smokeloader | 733aa27b3ca43c299f47ff800e1e2b99bfe58a09f4807ca6227047a2abd3f552

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39e50abfbe53394397416303df0c99d6.exe
Size 412KB
Sample220412-py23jabdfm
SHA256 733aa27b3ca43c299f47ff800e1e2b99bfe58a09f4807ca6227047a2abd3f552
MD5 39e50abfbe53394397416303df0c99d6
SHA1 ff7b47fe6f7a10b00ab539dece9d625364d8b5c5
SHA512 c665294af3151fc108963046cc273d7266279976aaf317ff65fd5ad53d24669dc50e48a2b66c25f1b6562fd2cf73dd637e38d8b72f9658179f2cda8c32ac547d
MD5 SHA1 SHA512

Score

10^/10

smokeloader backdoor evasion suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

https://oakland-studio.video/search.php
https://seattle-university.video/search.php

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2084	WerFault.exe	145

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39e50abfbe53394397416303df0c99d6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39e50abfbe53394397416303df0c99d6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39e50abfbe53394397416303df0c99d6.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3512	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4016	NETSTAT.EXE
4144	NETSTAT.EXE
4720	ipconfig.exe
4228	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3296	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2bdf96ee36d9544a96c6515b05c5582000000000200000000001066000000010000200000002b6c3f662863f825fbd658d32bda502e626e046b1cb04f7385f5a909e64fd0b8000000000e800000000200002000000030963f1a640f73be1efedabb06b803b244aaad854521832da46f80f391f6fc9e200000002654209bded1a95c4c5f1d4417b6daa65150c953c2b15530d0beea98506fe0e64000000048afbf36b7f459c3eb8abf4480c21e025109eccff094dfb25d1151d0996e3ead170afb4d2a9a97cf1b9c8e1ffe375c9c920152af282609e7f7b581794159c77a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "516941942"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2bdf96ee36d9544a96c6515b05c558200000000020000000000106600000001000020000000394e9006107c1fe309dd522894dd9de96ee1162a41030994c3bebc23f14e40a9000000000e800000000200002000000024052313be63bb6276f88fdbbdc1adfed29e56cdcacc620af608bf60d9a5493a20000000a3089761868d72725ad9210b27655f1c896f4e93cf86b3bc66bbfd9c236ec795400000000fa1fbe3f4b2516e01a8f77e6718af1ca7e89442da48c2a475729239c71cfebca597c8ae929e6015fab8b61a5f5a412ef06e5dbf5d0ef8aaf69746801da6fafc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09c0c237c4ed801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08318237c4ed801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356539759"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30953084"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953084"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "515067153"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "515067153"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4A39150D-BA6F-11EC-9DAB-66834AD3A487} = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000_Classes\Local Settings\MuiCache	backgroundTaskHost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3292	39e50abfbe53394397416303df0c99d6.exe
3292	39e50abfbe53394397416303df0c99d6.exe
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1004	Process not Found

