Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe
Resource
win10-en-20211208
General
-
Target
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe
-
Size
352KB
-
MD5
f709d60e1dd6354fcb587b6a1e17a21d
-
SHA1
c9a1aab6d7c48883960321c4620c576d3ef65f38
-
SHA256
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30
-
SHA512
10d2ac104d77f65955f63f56d32037f2556ad9386d557e911485b7ea67af8c4fbeca4b0a27a215a0e9b7965a1c6952ab772efeb84e6ec317da344fb4239d239c
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 1928 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3828 3568 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeNETSTAT.EXENETSTAT.EXEpid process 1676 ipconfig.exe 3948 ipconfig.exe 3652 NETSTAT.EXE 1472 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8AF0C37-80B9-11EC-9231-E62B0207BF3E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exepid process 2696 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe 2696 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 1928 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1928 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2696 2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe 1928 1928 1928 1928 1928 1928 1584 explorer.exe 1584 explorer.exe 1928 1928 2456 explorer.exe 2456 explorer.exe 1928 1928 3660 explorer.exe 3660 explorer.exe 1928 1928 3972 explorer.exe 3972 explorer.exe 1928 1928 2316 explorer.exe 2316 explorer.exe 1928 1928 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe 4072 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 596 WMIC.exe Token: SeSecurityPrivilege 596 WMIC.exe Token: SeTakeOwnershipPrivilege 596 WMIC.exe Token: SeLoadDriverPrivilege 596 WMIC.exe Token: SeSystemProfilePrivilege 596 WMIC.exe Token: SeSystemtimePrivilege 596 WMIC.exe Token: SeProfSingleProcessPrivilege 596 WMIC.exe Token: SeIncBasePriorityPrivilege 596 WMIC.exe Token: SeCreatePagefilePrivilege 596 WMIC.exe Token: SeBackupPrivilege 596 WMIC.exe Token: SeRestorePrivilege 596 WMIC.exe Token: SeShutdownPrivilege 596 WMIC.exe Token: SeDebugPrivilege 596 WMIC.exe Token: SeSystemEnvironmentPrivilege 596 WMIC.exe Token: SeRemoteShutdownPrivilege 596 WMIC.exe Token: SeUndockPrivilege 596 WMIC.exe Token: SeManageVolumePrivilege 596 WMIC.exe Token: 33 596 WMIC.exe Token: 34 596 WMIC.exe Token: 35 596 WMIC.exe Token: 36 596 WMIC.exe Token: SeIncreaseQuotaPrivilege 596 WMIC.exe Token: SeSecurityPrivilege 596 WMIC.exe Token: SeTakeOwnershipPrivilege 596 WMIC.exe Token: SeLoadDriverPrivilege 596 WMIC.exe Token: SeSystemProfilePrivilege 596 WMIC.exe Token: SeSystemtimePrivilege 596 WMIC.exe Token: SeProfSingleProcessPrivilege 596 WMIC.exe Token: SeIncBasePriorityPrivilege 596 WMIC.exe Token: SeCreatePagefilePrivilege 596 WMIC.exe Token: SeBackupPrivilege 596 WMIC.exe Token: SeRestorePrivilege 596 WMIC.exe Token: SeShutdownPrivilege 596 WMIC.exe Token: SeDebugPrivilege 596 WMIC.exe Token: SeSystemEnvironmentPrivilege 596 WMIC.exe Token: SeRemoteShutdownPrivilege 596 WMIC.exe Token: SeUndockPrivilege 596 WMIC.exe Token: SeManageVolumePrivilege 596 WMIC.exe Token: 33 596 WMIC.exe Token: 34 596 WMIC.exe Token: 35 596 WMIC.exe Token: 36 596 WMIC.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe Token: SeSecurityPrivilege 692 WMIC.exe Token: SeTakeOwnershipPrivilege 692 WMIC.exe Token: SeLoadDriverPrivilege 692 WMIC.exe Token: SeSystemProfilePrivilege 692 WMIC.exe Token: SeSystemtimePrivilege 692 WMIC.exe Token: SeProfSingleProcessPrivilege 692 WMIC.exe Token: SeIncBasePriorityPrivilege 692 WMIC.exe Token: SeCreatePagefilePrivilege 692 WMIC.exe Token: SeBackupPrivilege 692 WMIC.exe Token: SeRestorePrivilege 692 WMIC.exe Token: SeShutdownPrivilege 692 WMIC.exe Token: SeDebugPrivilege 692 WMIC.exe Token: SeSystemEnvironmentPrivilege 692 WMIC.exe Token: SeRemoteShutdownPrivilege 692 WMIC.exe Token: SeUndockPrivilege 692 WMIC.exe Token: SeManageVolumePrivilege 692 WMIC.exe Token: 33 692 WMIC.exe Token: 34 692 WMIC.exe Token: 35 692 WMIC.exe Token: 36 692 WMIC.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2128 iexplore.exe 2128 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1928 wrote to memory of 2584 1928 cmd.exe PID 1928 wrote to memory of 2584 1928 cmd.exe PID 2584 wrote to memory of 596 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 596 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 692 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 692 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2064 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2064 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3196 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3196 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3788 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3788 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 792 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 792 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3920 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3920 