Analysis
-
max time kernel
160s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 20:33
Static task
static1
Behavioral task
behavioral1
Sample
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe
Resource
win10-en-20211208
General
-
Target
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe
-
Size
352KB
-
MD5
7cec540b57de2cb38158ec47be2c1c59
-
SHA1
d5d469fc1fe61b14b8a041da76ad6a503efcce06
-
SHA256
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9
-
SHA512
734d11783660d9961df652d5fa710b9e51afa26ab74a1f8c83ad21d559a21998a6083ef1111644b055f635ac17394a67ca70643d420a1cbf73f5db9ca48fad20
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 396 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3348 3832 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 4980 ipconfig.exe 984 NETSTAT.EXE 1320 NETSTAT.EXE 2784 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25A2C7CB-59B1-11EC-9231-4A7FAB6426E3} = "0" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exepid process 3448 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe 3448 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3448 4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe 396 396 396 396 396 396 396 396 3160 explorer.exe 3160 explorer.exe 3192 explorer.exe 3192 explorer.exe 396 396 4452 explorer.exe 4452 explorer.exe 396 396 3144 explorer.exe 3144 explorer.exe 396 396 4008 explorer.exe 4008 explorer.exe 396 396 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe 3416 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 4296 WMIC.exe Token: SeSecurityPrivilege 4296 WMIC.exe Token: SeTakeOwnershipPrivilege 4296 WMIC.exe Token: SeLoadDriverPrivilege 4296 WMIC.exe Token: SeSystemProfilePrivilege 4296 WMIC.exe Token: SeSystemtimePrivilege 4296 WMIC.exe Token: SeProfSingleProcessPrivilege 4296 WMIC.exe Token: SeIncBasePriorityPrivilege 4296 WMIC.exe Token: SeCreatePagefilePrivilege 4296 WMIC.exe Token: SeBackupPrivilege 4296 WMIC.exe Token: SeRestorePrivilege 4296 WMIC.exe Token: SeShutdownPrivilege 4296 WMIC.exe Token: SeDebugPrivilege 4296 WMIC.exe Token: SeSystemEnvironmentPrivilege 4296 WMIC.exe Token: SeRemoteShutdownPrivilege 4296 WMIC.exe Token: SeUndockPrivilege 4296 WMIC.exe Token: SeManageVolumePrivilege 4296 WMIC.exe Token: 33 4296 WMIC.exe Token: 34 4296 WMIC.exe Token: 35 4296 WMIC.exe Token: 36 4296 WMIC.exe Token: SeIncreaseQuotaPrivilege 4296 WMIC.exe Token: SeSecurityPrivilege 4296 WMIC.exe Token: SeTakeOwnershipPrivilege 4296 WMIC.exe Token: SeLoadDriverPrivilege 4296 WMIC.exe Token: SeSystemProfilePrivilege 4296 WMIC.exe Token: SeSystemtimePrivilege 4296 WMIC.exe Token: SeProfSingleProcessPrivilege 4296 WMIC.exe Token: SeIncBasePriorityPrivilege 4296 WMIC.exe Token: SeCreatePagefilePrivilege 4296 WMIC.exe Token: SeBackupPrivilege 4296 WMIC.exe Token: SeRestorePrivilege 4296 WMIC.exe Token: SeShutdownPrivilege 4296 WMIC.exe Token: SeDebugPrivilege 4296 WMIC.exe Token: SeSystemEnvironmentPrivilege 4296 WMIC.exe Token: SeRemoteShutdownPrivilege 4296 WMIC.exe Token: SeUndockPrivilege 4296 WMIC.exe Token: SeManageVolumePrivilege 4296 WMIC.exe Token: 33 4296 WMIC.exe Token: 34 4296 WMIC.exe Token: 35 4296 WMIC.exe Token: 36 4296 WMIC.exe Token: SeIncreaseQuotaPrivilege 4456 WMIC.exe Token: SeSecurityPrivilege 4456 WMIC.exe Token: SeTakeOwnershipPrivilege 4456 WMIC.exe Token: SeLoadDriverPrivilege 4456 WMIC.exe Token: SeSystemProfilePrivilege 4456 WMIC.exe Token: SeSystemtimePrivilege 4456 WMIC.exe Token: SeProfSingleProcessPrivilege 4456 WMIC.exe Token: SeIncBasePriorityPrivilege 4456 WMIC.exe Token: SeCreatePagefilePrivilege 4456 WMIC.exe Token: SeBackupPrivilege 4456 WMIC.exe Token: SeRestorePrivilege 4456 WMIC.exe Token: SeShutdownPrivilege 4456 WMIC.exe Token: SeDebugPrivilege 4456 WMIC.exe Token: SeSystemEnvironmentPrivilege 4456 WMIC.exe Token: SeRemoteShutdownPrivilege 4456 WMIC.exe Token: SeUndockPrivilege 4456 WMIC.exe Token: SeManageVolumePrivilege 4456 WMIC.exe Token: 33 4456 WMIC.exe Token: 34 4456 WMIC.exe Token: 35 4456 WMIC.exe Token: 36 4456 WMIC.exe Token: SeIncreaseQuotaPrivilege 4456 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3024 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3024 iexplore.exe 3024 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 396 wrote to memory of 3316 396 cmd.exe PID 396 wrote to memory of 3316 396 cmd.exe PID 3316 wrote to memory of 4296 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4296 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4456 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4456 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4044 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4044 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 588 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 588 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 860 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 860 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2480 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2480 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2708 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2708 