Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 10:43
Static task
static1
Behavioral task
behavioral1
Sample
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe
Resource
win10-en-20211208
General
-
Target
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe
-
Size
352KB
-
MD5
31b9d8d4a63e8bf4ea6212b93a18713d
-
SHA1
aea8d712428d1df2a4ba6b9b2e0acec371a98730
-
SHA256
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa
-
SHA512
e0136e48a4e0a5ef48265ad676efa1c727f7a2aec88befd5d888bb86ff90b68b9905d8eab4ee9b818ea87ae9256dea240b950a02617baefe2429b13f5d307230
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3660 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3664 ipconfig.exe 580 NETSTAT.EXE 3916 NETSTAT.EXE 1372 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B31A115-5B6C-11EC-9231-D6A35E44B3F8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exepid process 2468 d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe 2468 d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2468 d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe 3024 3024 3024 3024 3024 3024 1912 explorer.exe 1912 explorer.exe 3024 3024 948 explorer.exe 948 explorer.exe 3024 3024 1064 explorer.exe 1064 explorer.exe 3024 3024 3748 explorer.exe 3748 explorer.exe 3024 3024 2204 explorer.exe 2204 explorer.exe 3024 3024 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe 480 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe Token: SeIncreaseQuotaPrivilege 2780 WMIC.exe Token: SeSecurityPrivilege 2780 WMIC.exe Token: SeTakeOwnershipPrivilege 2780 WMIC.exe Token: SeLoadDriverPrivilege 2780 WMIC.exe Token: SeSystemProfilePrivilege 2780 WMIC.exe Token: SeSystemtimePrivilege 2780 WMIC.exe Token: SeProfSingleProcessPrivilege 2780 WMIC.exe Token: SeIncBasePriorityPrivilege 2780 WMIC.exe Token: SeCreatePagefilePrivilege 2780 WMIC.exe Token: SeBackupPrivilege 2780 WMIC.exe Token: SeRestorePrivilege 2780 WMIC.exe Token: SeShutdownPrivilege 2780 WMIC.exe Token: SeDebugPrivilege 2780 WMIC.exe Token: SeSystemEnvironmentPrivilege 2780 WMIC.exe Token: SeRemoteShutdownPrivilege 2780 WMIC.exe Token: SeUndockPrivilege 2780 WMIC.exe Token: SeManageVolumePrivilege 2780 WMIC.exe Token: 33 2780 WMIC.exe Token: 34 2780 WMIC.exe Token: 35 2780 WMIC.exe Token: 36 2780 WMIC.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe Token: SeSecurityPrivilege 1140 WMIC.exe Token: SeTakeOwnershipPrivilege 1140 WMIC.exe Token: SeLoadDriverPrivilege 1140 WMIC.exe Token: SeSystemProfilePrivilege 1140 WMIC.exe Token: SeSystemtimePrivilege 1140 WMIC.exe Token: SeProfSingleProcessPrivilege 1140 WMIC.exe Token: SeIncBasePriorityPrivilege 1140 WMIC.exe Token: SeCreatePagefilePrivilege 1140 WMIC.exe Token: SeBackupPrivilege 1140 WMIC.exe Token: SeRestorePrivilege 1140 WMIC.exe Token: SeShutdownPrivilege 1140 WMIC.exe Token: SeDebugPrivilege 1140 WMIC.exe Token: SeSystemEnvironmentPrivilege 1140 WMIC.exe Token: SeRemoteShutdownPrivilege 1140 WMIC.exe Token: SeUndockPrivilege 1140 WMIC.exe Token: SeManageVolumePrivilege 1140 WMIC.exe Token: 33 1140 WMIC.exe Token: 34 1140 WMIC.exe Token: 35 1140 WMIC.exe Token: 36 1140 WMIC.exe Token: SeIncreaseQuotaPrivilege 1140 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2144 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2144 iexplore.exe 2144 iexplore.exe 1844 IEXPLORE.EXE 1844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3024 wrote to memory of 856 3024 cmd.exe PID 3024 wrote to memory of 856 3024 cmd.exe PID 856 wrote to memory of 2780 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2780 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1140 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1140 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1064 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1064 856 cmd.exe WMIC.exe PID 856 wrote to memory of 684 856 cmd.exe WMIC.exe PID 856 wrote to memory of 684 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2568 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2568 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1880 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1880 856 cmd.exe WMIC.exe PID 856 wrote to memory of 3944 856 cmd.exe WMIC.exe PID 856 wrote to memory of 3944 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2480 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2480 856 cmd.exe WMIC.exe PID 856 wrote to memory of 68 856 cmd.exe WMIC.exe PID 856 wrote to memory of 68 856 cmd.exe WMIC.exe