Suspicious behavior: MapViewOfSection 53 IoCs

pid	Process
3292	39e50abfbe53394397416303df0c99d6.exe
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
1004	Process not Found
4420	explorer.exe
4420	explorer.exe
1004	Process not Found
1004	Process not Found
4228	explorer.exe
4228	explorer.exe
1004	Process not Found
1004	Process not Found
4232	explorer.exe
4232	explorer.exe
1004	Process not Found
1004	Process not Found
2452	explorer.exe
2452	explorer.exe
1004	Process not Found
1004	Process not Found
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
4376	explorer.exe
1004	Process not Found
1004	Process not Found
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe
2996	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4520	WMIC.exe
Token: SeSecurityPrivilege	4520	WMIC.exe
Token: SeTakeOwnershipPrivilege	4520	WMIC.exe
Token: SeLoadDriverPrivilege	4520	WMIC.exe
Token: SeSystemProfilePrivilege	4520	WMIC.exe
Token: SeSystemtimePrivilege	4520	WMIC.exe
Token: SeProfSingleProcessPrivilege	4520	WMIC.exe
Token: SeIncBasePriorityPrivilege	4520	WMIC.exe
Token: SeCreatePagefilePrivilege	4520	WMIC.exe
Token: SeBackupPrivilege	4520	WMIC.exe
Token: SeRestorePrivilege	4520	WMIC.exe
Token: SeShutdownPrivilege	4520	WMIC.exe
Token: SeDebugPrivilege	4520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4520	WMIC.exe
Token: SeRemoteShutdownPrivilege	4520	WMIC.exe
Token: SeUndockPrivilege	4520	WMIC.exe
Token: SeManageVolumePrivilege	4520	WMIC.exe
Token: 33	4520	WMIC.exe
Token: 34	4520	WMIC.exe
Token: 35	4520	WMIC.exe
Token: 36	4520	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4520	WMIC.exe
Token: SeSecurityPrivilege	4520	WMIC.exe
Token: SeTakeOwnershipPrivilege	4520	WMIC.exe
Token: SeLoadDriverPrivilege	4520	WMIC.exe
Token: SeSystemProfilePrivilege	4520	WMIC.exe
Token: SeSystemtimePrivilege	4520	WMIC.exe
Token: SeProfSingleProcessPrivilege	4520	WMIC.exe
Token: SeIncBasePriorityPrivilege	4520	WMIC.exe
Token: SeCreatePagefilePrivilege	4520	WMIC.exe
Token: SeBackupPrivilege	4520	WMIC.exe
Token: SeRestorePrivilege	4520	WMIC.exe
Token: SeShutdownPrivilege	4520	WMIC.exe
Token: SeDebugPrivilege	4520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4520	WMIC.exe
Token: SeRemoteShutdownPrivilege	4520	WMIC.exe
Token: SeUndockPrivilege	4520	WMIC.exe
Token: SeManageVolumePrivilege	4520	WMIC.exe
Token: 33	4520	WMIC.exe
Token: 34	4520	WMIC.exe
Token: 35	4520	WMIC.exe
Token: 36	4520	WMIC.exe
Token: SeIncreaseQuotaPrivilege	828	WMIC.exe
Token: SeSecurityPrivilege	828	WMIC.exe
Token: SeTakeOwnershipPrivilege	828	WMIC.exe
Token: SeLoadDriverPrivilege	828	WMIC.exe
Token: SeSystemProfilePrivilege	828	WMIC.exe
Token: SeSystemtimePrivilege	828	WMIC.exe
Token: SeProfSingleProcessPrivilege	828	WMIC.exe
Token: SeIncBasePriorityPrivilege	828	WMIC.exe
Token: SeCreatePagefilePrivilege	828	WMIC.exe
Token: SeBackupPrivilege	828	WMIC.exe
Token: SeRestorePrivilege	828	WMIC.exe
Token: SeShutdownPrivilege	828	WMIC.exe
Token: SeDebugPrivilege	828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	828	WMIC.exe
Token: SeRemoteShutdownPrivilege	828	WMIC.exe
Token: SeUndockPrivilege	828	WMIC.exe
Token: SeManageVolumePrivilege	828	WMIC.exe
Token: 33	828	WMIC.exe
Token: 34	828	WMIC.exe
Token: 35	828	WMIC.exe
Token: 36	828	WMIC.exe
Token: SeIncreaseQuotaPrivilege	828	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
4716	IEXPLORE.EXE
4716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4808	1004	Process not Found	89
PID 1004 wrote to memory of 4808	1004	Process not Found	89
PID 4808 wrote to memory of 4520	4808	cmd.exe	91
PID 4808 wrote to memory of 4520	4808	cmd.exe	91
PID 4808 wrote to memory of 828	4808	cmd.exe	92
PID 4808 wrote to memory of 828	4808	cmd.exe	92
PID 4808 wrote to memory of 1404	4808	cmd.exe	93
PID 4808 wrote to memory of 1404	4808	cmd.exe	93
PID 4808 wrote to memory of 4680	4808	cmd.exe	94
PID 4808 wrote to memory of 4680	4808	cmd.exe	94
PID 4808 wrote to memory of 4480	4808	cmd.exe	95
PID 4808 wrote to memory of 4480	4808	cmd.exe	95
PID 4808 wrote to memory of 1156	4808	cmd.exe	98
PID 4808 wrote to memory of 1156	4808	cmd.exe	98
PID 4808 wrote to memory of 3800	4808	cmd.exe	99
PID 4808 wrote to memory of 3800	4808	cmd.exe	99
PID 4808 wrote to memory of 5052	4808	cmd.exe	100
PID 4808 wrote to memory of 5052	4808	cmd.exe	100
PID 4808 wrote to memory of 4224	4808	cmd.exe	101
PID 4808 wrote to memory of 4224	4808	cmd.exe	101
PID 4808 wrote to memory of 3604	4808	cmd.exe	102
PID 4808 wrote to memory of 3604	4808	cmd.exe	102
PID 4808 wrote to memory of 3584	4808	cmd.exe	103
PID 4808 wrote to memory of 3584	4808	cmd.exe	103
PID 4808 wrote to memory of 3452	4808	cmd.exe	104
PID 4808 wrote to memory of 3452	4808	cmd.exe	104
PID 4808 wrote to memory of 2776	4808	cmd.exe	105
PID 4808 wrote to memory of 2776	4808	cmd.exe	105
PID 4808 wrote to memory of 1568	4808	cmd.exe	106
PID 4808 wrote to memory of 1568	4808	cmd.exe	106
PID 4808 wrote to memory of 4228	4808	cmd.exe	108
PID 4808 wrote to memory of 4228	4808	cmd.exe	108
PID 4808 wrote to memory of 2180	4808	cmd.exe	109
PID 4808 wrote to memory of 2180	4808	cmd.exe	109
PID 4808 wrote to memory of 3056	4808	cmd.exe	110
PID 4808 wrote to memory of 3056	4808	cmd.exe	110
PID 4808 wrote to memory of 3296	4808	cmd.exe	111
PID 4808 wrote to memory of 3296	4808	cmd.exe	111
PID 4808 wrote to memory of 3512	4808	cmd.exe	119
PID 4808 wrote to memory of 3512	4808	cmd.exe	119
PID 4808 wrote to memory of 4448	4808	cmd.exe	121
PID 4808 wrote to memory of 4448	4808	cmd.exe	121
PID 4448 wrote to memory of 4688	4448	net.exe	122
PID 4448 wrote to memory of 4688	4448	net.exe	122
PID 4808 wrote to memory of 1196	4808	cmd.exe	123
PID 4808 wrote to memory of 1196	4808	cmd.exe	123
PID 1196 wrote to memory of 5012	1196	net.exe	124
PID 1196 wrote to memory of 5012	1196	net.exe	124
PID 4808 wrote to memory of 4220	4808	cmd.exe	125
PID 4808 wrote to memory of 4220	4808	cmd.exe	125
PID 4220 wrote to memory of 3692	4220	net.exe	126
PID 4220 wrote to memory of 3692	4220	net.exe	126
PID 4808 wrote to memory of 3916	4808	cmd.exe	127
PID 4808 wrote to memory of 3916	4808	cmd.exe	127
PID 3916 wrote to memory of 1536	3916	net.exe	128
PID 3916 wrote to memory of 1536	3916	net.exe	128
PID 4808 wrote to memory of 3328	4808	cmd.exe	129
PID 4808 wrote to memory of 3328	4808	cmd.exe	129
PID 4808 wrote to memory of 2732	4808	cmd.exe	130
PID 4808 wrote to memory of 2732	4808	cmd.exe	130
PID 2732 wrote to memory of 468	2732	net.exe	131
PID 2732 wrote to memory of 468	2732	net.exe	131
PID 4808 wrote to memory of 3120	4808	cmd.exe	132
PID 4808 wrote to memory of 3120	4808	cmd.exe	132

