Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
20-05-2022 22:49
Static task
static1
Behavioral task
behavioral1
Sample
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe
Resource
win10-20220414-en
General
-
Target
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe
-
Size
304KB
-
MD5
0c17e95d1daf58f2eea465d5f07e1b02
-
SHA1
92017f67294378617d6e5f614e65c8585ed8b390
-
SHA256
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676
-
SHA512
6ce776c372ef53071df4e0ffec06d9fe6374bb82e71c7d4df83a987ee7d33026f9da9405accd9495a81605ba77408b81bc42220a34171a50165d55766af66a4c
Malware Config
Extracted
smokeloader
2020
https://ny-city-mall.com/search.php
https://fresh-cars.net/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Modifies Windows Firewall 1 TTPs
-
Deletes itself 1 IoCs
Processes:
pid process 2488 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeNETSTAT.EXENETSTAT.EXEipconfig.exepid process 4080 ipconfig.exe 2564 NETSTAT.EXE 3540 NETSTAT.EXE 1264 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960813" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2876099876" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30960813" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D61A9DDA-D8A0-11EC-B804-6A7F83E02785} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2876099876" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exepid process 2264 a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe 2264 a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 2488 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2488 -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2264 a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe 2488 2488 2488 2488 2488 2488 2488 2488 3476 explorer.exe 3476 explorer.exe 2488 2488 2384 explorer.exe 2384 explorer.exe 2276 explorer.exe 2276 explorer.exe 2488 2488 3200 explorer.exe 3200 explorer.exe 2488 2488 2488 2488 2776 explorer.exe 2776 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe 3924 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1124 WMIC.exe Token: SeSecurityPrivilege 1124 WMIC.exe Token: SeTakeOwnershipPrivilege 1124 WMIC.exe Token: SeLoadDriverPrivilege 1124 WMIC.exe Token: SeSystemProfilePrivilege 1124 WMIC.exe Token: SeSystemtimePrivilege 1124 WMIC.exe Token: SeProfSingleProcessPrivilege 1124 WMIC.exe Token: SeIncBasePriorityPrivilege 1124 WMIC.exe Token: SeCreatePagefilePrivilege 1124 WMIC.exe Token: SeBackupPrivilege 1124 WMIC.exe Token: SeRestorePrivilege 1124 WMIC.exe Token: SeShutdownPrivilege 1124 WMIC.exe Token: SeDebugPrivilege 1124 WMIC.exe Token: SeSystemEnvironmentPrivilege 1124 WMIC.exe Token: SeRemoteShutdownPrivilege 1124 WMIC.exe Token: SeUndockPrivilege 1124 WMIC.exe Token: SeManageVolumePrivilege 1124 WMIC.exe Token: 33 1124 WMIC.exe Token: 34 1124 WMIC.exe Token: 35 1124 WMIC.exe Token: 36 1124 WMIC.exe Token: SeIncreaseQuotaPrivilege 1124 WMIC.exe Token: SeSecurityPrivilege 1124 WMIC.exe Token: SeTakeOwnershipPrivilege 1124 WMIC.exe Token: SeLoadDriverPrivilege 1124 WMIC.exe Token: SeSystemProfilePrivilege 1124 WMIC.exe Token: SeSystemtimePrivilege 1124 WMIC.exe Token: SeProfSingleProcessPrivilege 1124 WMIC.exe Token: SeIncBasePriorityPrivilege 1124 WMIC.exe Token: SeCreatePagefilePrivilege 1124 WMIC.exe Token: SeBackupPrivilege 1124 WMIC.exe Token: SeRestorePrivilege 1124 WMIC.exe Token: SeShutdownPrivilege 1124 WMIC.exe Token: SeDebugPrivilege 1124 WMIC.exe Token: SeSystemEnvironmentPrivilege 1124 WMIC.exe Token: SeRemoteShutdownPrivilege 1124 WMIC.exe Token: SeUndockPrivilege 1124 WMIC.exe Token: SeManageVolumePrivilege 1124 WMIC.exe Token: 33 1124 WMIC.exe Token: 34 1124 WMIC.exe Token: 35 1124 WMIC.exe Token: 36 1124 WMIC.exe Token: SeIncreaseQuotaPrivilege 3208 WMIC.exe Token: SeSecurityPrivilege 