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2780 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2780 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2912 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2912 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 3124 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 3124 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2932 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 2932 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4816 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4816 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 1236 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 1236 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4904 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4904 3316 cmd.exe WMIC.exe PID 3316 wrote to memory of 4980 3316 cmd.exe ipconfig.exe PID 3316 wrote to memory of 4980 3316 cmd.exe ipconfig.exe PID 3316 wrote to memory of 1332 3316 cmd.exe ROUTE.EXE PID 3316 wrote to memory of 1332 3316 cmd.exe ROUTE.EXE PID 3316 wrote to memory of 1968 3316 cmd.exe netsh.exe PID 3316 wrote to memory of 1968 3316 cmd.exe netsh.exe PID 3316 wrote to memory of 3608 3316 cmd.exe systeminfo.exe PID 3316 wrote to memory of 3608 3316 cmd.exe systeminfo.exe PID 3316 wrote to memory of 4888 3316 cmd.exe tasklist.exe PID 3316 wrote to memory of 4888 3316 cmd.exe tasklist.exe PID 3316 wrote to memory of 5088 3316 cmd.exe net.exe PID 3316 wrote to memory of 5088 3316 cmd.exe net.exe PID 5088 wrote to memory of 5072 5088 net.exe net1.exe PID 5088 wrote to memory of 5072 5088 net.exe net1.exe PID 3316 wrote to memory of 2636 3316 cmd.exe net.exe PID 3316 wrote to memory of 2636 3316 cmd.exe net.exe PID 2636 wrote to memory of 1076 2636 net.exe net1.exe PID 2636 wrote to memory of 1076 2636 net.exe net1.exe PID 3316 wrote to memory of 400 3316 cmd.exe net.exe PID 3316 wrote to memory of 400 3316 cmd.exe net.exe PID 400 wrote to memory of 376 400 net.exe net1.exe PID 400 wrote to memory of 376 400 net.exe net1.exe PID 3316 wrote to memory of 2648 3316 cmd.exe net.exe PID 3316 wrote to memory of 2648 3316 cmd.exe net.exe PID 2648 wrote to memory of 1084 2648 net.exe net1.exe PID 2648 wrote to memory of 1084 2648 net.exe net1.exe PID 3316 wrote to memory of 4604 3316 cmd.exe net.exe PID 3316 wrote to memory of 4604 3316 cmd.exe net.exe PID 3316 wrote to memory of 4776 3316 cmd.exe net.exe PID 3316 wrote to memory of 4776 3316 cmd.exe net.exe PID 4776 wrote to memory of 4940 4776 net.exe net1.exe PID 4776 wrote to memory of 4940 4776 net.exe net1.exe PID 3316 wrote to memory of 2872 3316 cmd.exe net.exe PID 3316 wrote to memory of 2872 3316 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3832 -s 9002⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe"C:\Users\Admin\AppData\Local\Temp\4646265f4b50a7bcc90d7b87cd3a80fab6b348bf1fddb8db8e25b25691fe56e9.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/396-121-0x0000000000B00000-0x0000000000B16000-memory.dmpFilesize
88KB
-
memory/396-124-0x0000000000BA0000-0x0000000002A70000-memory.dmpFilesize
30.8MB
-
memory/2344-152-0x0000026932C00000-0x0000026932C01000-memory.dmpFilesize
4KB
-
memory/2360-153-0x0000020109B50000-0x0000020109B51000-memory.dmpFilesize
4KB
-
memory/2424-159-0x000001C5B4B90000-0x000001C5B4B91000-memory.dmpFilesize
4KB
-
memory/2424-154-0x000001C5B4850000-0x000001C5B4851000-memory.dmpFilesize
4KB
-
memory/3028-143-0x0000000002840000-0x00000000028AB000-memory.dmpFilesize
428KB
-
memory/3028-141-0x00000000028B0000-0x0000000002925000-memory.dmpFilesize
468KB
-
memory/3144-147-0x00000000010E0000-0x00000000010EC000-memory.dmpFilesize
48KB
-
memory/3144-146-0x00000000010F0000-0x00000000010F6000-memory.dmpFilesize
24KB
-
memory/3160-138-0x0000000000AC0000-0x0000000000AC9000-memory.dmpFilesize
36KB
-
memory/3160-139-0x0000000000AB0000-0x0000000000ABE000-memory.dmpFilesize
56KB
-
memory/3192-142-0x0000000002CD0000-0x0000000002CDB000-memory.dmpFilesize
44KB
-
memory/3192-140-0x0000000002CE0000-0x0000000002CE7000-memory.dmpFilesize
28KB
-
memory/3348-158-0x0000021F78EB0000-0x0000021F79012000-memory.dmpFilesize
1.4MB
-
memory/3348-157-0x0000021F78EB0000-0x0000021F79012000-memory.dmpFilesize
1.4MB
-
memory/3416-151-0x0000000000B90000-0x0000000000B9D000-memory.dmpFilesize
52KB
-
memory/3416-150-0x0000000000BA0000-0x0000000000BA7000-memory.dmpFilesize
28KB
-
memory/3448-118-0x00000000006C0000-0x00000000006E9000-memory.dmpFilesize
164KB
-
memory/3448-120-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3448-119-0x0000000000490000-0x00000000005DA000-memory.dmpFilesize
1.3MB
-
memory/3540-155-0x000002677C8B0000-0x000002677C8B1000-memory.dmpFilesize
4KB
-
memory/3704-137-0x0000000001280000-0x000000000128C000-memory.dmpFilesize
48KB
-
memory/4008-149-0x00000000027A0000-0x00000000027AB000-memory.dmpFilesize
44KB
-
memory/4008-148-0x00000000027B0000-0x00000000027B6000-memory.dmpFilesize
24KB
-
memory/4452-145-0x0000000002840000-0x0000000002849000-memory.dmpFilesize
36KB
-
memory/4452-144-0x0000000002850000-0x0000000002855000-memory.dmpFilesize
20KB