Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 11:52
Static task
static1
Behavioral task
behavioral1
Sample
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe
Resource
win10-en-20211208
General
-
Target
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe
-
Size
352KB
-
MD5
68ac356f29229ca830ac9e763f9a26a4
-
SHA1
46afdad82d6eb6380913a04f2e6086104bcee58b
-
SHA256
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907
-
SHA512
5be58a6feef8867af44a48c2c955b9e95de3bfd4d37c88ed630e4d613ceca88d0e92b49796699605a97fe74aaf8332d63c74424b24b31fc940ad06d5e8c1e77e
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 3024 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2780 3696 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 3780 ipconfig.exe 3588 NETSTAT.EXE 1032 NETSTAT.EXE 3964 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A9F4949-5B6C-11EC-9231-D6A35E44B3F8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exepid process 2412 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe 2412 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 3024 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3024 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2412 2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe 3024 3024 3024 3024 3024 3024 3468 explorer.exe 3468 explorer.exe 3024 3024 640 explorer.exe 640 explorer.exe 3024 3024 3604 explorer.exe 3604 explorer.exe 3024 3024 3340 explorer.exe 3340 explorer.exe 3024 3024 3184 explorer.exe 3184 explorer.exe 3024 3024 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe 1140 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3960 WMIC.exe Token: SeSecurityPrivilege 3960 WMIC.exe Token: SeTakeOwnershipPrivilege 3960 WMIC.exe Token: SeLoadDriverPrivilege 3960 WMIC.exe Token: SeSystemProfilePrivilege 3960 WMIC.exe Token: SeSystemtimePrivilege 3960 WMIC.exe Token: SeProfSingleProcessPrivilege 3960 WMIC.exe Token: SeIncBasePriorityPrivilege 3960 WMIC.exe Token: SeCreatePagefilePrivilege 3960 WMIC.exe Token: SeBackupPrivilege 3960 WMIC.exe Token: SeRestorePrivilege 3960 WMIC.exe Token: SeShutdownPrivilege 3960 WMIC.exe Token: SeDebugPrivilege 3960 WMIC.exe Token: SeSystemEnvironmentPrivilege 3960 WMIC.exe Token: SeRemoteShutdownPrivilege 3960 WMIC.exe Token: SeUndockPrivilege 3960 WMIC.exe Token: SeManageVolumePrivilege 3960 WMIC.exe Token: 33 3960 WMIC.exe Token: 34 3960 WMIC.exe Token: 35 3960 WMIC.exe Token: 36 3960 WMIC.exe Token: SeIncreaseQuotaPrivilege 3960 WMIC.exe Token: SeSecurityPrivilege 3960 WMIC.exe Token: SeTakeOwnershipPrivilege 3960 WMIC.exe Token: SeLoadDriverPrivilege 3960 WMIC.exe Token: SeSystemProfilePrivilege 3960 WMIC.exe Token: SeSystemtimePrivilege 3960 WMIC.exe Token: SeProfSingleProcessPrivilege 3960 WMIC.exe Token: SeIncBasePriorityPrivilege 3960 WMIC.exe Token: SeCreatePagefilePrivilege 3960 WMIC.exe Token: SeBackupPrivilege 3960 WMIC.exe Token: SeRestorePrivilege 3960 WMIC.exe Token: SeShutdownPrivilege 3960 WMIC.exe Token: SeDebugPrivilege 3960 WMIC.exe Token: SeSystemEnvironmentPrivilege 3960 WMIC.exe Token: SeRemoteShutdownPrivilege 3960 WMIC.exe Token: SeUndockPrivilege 3960 WMIC.exe Token: SeManageVolumePrivilege 3960 WMIC.exe Token: 33 3960 WMIC.exe Token: 34 3960 WMIC.exe Token: 35 3960 WMIC.exe Token: 36 3960 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: 36 1504 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1388 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1388 iexplore.exe 1388 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3024 wrote to memory of 4036 3024 cmd.exe PID 3024 wrote to memory of 4036 3024 cmd.exe PID 4036 wrote to memory of 3960 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3960 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1504 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1504 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 884 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 884 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1156 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1156 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 368 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 368 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1684 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 1684 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2120 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2120 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2132 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2132 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3204 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3204 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2980 