exe WMIC.exe PID 728 wrote to memory of 1584 728 cmd.exe WMIC.exe PID 728 wrote to memory of 3532 728 cmd.exe WMIC.exe PID 728 wrote to memory of 3532 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2240 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2240 728 cmd.exe WMIC.exe PID 728 wrote to memory of 3148 728 cmd.exe WMIC.exe PID 728 wrote to memory of 3148 728 cmd.exe WMIC.exe PID 728 wrote to memory of 2140 728 cmd.exe ipconfig.exe PID 728 wrote to memory of 2140 728 cmd.exe ipconfig.exe PID 728 wrote to memory of 2160 728 cmd.exe ROUTE.EXE PID 728 wrote to memory of 2160 728 cmd.exe ROUTE.EXE PID 728 wrote to memory of 1220 728 cmd.exe netsh.exe PID 728 wrote to memory of 1220 728 cmd.exe netsh.exe PID 728 wrote to memory of 432 728 cmd.exe systeminfo.exe PID 728 wrote to memory of 432 728 cmd.exe systeminfo.exe PID 728 wrote to memory of 2180 728 cmd.exe tasklist.exe PID 728 wrote to memory of 2180 728 cmd.exe tasklist.exe PID 728 wrote to memory of 3904 728 cmd.exe net.exe PID 728 wrote to memory of 3904 728 cmd.exe net.exe PID 3904 wrote to memory of 1396 3904 net.exe net1.exe PID 3904 wrote to memory of 1396 3904 net.exe net1.exe PID 728 wrote to memory of 1392 728 cmd.exe net.exe PID 728 wrote to memory of 1392 728 cmd.exe net.exe PID 1392 wrote to memory of 1376 1392 net.exe net1.exe PID 1392 wrote to memory of 1376 1392 net.exe net1.exe PID 728 wrote to memory of 804 728 cmd.exe net.exe PID 728 wrote to memory of 804 728 cmd.exe net.exe PID 804 wrote to memory of 3792 804 net.exe net1.exe PID 804 wrote to memory of 3792 804 net.exe net1.exe PID 728 wrote to memory of 1500 728 cmd.exe net.exe PID 728 wrote to memory of 1500 728 cmd.exe net.exe PID 1500 wrote to memory of 608 1500 net.exe net1.exe PID 1500 wrote to memory of 608 1500 net.exe net1.exe PID 728 wrote to memory of 956 728 cmd.exe net.exe PID 728 wrote to memory of 956 728 cmd.exe net.exe PID 728 wrote to memory of 400 728 cmd.exe net.exe PID 728 wrote to memory of 400 728 cmd.exe net.exe PID 400 wrote to memory of 1260 400 net.exe net1.exe PID 400 wrote to memory of 1260 400 net.exe net1.exe PID 728 wrote to memory of 1244 728 cmd.exe net.exe PID 728 wrote to memory of 1244 728 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3648 -s 9082⤵
- Program crash
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe"C:\Users\Admin\AppData\Local\Temp\aa3e4850de759f8e8f6f3dd52e9006ad699bec7cd02248194075f6617baac8ce.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/404-151-0x0000020BA2A80000-0x0000020BA2A81000-memory.dmpFilesize
4KB
-
memory/808-119-0x0000000000490000-0x00000000005DA000-memory.dmpFilesize
1.3MB
-
memory/808-120-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/808-118-0x00000000006A0000-0x00000000006C9000-memory.dmpFilesize
164KB
-
memory/1216-137-0x0000000000590000-0x000000000059E000-memory.dmpFilesize
56KB
-
memory/1216-136-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/1720-132-0x00000000006D0000-0x000000000073B000-memory.dmpFilesize
428KB
-
memory/1720-131-0x0000000000740000-0x00000000007B5000-memory.dmpFilesize
468KB
-
memory/2332-146-0x00000139FDBB0000-0x00000139FDBB1000-memory.dmpFilesize
4KB
-
memory/2356-147-0x000001F164640000-0x000001F164641000-memory.dmpFilesize
4KB
-
memory/2484-133-0x0000000000610000-0x000000000061C000-memory.dmpFilesize
48KB
-
memory/2716-148-0x000001E632A40000-0x000001E632A41000-memory.dmpFilesize
4KB
-
memory/2716-150-0x000001E632D80000-0x000001E632D81000-memory.dmpFilesize
4KB
-
memory/3036-124-0x00000000030F0000-0x00000000030FF000-memory.dmpFilesize
60KB
-
memory/3036-121-0x0000000001120000-0x0000000001136000-memory.dmpFilesize
88KB
-
memory/3180-134-0x00000000032B0000-0x00000000032B7000-memory.dmpFilesize
28KB
-
memory/3180-135-0x00000000032A0000-0x00000000032AB000-memory.dmpFilesize
44KB
-
memory/3352-139-0x0000000002F60000-0x0000000002F69000-memory.dmpFilesize
36KB
-
memory/3352-138-0x0000000002F70000-0x0000000002F75000-memory.dmpFilesize
20KB
-
memory/3428-149-0x00000166BD410000-0x00000166BD411000-memory.dmpFilesize
4KB
-
memory/3448-143-0x0000000002F70000-0x0000000002F7B000-memory.dmpFilesize
44KB
-
memory/3448-142-0x0000000002F80000-0x0000000002F86000-memory.dmpFilesize
24KB
-
memory/3644-141-0x0000000000720000-0x000000000072C000-memory.dmpFilesize
48KB
-
memory/3644-140-0x0000000000730000-0x0000000000736000-memory.dmpFilesize
24KB
-
memory/3808-144-0x00000000012E0000-0x00000000012E7000-memory.dmpFilesize
28KB
-
memory/3808-145-0x00000000012D0000-0x00000000012DD000-memory.dmpFilesize
52KB