Analysis
-
max time kernel
167s -
max time network
169s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 00:20
Static task
static1
Behavioral task
behavioral1
Sample
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe
Resource
win10-en-20211208
General
-
Target
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe
-
Size
316KB
-
MD5
0d0b0dbf2329b5524a15537186c77d9b
-
SHA1
eba3c6059c29912c41d821aa6599a11577355051
-
SHA256
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616
-
SHA512
477d2476f2d8b94cbb3759eebea6fb0287e9ee553c61ec821e791e08b611b8169f537da2edbdd34a3ea7b669da8670fa6682d6a80b55b623d39b43f862f0a28e
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2364 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3112 3752 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXENETSTAT.EXEipconfig.exeipconfig.exepid process 3936 NETSTAT.EXE 1360 NETSTAT.EXE 2992 ipconfig.exe 1076 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4F4C8CF-833D-11EC-876A-DE070294B4D8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exepid process 3508 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe 3508 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2364 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3508 071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe 2364 2364 2364 2364 2364 2364 1204 explorer.exe 1204 explorer.exe 2364 2364 2520 explorer.exe 2520 explorer.exe 2364 2364 1076 explorer.exe 1076 explorer.exe 2364 2364 1308 explorer.exe 1308 explorer.exe 2364 2364 2084 explorer.exe 2084 explorer.exe 2364 2364 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe 3764 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1844 WMIC.exe Token: SeSecurityPrivilege 1844 WMIC.exe Token: SeTakeOwnershipPrivilege 1844 WMIC.exe Token: SeLoadDriverPrivilege 1844 WMIC.exe Token: SeSystemProfilePrivilege 1844 WMIC.exe Token: SeSystemtimePrivilege 1844 WMIC.exe Token: SeProfSingleProcessPrivilege 1844 WMIC.exe Token: SeIncBasePriorityPrivilege 1844 WMIC.exe Token: SeCreatePagefilePrivilege 1844 WMIC.exe Token: SeBackupPrivilege 1844 WMIC.exe Token: SeRestorePrivilege 1844 WMIC.exe Token: SeShutdownPrivilege 1844 WMIC.exe Token: SeDebugPrivilege 1844 WMIC.exe Token: SeSystemEnvironmentPrivilege 1844 WMIC.exe Token: SeRemoteShutdownPrivilege 1844 WMIC.exe Token: SeUndockPrivilege 1844 WMIC.exe Token: SeManageVolumePrivilege 1844 WMIC.exe Token: 33 1844 WMIC.exe Token: 34 1844 WMIC.exe Token: 35 1844 WMIC.exe Token: 36 1844 WMIC.exe Token: SeIncreaseQuotaPrivilege 1844 WMIC.exe Token: SeSecurityPrivilege 1844 WMIC.exe Token: SeTakeOwnershipPrivilege 1844 WMIC.exe Token: SeLoadDriverPrivilege 1844 WMIC.exe Token: SeSystemProfilePrivilege 1844 WMIC.exe Token: SeSystemtimePrivilege 1844 WMIC.exe Token: SeProfSingleProcessPrivilege 1844 WMIC.exe Token: SeIncBasePriorityPrivilege 1844 WMIC.exe Token: SeCreatePagefilePrivilege 1844 WMIC.exe Token: SeBackupPrivilege 1844 WMIC.exe Token: SeRestorePrivilege 1844 WMIC.exe Token: SeShutdownPrivilege 1844 WMIC.exe Token: SeDebugPrivilege 1844 WMIC.exe Token: SeSystemEnvironmentPrivilege 1844 WMIC.exe Token: SeRemoteShutdownPrivilege 1844 WMIC.exe Token: SeUndockPrivilege 1844 WMIC.exe Token: SeManageVolumePrivilege 1844 WMIC.exe Token: 33 1844 WMIC.exe Token: 34 1844 WMIC.exe Token: 35 1844 WMIC.exe Token: 36 1844 WMIC.exe Token: SeIncreaseQuotaPrivilege 1328 WMIC.exe Token: SeSecurityPrivilege 1328 WMIC.exe Token: SeTakeOwnershipPrivilege 1328 WMIC.exe Token: SeLoadDriverPrivilege 1328 WMIC.exe Token: SeSystemProfilePrivilege 1328 WMIC.exe Token: SeSystemtimePrivilege 1328 WMIC.exe Token: SeProfSingleProcessPrivilege 1328 WMIC.exe Token: SeIncBasePriorityPrivilege 1328 WMIC.exe Token: SeCreatePagefilePrivilege 1328 WMIC.exe Token: SeBackupPrivilege 1328 WMIC.exe Token: SeRestorePrivilege 1328 WMIC.exe Token: SeShutdownPrivilege 1328 WMIC.exe Token: SeDebugPrivilege 1328 WMIC.exe Token: SeSystemEnvironmentPrivilege 1328 WMIC.exe Token: SeRemoteShutdownPrivilege 1328 WMIC.exe Token: SeUndockPrivilege 1328 WMIC.exe Token: SeManageVolumePrivilege 1328 WMIC.exe Token: 33 1328 WMIC.exe Token: 34 1328 WMIC.exe Token: 35 1328 WMIC.exe Token: 36 1328 WMIC.exe Token: SeIncreaseQuotaPrivilege 1328 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2792 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2792 iexplore.exe 2792 iexplore.exe 3960 IEXPLORE.EXE 3960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2364 wrote to memory of 3144 2364 cmd.exe PID 2364 wrote to memory of 3144 2364 cmd.exe PID 3144 wrote to memory of 1844 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1844 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1328 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1328 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2520 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2520 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1100 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1100 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1504 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1504 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3580 