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2980 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3468 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3468 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 640 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 640 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2296 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 2296 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3344 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3344 4036 cmd.exe WMIC.exe PID 4036 wrote to memory of 3780 4036 cmd.exe ipconfig.exe PID 4036 wrote to memory of 3780 4036 cmd.exe ipconfig.exe PID 4036 wrote to memory of 2184 4036 cmd.exe ROUTE.EXE PID 4036 wrote to memory of 2184 4036 cmd.exe ROUTE.EXE PID 4036 wrote to memory of 3748 4036 cmd.exe netsh.exe PID 4036 wrote to memory of 3748 4036 cmd.exe netsh.exe PID 4036 wrote to memory of 2448 4036 cmd.exe systeminfo.exe PID 4036 wrote to memory of 2448 4036 cmd.exe systeminfo.exe PID 4036 wrote to memory of 2400 4036 cmd.exe tasklist.exe PID 4036 wrote to memory of 2400 4036 cmd.exe tasklist.exe PID 4036 wrote to memory of 3108 4036 cmd.exe net.exe PID 4036 wrote to memory of 3108 4036 cmd.exe net.exe PID 3108 wrote to memory of 3996 3108 net.exe net1.exe PID 3108 wrote to memory of 3996 3108 net.exe net1.exe PID 4036 wrote to memory of 2700 4036 cmd.exe net.exe PID 4036 wrote to memory of 2700 4036 cmd.exe net.exe PID 2700 wrote to memory of 2992 2700 net.exe net1.exe PID 2700 wrote to memory of 2992 2700 net.exe net1.exe PID 4036 wrote to memory of 3016 4036 cmd.exe net.exe PID 4036 wrote to memory of 3016 4036 cmd.exe net.exe PID 3016 wrote to memory of 2788 3016 net.exe net1.exe PID 3016 wrote to memory of 2788 3016 net.exe net1.exe PID 4036 wrote to memory of 2780 4036 cmd.exe net.exe PID 4036 wrote to memory of 2780 4036 cmd.exe net.exe PID 2780 wrote to memory of 60 2780 net.exe net1.exe PID 2780 wrote to memory of 60 2780 net.exe net1.exe PID 4036 wrote to memory of 2616 4036 cmd.exe net.exe PID 4036 wrote to memory of 2616 4036 cmd.exe net.exe PID 4036 wrote to memory of 672 4036 cmd.exe net.exe PID 4036 wrote to memory of 672 4036 cmd.exe net.exe PID 672 wrote to memory of 1588 672 net.exe net1.exe PID 672 wrote to memory of 1588 672 net.exe net1.exe PID 4036 wrote to memory of 1188 4036 cmd.exe net.exe PID 4036 wrote to memory of 1188 4036 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe"C:\Users\Admin\AppData\Local\Temp\2fca3f21df39b77f19f6aff9aa4249f8cea2380cbeedc3d98119d012a0a39907.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1388 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-133-0x00000000007E0000-0x00000000007E9000-memory.dmpFilesize
36KB
-
memory/640-134-0x00000000007D0000-0x00000000007DE000-memory.dmpFilesize
56KB
-
memory/1140-142-0x0000000000F20000-0x0000000000F2D000-memory.dmpFilesize
52KB
-
memory/1140-141-0x0000000000F30000-0x0000000000F37000-memory.dmpFilesize
28KB
-
memory/2388-143-0x000001BB06C40000-0x000001BB06C41000-memory.dmpFilesize
4KB
-
memory/2412-116-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2412-117-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2412-115-0x00000000005F0000-0x000000000061A000-memory.dmpFilesize
168KB
-
memory/2420-144-0x00000286A1A80000-0x00000286A1A81000-memory.dmpFilesize
4KB
-
memory/2500-129-0x0000000000C40000-0x0000000000CAB000-memory.dmpFilesize
428KB
-
memory/2500-128-0x0000000000CB0000-0x0000000000D25000-memory.dmpFilesize
468KB
-
memory/2708-147-0x0000015B0BC10000-0x0000015B0BC11000-memory.dmpFilesize
4KB
-
memory/2708-145-0x0000015B0B8D0000-0x0000015B0B8D1000-memory.dmpFilesize
4KB
-
memory/2780-148-0x0000025850A50000-0x0000025850A51000-memory.dmpFilesize
4KB
-
memory/3024-118-0x00000000012D0000-0x00000000012E6000-memory.dmpFilesize
88KB
-
memory/3024-121-0x00000000030F0000-0x00000000030FF000-memory.dmpFilesize
60KB
-
memory/3184-139-0x00000000007E0000-0x00000000007E6000-memory.dmpFilesize
24KB
-
memory/3184-140-0x00000000007D0000-0x00000000007DB000-memory.dmpFilesize
44KB
-
memory/3340-137-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/3340-138-0x00000000005D0000-0x00000000005DC000-memory.dmpFilesize
48KB
-
memory/3440-146-0x000001BA57D50000-0x000001BA57D51000-memory.dmpFilesize
4KB
-
memory/3468-132-0x0000000000450000-0x000000000045B000-memory.dmpFilesize
44KB
-
memory/3468-131-0x0000000000460000-0x0000000000467000-memory.dmpFilesize
28KB
-
memory/3604-136-0x0000000000EA0000-0x0000000000EA9000-memory.dmpFilesize
36KB
-
memory/3604-135-0x0000000000EB0000-0x0000000000EB5000-memory.dmpFilesize
20KB
-
memory/4076-130-0x00000000005C0000-0x00000000005CC000-memory.dmpFilesize
48KB