PID 856 wrote to memory of 3048 856 cmd.exe WMIC.exe PID 856 wrote to memory of 3048 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2104 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2104 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1740 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1740 856 cmd.exe WMIC.exe PID 856 wrote to memory of 948 856 cmd.exe WMIC.exe PID 856 wrote to memory of 948 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2264 856 cmd.exe WMIC.exe PID 856 wrote to memory of 2264 856 cmd.exe WMIC.exe PID 856 wrote to memory of 3664 856 cmd.exe ipconfig.exe PID 856 wrote to memory of 3664 856 cmd.exe ipconfig.exe PID 856 wrote to memory of 780 856 cmd.exe ROUTE.EXE PID 856 wrote to memory of 780 856 cmd.exe ROUTE.EXE PID 856 wrote to memory of 1808 856 cmd.exe netsh.exe PID 856 wrote to memory of 1808 856 cmd.exe netsh.exe PID 856 wrote to memory of 2656 856 cmd.exe systeminfo.exe PID 856 wrote to memory of 2656 856 cmd.exe systeminfo.exe PID 856 wrote to memory of 2460 856 cmd.exe tasklist.exe PID 856 wrote to memory of 2460 856 cmd.exe tasklist.exe PID 856 wrote to memory of 4032 856 cmd.exe net.exe PID 856 wrote to memory of 4032 856 cmd.exe net.exe PID 4032 wrote to memory of 3924 4032 net.exe net1.exe PID 4032 wrote to memory of 3924 4032 net.exe net1.exe PID 856 wrote to memory of 680 856 cmd.exe net.exe PID 856 wrote to memory of 680 856 cmd.exe net.exe PID 680 wrote to memory of 3284 680 net.exe net1.exe PID 680 wrote to memory of 3284 680 net.exe net1.exe PID 856 wrote to memory of 1564 856 cmd.exe net.exe PID 856 wrote to memory of 1564 856 cmd.exe net.exe PID 1564 wrote to memory of 1152 1564 net.exe net1.exe PID 1564 wrote to memory of 1152 1564 net.exe net1.exe PID 856 wrote to memory of 2612 856 cmd.exe net.exe PID 856 wrote to memory of 2612 856 cmd.exe net.exe PID 2612 wrote to memory of 884 2612 net.exe net1.exe PID 2612 wrote to memory of 884 2612 net.exe net1.exe PID 856 wrote to memory of 1120 856 cmd.exe net.exe PID 856 wrote to memory of 1120 856 cmd.exe net.exe PID 856 wrote to memory of 596 856 cmd.exe net.exe PID 856 wrote to memory of 596 856 cmd.exe net.exe PID 596 wrote to memory of 600 596 net.exe net1.exe PID 596 wrote to memory of 600 596 net.exe net1.exe PID 856 wrote to memory of 364 856 cmd.exe net.exe PID 856 wrote to memory of 364 856 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe"C:\Users\Admin\AppData\Local\Temp\d52f0f1ac98c8da148663f1548533fe71765b190ea82cb4f0b818084deb0e1aa.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/480-142-0x00000000010C0000-0x00000000010CD000-memory.dmpFilesize
52KB
-
memory/480-141-0x00000000010D0000-0x00000000010D7000-memory.dmpFilesize
28KB
-
memory/948-134-0x00000000001B0000-0x00000000001BE000-memory.dmpFilesize
56KB
-
memory/948-133-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1028-130-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1064-136-0x0000000002F70000-0x0000000002F79000-memory.dmpFilesize
36KB
-
memory/1064-135-0x0000000002F80000-0x0000000002F85000-memory.dmpFilesize
20KB
-
memory/1912-131-0x00000000001B0000-0x00000000001B7000-memory.dmpFilesize
28KB
-
memory/1912-132-0x00000000001A0000-0x00000000001AB000-memory.dmpFilesize
44KB
-
memory/2204-139-0x0000000000990000-0x0000000000996000-memory.dmpFilesize
24KB
-
memory/2204-140-0x0000000000980000-0x000000000098B000-memory.dmpFilesize
44KB
-
memory/2388-143-0x000001BB06C40000-0x000001BB06C41000-memory.dmpFilesize
4KB
-
memory/2420-144-0x00000286A1A80000-0x00000286A1A81000-memory.dmpFilesize
4KB
-
memory/2468-116-0x0000000000490000-0x000000000053E000-memory.dmpFilesize
696KB
-
memory/2468-117-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2708-145-0x0000015B0B8D0000-0x0000015B0B8D1000-memory.dmpFilesize
4KB
-
memory/2708-147-0x0000015B0BC10000-0x0000015B0BC11000-memory.dmpFilesize
4KB
-
memory/2980-129-0x0000000002EF0000-0x0000000002F5B000-memory.dmpFilesize
428KB
-
memory/2980-128-0x0000000002F60000-0x0000000002FD5000-memory.dmpFilesize
468KB
-
memory/3024-121-0x0000000002F60000-0x0000000002F6F000-memory.dmpFilesize
60KB
-
memory/3024-118-0x00000000012D0000-0x00000000012E6000-memory.dmpFilesize
88KB
-
memory/3440-146-0x000001BA57D50000-0x000001BA57D51000-memory.dmpFilesize
4KB
-
memory/3660-148-0x00000299F27A0000-0x00000299F27A1000-memory.dmpFilesize
4KB
-
memory/3748-138-0x0000000000380000-0x000000000038C000-memory.dmpFilesize
48KB
-
memory/3748-137-0x0000000000390000-0x0000000000396000-memory.dmpFilesize
24KB