Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 08:55
Static task
static1
Behavioral task
behavioral1
Sample
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe
Resource
win10-en-20211208
General
-
Target
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe
-
Size
357KB
-
MD5
0e84578bea1fb3792a6a67947802e403
-
SHA1
2ab191f4b4936b1c54573b715a8740fbb8d0afca
-
SHA256
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670
-
SHA512
4c9ea6e99cfdbdc54f307d26dec5a63a6784466c8e387ab4537aff788345851824264b6d2e2df7e43342696cac78f5b4b9bb3c2e0a460c9cdaf043b97e8bab46
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2984 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1300 3720 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 2176 ipconfig.exe 2340 NETSTAT.EXE 1808 NETSTAT.EXE 2120 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4931B5E-5B6C-11EC-876A-560F96CD90AC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exepid process 3736 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe 3736 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 2984 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2984 -
Suspicious behavior: MapViewOfSection 45 IoCs
Processes:
78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3736 78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe 2984 2984 2984 2984 2984 2984 2984 2984 3820 explorer.exe 3820 explorer.exe 2984 2984 1184 explorer.exe 1184 explorer.exe 2984 2984 2464 explorer.exe 2464 explorer.exe 2984 2984 3940 explorer.exe 3940 explorer.exe 2984 2984 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe 2972 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1584 WMIC.exe Token: SeSecurityPrivilege 1584 WMIC.exe Token: SeTakeOwnershipPrivilege 1584 WMIC.exe Token: SeLoadDriverPrivilege 1584 WMIC.exe Token: SeSystemProfilePrivilege 1584 WMIC.exe Token: SeSystemtimePrivilege 1584 WMIC.exe Token: SeProfSingleProcessPrivilege 1584 WMIC.exe Token: SeIncBasePriorityPrivilege 1584 WMIC.exe Token: SeCreatePagefilePrivilege 1584 WMIC.exe Token: SeBackupPrivilege 1584 WMIC.exe Token: SeRestorePrivilege 1584 WMIC.exe Token: SeShutdownPrivilege 1584 WMIC.exe Token: SeDebugPrivilege 1584 WMIC.exe Token: SeSystemEnvironmentPrivilege 1584 WMIC.exe Token: SeRemoteShutdownPrivilege 1584 WMIC.exe Token: SeUndockPrivilege 1584 WMIC.exe Token: SeManageVolumePrivilege 1584 WMIC.exe Token: 33 1584 WMIC.exe Token: 34 1584 WMIC.exe Token: 35 1584 WMIC.exe Token: 36 1584 WMIC.exe Token: SeIncreaseQuotaPrivilege 1584 WMIC.exe Token: SeSecurityPrivilege 1584 WMIC.exe Token: SeTakeOwnershipPrivilege 1584 WMIC.exe Token: SeLoadDriverPrivilege 1584 WMIC.exe Token: SeSystemProfilePrivilege 1584 WMIC.exe Token: SeSystemtimePrivilege 1584 WMIC.exe Token: SeProfSingleProcessPrivilege 1584 WMIC.exe Token: SeIncBasePriorityPrivilege 1584 WMIC.exe Token: SeCreatePagefilePrivilege 1584 WMIC.exe Token: SeBackupPrivilege 1584 WMIC.exe Token: SeRestorePrivilege 1584 WMIC.exe Token: SeShutdownPrivilege 1584 WMIC.exe Token: SeDebugPrivilege 1584 WMIC.exe Token: SeSystemEnvironmentPrivilege 1584 WMIC.exe Token: SeRemoteShutdownPrivilege 1584 WMIC.exe Token: SeUndockPrivilege 1584 WMIC.exe Token: SeManageVolumePrivilege 1584 WMIC.exe Token: 33 1584 WMIC.exe Token: 34 1584 WMIC.exe Token: 35 1584 WMIC.exe Token: 36 1584 WMIC.exe Token: SeIncreaseQuotaPrivilege 2416 WMIC.exe Token: SeSecurityPrivilege 2416 WMIC.exe Token: SeTakeOwnershipPrivilege 2416 WMIC.exe Token: SeLoadDriverPrivilege 2416 WMIC.exe Token: SeSystemProfilePrivilege 2416 WMIC.exe Token: SeSystemtimePrivilege 2416 WMIC.exe Token: SeProfSingleProcessPrivilege 2416 WMIC.exe Token: SeIncBasePriorityPrivilege 2416 WMIC.exe Token: SeCreatePagefilePrivilege 2416 WMIC.exe Token: SeBackupPrivilege 2416 WMIC.exe Token: SeRestorePrivilege 2416 WMIC.exe Token: SeShutdownPrivilege 2416 WMIC.exe Token: SeDebugPrivilege 2416 WMIC.exe Token: SeSystemEnvironmentPrivilege 2416 WMIC.exe Token: SeRemoteShutdownPrivilege 2416 WMIC.exe Token: SeUndockPrivilege 2416 WMIC.exe Token: SeManageVolumePrivilege 2416 WMIC.exe Token: 33 2416 WMIC.exe Token: 34 2416 WMIC.exe Token: 35 2416 WMIC.exe Token: 36 2416 WMIC.exe Token: SeIncreaseQuotaPrivilege 2416 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3232 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3232 iexplore.exe 3232 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2984 wrote to memory of 3456 2984 cmd.exe PID 2984 wrote to memory of 3456 2984 cmd.exe PID 3456 wrote to memory of 1584 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1584 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2416 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2416 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1468 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1468 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 744 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 744 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2460 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2460 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2424 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2424 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3008 