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3580 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3024 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3024 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2124 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2124 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3228 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 3228 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2784 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 2784 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1780 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1780 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1824 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1824 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1176 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1176 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1972 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1972 3144 cmd.exe WMIC.exe PID 3144 wrote to memory of 1076 3144 cmd.exe ipconfig.exe PID 3144 wrote to memory of 1076 3144 cmd.exe ipconfig.exe PID 3144 wrote to memory of 3796 3144 cmd.exe ROUTE.EXE PID 3144 wrote to memory of 3796 3144 cmd.exe ROUTE.EXE PID 3144 wrote to memory of 1296 3144 cmd.exe netsh.exe PID 3144 wrote to memory of 1296 3144 cmd.exe netsh.exe PID 3144 wrote to memory of 2548 3144 cmd.exe systeminfo.exe PID 3144 wrote to memory of 2548 3144 cmd.exe systeminfo.exe PID 3144 wrote to memory of 1232 3144 cmd.exe tasklist.exe PID 3144 wrote to memory of 1232 3144 cmd.exe tasklist.exe PID 3144 wrote to memory of 2712 3144 cmd.exe net.exe PID 3144 wrote to memory of 2712 3144 cmd.exe net.exe PID 2712 wrote to memory of 1252 2712 net.exe net1.exe PID 2712 wrote to memory of 1252 2712 net.exe net1.exe PID 3144 wrote to memory of 1144 3144 cmd.exe net.exe PID 3144 wrote to memory of 1144 3144 cmd.exe net.exe PID 1144 wrote to memory of 380 1144 net.exe net1.exe PID 1144 wrote to memory of 380 1144 net.exe net1.exe PID 3144 wrote to memory of 3156 3144 cmd.exe net.exe PID 3144 wrote to memory of 3156 3144 cmd.exe net.exe PID 3156 wrote to memory of 608 3156 net.exe net1.exe PID 3156 wrote to memory of 608 3156 net.exe net1.exe PID 3144 wrote to memory of 3256 3144 cmd.exe net.exe PID 3144 wrote to memory of 3256 3144 cmd.exe net.exe PID 3256 wrote to memory of 404 3256 net.exe net1.exe PID 3256 wrote to memory of 404 3256 net.exe net1.exe PID 3144 wrote to memory of 1136 3144 cmd.exe net.exe PID 3144 wrote to memory of 1136 3144 cmd.exe net.exe PID 3144 wrote to memory of 1128 3144 cmd.exe net.exe PID 3144 wrote to memory of 1128 3144 cmd.exe net.exe PID 1128 wrote to memory of 784 1128 net.exe net1.exe PID 1128 wrote to memory of 784 1128 net.exe net1.exe PID 3144 wrote to memory of 736 3144 cmd.exe net.exe PID 3144 wrote to memory of 736 3144 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3752 -s 9122⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe"C:\Users\Admin\AppData\Local\Temp\071316d2db6746e3b026add63d4ba5993092218d9f4a101fde5b7c361a715616.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-130-0x0000000000B50000-0x0000000000B5C000-memory.dmpFilesize
48KB
-
memory/1076-136-0x0000000002F70000-0x0000000002F79000-memory.dmpFilesize
36KB
-
memory/1076-135-0x0000000002F80000-0x0000000002F85000-memory.dmpFilesize
20KB
-
memory/1204-132-0x0000000000500000-0x000000000050B000-memory.dmpFilesize
44KB
-
memory/1204-131-0x0000000000510000-0x0000000000517000-memory.dmpFilesize
28KB
-
memory/1308-137-0x0000000000BF0000-0x0000000000BF6000-memory.dmpFilesize
24KB
-
memory/1308-138-0x0000000000BE0000-0x0000000000BEC000-memory.dmpFilesize
48KB
-
memory/2084-140-0x0000000000410000-0x000000000041B000-memory.dmpFilesize
44KB
-
memory/2084-139-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/2364-121-0x00000000010A0000-0x00000000010AF000-memory.dmpFilesize
60KB
-
memory/2364-118-0x0000000000E50000-0x0000000000E66000-memory.dmpFilesize
88KB
-
memory/2520-133-0x0000000000180000-0x0000000000189000-memory.dmpFilesize
36KB
-
memory/2520-134-0x0000000000170000-0x000000000017E000-memory.dmpFilesize
56KB
-
memory/2668-143-0x000002C72EF20000-0x000002C72EF21000-memory.dmpFilesize
4KB
-
memory/2696-144-0x000001CAEE9F0000-0x000001CAEE9F1000-memory.dmpFilesize
4KB
-
memory/2796-129-0x0000000003000000-0x000000000306B000-memory.dmpFilesize
428KB
-
memory/2796-128-0x0000000003070000-0x00000000030E5000-memory.dmpFilesize
468KB
-
memory/2872-145-0x000001FAE0370000-0x000001FAE0371000-memory.dmpFilesize
4KB
-
memory/2872-148-0x000001FAE06B0000-0x000001FAE06B1000-memory.dmpFilesize
4KB
-
memory/3112-147-0x0000024F00F90000-0x0000024F00F91000-memory.dmpFilesize
4KB
-
memory/3488-146-0x0000028705280000-0x0000028705281000-memory.dmpFilesize
4KB
-
memory/3508-115-0x00000000005C0000-0x00000000005C8000-memory.dmpFilesize
32KB
-
memory/3508-117-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3508-116-0x00000000005D0000-0x00000000005D9000-memory.dmpFilesize
36KB
-
memory/3764-141-0x0000000000EC0000-0x0000000000EC7000-memory.dmpFilesize
28KB
-
memory/3764-142-0x0000000000EB0000-0x0000000000EBD000-memory.dmpFilesize
52KB