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3736

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3104

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2660

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Users\Admin\AppData\Local\Temp\39e50abfbe53394397416303df0c99d6.exe
"C:\Users\Admin\AppData\Local\Temp\39e50abfbe53394397416303df0c99d6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3292

C:\Windows\system32\cmd.exe
cmd
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:1404
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:4680
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:4480
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:1156
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:3800
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:5052
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:4224
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:3604
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:3584
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:3452
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:2776
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:1568
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:4228
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:2180
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  PID:3056
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:3296
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:3512
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts /domain
    3⤵
    PID:4688
- C:\Windows\system32\net.exe
  net share
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:5012
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:3692
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:1536
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:3328
- C:\Windows\system32\net.exe
  net group
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:468
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:3120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:2948
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:1336
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:3352
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:4144
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:3188
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:4720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2252

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:4184

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4716

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 872
  2⤵
  - Program crash
  PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2084 -ip 2084
1⤵
PID:4164

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4420

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4228

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4232

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2452

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4376

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2996

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Modifies registry class
PID:4712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 26dce13feda2a3246817e7763b4b5ecc05be9701b9865c327934afa71d582be1
MD5 a5295b4e1f55f566e97f538a9686daf4
SHA1 c0c0252c0d7d516d49d1e2a0d20622cb8b6a2e3b
SHA512 731884bc5aae84b09411d32eff7b076a5b2ee38a216517f175be71812118658ee46a3e33ea6f25745973ecea9181ec472b8ca4d43a105f1630c44bb324be4901
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 434B
SHA256 1123e3c83e9ceb71cf7e5231655bd49505867898f4904be95af7dbee68c67793
MD5 dcbcdb2ee4e408b49ca4b27e5b762ee1
SHA1 348ba564841a78c852101ef4526e877418a6800c
SHA512 72d59227c99b23c8c3836906fc5452a1b83279c3ce6dbd9816b3fd5107bb26d6328630be7ac9a94bd3d63bbd97b3c3fa209770f6e4e2dc26e347d76d992c71e1
MD5 SHA1 SHA512

Submit Download

bc5e7b2dae664b83a2819f132cc8f4a6_1

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\bc5e7b2dae664b83a2819f132cc8f4a6_1
Size 3KB
SHA256 dd7da34143303c8df8cb61ad703bb4545117d6b405f2c4c84076b6fed5221d8b
MD5 a69f929bc2d954cd220b2536f77a1214
SHA1 13c23aae296dd8c12612278f6fb509fd86223255
SHA512 d0944647eab1f35b1fb102cc32d7faa0ad1a9ba3abdf1a7cd407cd946a0675e105681fda0c8fdd847ff8b70cfd82fa174f054da9f3b97b1e65297c94750e926f
MD5 SHA1 SHA512

Submit Download

memory/1004-126-0x0000000000860000-0x0000000000876000-memory.dmp

Download

memory/1004-127-0x0000000002810000-0x000000000281F000-memory.dmp

Download

memory/3292-125-0x0000000000860000-0x0000000000869000-memory.dmp

Download

memory/3292-124-0x0000000000850000-0x000000000085A000-memory.dmp

Download