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3212 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3212 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2952 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2952 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3588 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3588 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 684 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 684 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 1164 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 1164 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3692 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3692 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2168 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 2168 2584 cmd.exe WMIC.exe PID 2584 wrote to memory of 3948 2584 cmd.exe ipconfig.exe PID 2584 wrote to memory of 3948 2584 cmd.exe ipconfig.exe PID 2584 wrote to memory of 3672 2584 cmd.exe ROUTE.EXE PID 2584 wrote to memory of 3672 2584 cmd.exe ROUTE.EXE PID 2584 wrote to memory of 3156 2584 cmd.exe netsh.exe PID 2584 wrote to memory of 3156 2584 cmd.exe netsh.exe PID 2584 wrote to memory of 2880 2584 cmd.exe systeminfo.exe PID 2584 wrote to memory of 2880 2584 cmd.exe systeminfo.exe PID 2584 wrote to memory of 3264 2584 cmd.exe tasklist.exe PID 2584 wrote to memory of 3264 2584 cmd.exe tasklist.exe PID 2584 wrote to memory of 644 2584 cmd.exe net.exe PID 2584 wrote to memory of 644 2584 cmd.exe net.exe PID 644 wrote to memory of 524 644 net.exe net1.exe PID 644 wrote to memory of 524 644 net.exe net1.exe PID 2584 wrote to memory of 708 2584 cmd.exe net.exe PID 2584 wrote to memory of 708 2584 cmd.exe net.exe PID 708 wrote to memory of 3720 708 net.exe net1.exe PID 708 wrote to memory of 3720 708 net.exe net1.exe PID 2584 wrote to memory of 1236 2584 cmd.exe net.exe PID 2584 wrote to memory of 1236 2584 cmd.exe net.exe PID 1236 wrote to memory of 360 1236 net.exe net1.exe PID 1236 wrote to memory of 360 1236 net.exe net1.exe PID 2584 wrote to memory of 364 2584 cmd.exe net.exe PID 2584 wrote to memory of 364 2584 cmd.exe net.exe PID 364 wrote to memory of 704 364 net.exe net1.exe PID 364 wrote to memory of 704 364 net.exe net1.exe PID 2584 wrote to memory of 2924 2584 cmd.exe net.exe PID 2584 wrote to memory of 2924 2584 cmd.exe net.exe PID 2584 wrote to memory of 664 2584 cmd.exe net.exe PID 2584 wrote to memory of 664 2584 cmd.exe net.exe PID 664 wrote to memory of 2284 664 net.exe net1.exe PID 664 wrote to memory of 2284 664 net.exe net1.exe PID 2584 wrote to memory of 1360 2584 cmd.exe net.exe PID 2584 wrote to memory of 1360 2584 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3568 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe"C:\Users\Admin\AppData\Local\Temp\2bcb3ba0c0e172fe3988e762c0c794fd60a169ff1d988679722d4e1305c6ee30.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-131-0x00000000028C0000-0x00000000028C7000-memory.dmpFilesize
28KB
-
memory/1584-132-0x00000000028B0000-0x00000000028BB000-memory.dmpFilesize
44KB
-
memory/1928-121-0x0000000002810000-0x000000000281F000-memory.dmpFilesize
60KB
-
memory/1928-118-0x0000000000850000-0x0000000000866000-memory.dmpFilesize
88KB
-
memory/2316-140-0x00000000027C0000-0x00000000027CB000-memory.dmpFilesize
44KB
-
memory/2316-139-0x00000000027D0000-0x00000000027D6000-memory.dmpFilesize
24KB
-
memory/2456-133-0x0000000000690000-0x0000000000699000-memory.dmpFilesize
36KB
-
memory/2456-134-0x0000000000680000-0x000000000068E000-memory.dmpFilesize
56KB
-
memory/2612-143-0x000002169DD00000-0x000002169DD01000-memory.dmpFilesize
4KB
-
memory/2664-144-0x000001D46E8C0000-0x000001D46E8C1000-memory.dmpFilesize
4KB
-
memory/2696-115-0x00000000007E0000-0x0000000000809000-memory.dmpFilesize
164KB
-
memory/2696-116-0x0000000000490000-0x00000000005DA000-memory.dmpFilesize
1.3MB
-
memory/2696-117-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2852-145-0x000002C024900000-0x000002C024901000-memory.dmpFilesize
4KB
-
memory/2852-147-0x000002C024C40000-0x000002C024C41000-memory.dmpFilesize
4KB
-
memory/2980-130-0x0000000002960000-0x00000000029CB000-memory.dmpFilesize
428KB
-
memory/2980-129-0x0000000002C00000-0x0000000002C75000-memory.dmpFilesize
468KB
-
memory/3432-146-0x00000213933A0000-0x00000213933A1000-memory.dmpFilesize
4KB
-
memory/3660-135-0x0000000003090000-0x0000000003095000-memory.dmpFilesize
20KB
-
memory/3660-136-0x0000000003080000-0x0000000003089000-memory.dmpFilesize
36KB
-
memory/3828-148-0x000001BFFDB60000-0x000001BFFDB61000-memory.dmpFilesize
4KB
-
memory/3892-128-0x00000000012A0000-0x00000000012AC000-memory.dmpFilesize
48KB
-
memory/3972-138-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/3972-137-0x00000000003E0000-0x00000000003E6000-memory.dmpFilesize
24KB
-
memory/4072-141-0x0000000000890000-0x0000000000897000-memory.dmpFilesize
28KB
-
memory/4072-142-0x0000000000880000-0x000000000088D000-memory.dmpFilesize
52KB