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3008 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3492 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3492 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 392 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 392 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3200 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3200 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3220 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 3220 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1008 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1008 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1632 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 1632 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2212 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2212 3456 cmd.exe WMIC.exe PID 3456 wrote to memory of 2176 3456 cmd.exe ipconfig.exe PID 3456 wrote to memory of 2176 3456 cmd.exe ipconfig.exe PID 3456 wrote to memory of 1464 3456 cmd.exe ROUTE.EXE PID 3456 wrote to memory of 1464 3456 cmd.exe ROUTE.EXE PID 3456 wrote to memory of 3812 3456 cmd.exe netsh.exe PID 3456 wrote to memory of 3812 3456 cmd.exe netsh.exe PID 3456 wrote to memory of 2880 3456 cmd.exe systeminfo.exe PID 3456 wrote to memory of 2880 3456 cmd.exe systeminfo.exe PID 3456 wrote to memory of 3316 3456 cmd.exe tasklist.exe PID 3456 wrote to memory of 3316 3456 cmd.exe tasklist.exe PID 3456 wrote to memory of 2932 3456 cmd.exe net.exe PID 3456 wrote to memory of 2932 3456 cmd.exe net.exe PID 2932 wrote to memory of 612 2932 net.exe net1.exe PID 2932 wrote to memory of 612 2932 net.exe net1.exe PID 3456 wrote to memory of 1592 3456 cmd.exe net.exe PID 3456 wrote to memory of 1592 3456 cmd.exe net.exe PID 1592 wrote to memory of 1364 1592 net.exe net1.exe PID 1592 wrote to memory of 1364 1592 net.exe net1.exe PID 3456 wrote to memory of 3548 3456 cmd.exe net.exe PID 3456 wrote to memory of 3548 3456 cmd.exe net.exe PID 3548 wrote to memory of 704 3548 net.exe net1.exe PID 3548 wrote to memory of 704 3548 net.exe net1.exe PID 3456 wrote to memory of 1068 3456 cmd.exe net.exe PID 3456 wrote to memory of 1068 3456 cmd.exe net.exe PID 1068 wrote to memory of 436 1068 net.exe net1.exe PID 1068 wrote to memory of 436 1068 net.exe net1.exe PID 3456 wrote to memory of 1300 3456 cmd.exe net.exe PID 3456 wrote to memory of 1300 3456 cmd.exe net.exe PID 3456 wrote to memory of 1328 3456 cmd.exe net.exe PID 3456 wrote to memory of 1328 3456 cmd.exe net.exe PID 1328 wrote to memory of 1704 1328 net.exe net1.exe PID 1328 wrote to memory of 1704 1328 net.exe net1.exe PID 3456 wrote to memory of 1644 3456 cmd.exe net.exe PID 3456 wrote to memory of 1644 3456 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3720 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe"C:\Users\Admin\AppData\Local\Temp\78a9df3c3e0e7395f2ac5cf112331793f00311b251bf435bc3c44869e3705670.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3232 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1184-136-0x0000000000DE0000-0x0000000000DE9000-memory.dmpFilesize
36KB
-
memory/1184-135-0x0000000000DF0000-0x0000000000DF5000-memory.dmpFilesize
20KB
-
memory/1300-149-0x000001B381990000-0x000001B381B59000-memory.dmpFilesize
1.8MB
-
memory/1300-147-0x000001B381980000-0x000001B381981000-memory.dmpFilesize
4KB
-
memory/1372-132-0x0000000000F70000-0x0000000000F7B000-memory.dmpFilesize
44KB
-
memory/1372-131-0x0000000000F80000-0x0000000000F87000-memory.dmpFilesize
28KB
-
memory/2216-128-0x00000000010F0000-0x00000000010FC000-memory.dmpFilesize
48KB
-
memory/2360-143-0x000001FA87BE0000-0x000001FA87BE1000-memory.dmpFilesize
4KB
-
memory/2380-144-0x000001E16BED0000-0x000001E16BED1000-memory.dmpFilesize
4KB
-
memory/2464-138-0x00000000007D0000-0x00000000007DC000-memory.dmpFilesize
48KB
-
memory/2464-137-0x00000000007E0000-0x00000000007E6000-memory.dmpFilesize
24KB
-
memory/2496-145-0x0000023E1E360000-0x0000023E1E361000-memory.dmpFilesize
4KB
-
memory/2496-148-0x0000023E1E6A0000-0x0000023E1E6A1000-memory.dmpFilesize
4KB
-
memory/2972-141-0x0000000000110000-0x0000000000117000-memory.dmpFilesize
28KB
-
memory/2972-142-0x0000000000100000-0x000000000010D000-memory.dmpFilesize
52KB
-
memory/2984-121-0x0000000002770000-0x000000000277F000-memory.dmpFilesize
60KB
-
memory/2984-118-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB
-
memory/3468-146-0x000001623DF40000-0x000001623DF41000-memory.dmpFilesize
4KB
-
memory/3736-116-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/3736-117-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/3736-115-0x0000000000820000-0x000000000084A000-memory.dmpFilesize
168KB
-
memory/3780-130-0x0000000001080000-0x00000000010EB000-memory.dmpFilesize
428KB
-
memory/3780-129-0x00000000010F0000-0x0000000001165000-memory.dmpFilesize
468KB
-
memory/3820-134-0x0000000000EA0000-0x0000000000EAE000-memory.dmpFilesize
56KB
-
memory/3820-133-0x0000000000EB0000-0x0000000000EB9000-memory.dmpFilesize
36KB
-
memory/3940-140-0x00000000004B0000-0x00000000004BB000-memory.dmpFilesize
44KB
-
memory/3940-139-0x00000000004C0000-0x00000000004C6000-memory.dmpFilesize
24KB