3208 WMIC.exe Token: SeTakeOwnershipPrivilege 3208 WMIC.exe Token: SeLoadDriverPrivilege 3208 WMIC.exe Token: SeSystemProfilePrivilege 3208 WMIC.exe Token: SeSystemtimePrivilege 3208 WMIC.exe Token: SeProfSingleProcessPrivilege 3208 WMIC.exe Token: SeIncBasePriorityPrivilege 3208 WMIC.exe Token: SeCreatePagefilePrivilege 3208 WMIC.exe Token: SeBackupPrivilege 3208 WMIC.exe Token: SeRestorePrivilege 3208 WMIC.exe Token: SeShutdownPrivilege 3208 WMIC.exe Token: SeDebugPrivilege 3208 WMIC.exe Token: SeSystemEnvironmentPrivilege 3208 WMIC.exe Token: SeRemoteShutdownPrivilege 3208 WMIC.exe Token: SeUndockPrivilege 3208 WMIC.exe Token: SeManageVolumePrivilege 3208 WMIC.exe Token: 33 3208 WMIC.exe Token: 34 3208 WMIC.exe Token: 35 3208 WMIC.exe Token: 36 3208 WMIC.exe Token: SeIncreaseQuotaPrivilege 3208 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3220 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3220 iexplore.exe 3220 iexplore.exe 3400 IEXPLORE.EXE 3400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2488 wrote to memory of 424 2488 cmd.exe PID 2488 wrote to memory of 424 2488 cmd.exe PID 424 wrote to memory of 1124 424 cmd.exe WMIC.exe PID 424 wrote to memory of 1124 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3208 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3208 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3616 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3616 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2324 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2324 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2400 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2400 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2636 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2636 424 cmd.exe WMIC.exe PID 424 wrote to memory of 1856 424 cmd.exe WMIC.exe PID 424 wrote to memory of 1856 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3872 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3872 424 cmd.exe WMIC.exe PID 424 wrote to memory of 916 424 cmd.exe WMIC.exe PID 424 wrote to memory of 916 424 cmd.exe WMIC.exe PID 424 wrote to memory of 1088 424 cmd.exe WMIC.exe PID 424 wrote to memory of 1088 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3220 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3220 424 cmd.exe WMIC.exe PID 424 wrote to memory of 548 424 cmd.exe WMIC.exe PID 424 wrote to memory of 548 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2264 424 cmd.exe WMIC.exe PID 424 wrote to memory of 2264 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3328 424 cmd.exe WMIC.exe PID 424 wrote to memory of 3328 424 cmd.exe WMIC.exe PID 424 wrote to memory of 4080 424 cmd.exe ipconfig.exe PID 424 wrote to memory of 4080 424 cmd.exe ipconfig.exe PID 424 wrote to memory of 592 424 cmd.exe ROUTE.EXE PID 424 wrote to memory of 592 424 cmd.exe ROUTE.EXE PID 424 wrote to memory of 2904 424 cmd.exe netsh.exe PID 424 wrote to memory of 2904 424 cmd.exe netsh.exe PID 424 wrote to memory of 1400 424 cmd.exe systeminfo.exe PID 424 wrote to memory of 1400 424 cmd.exe systeminfo.exe PID 424 wrote to memory of 204 424 cmd.exe tasklist.exe PID 424 wrote to memory of 204 424 cmd.exe tasklist.exe PID 424 wrote to memory of 2276 424 cmd.exe net.exe PID 424 wrote to memory of 2276 424 cmd.exe net.exe PID 2276 wrote to memory of 1972 2276 net.exe net1.exe PID 2276 wrote to memory of 1972 2276 net.exe net1.exe PID 424 wrote to memory of 1156 424 cmd.exe net.exe PID 424 wrote to memory of 1156 424 cmd.exe net.exe PID 1156 wrote to memory of 2744 1156 net.exe net1.exe PID 1156 wrote to memory of 2744 1156 net.exe net1.exe PID 424 wrote to memory of 4072 424 cmd.exe net.exe PID 424 wrote to memory of 4072 424 cmd.exe net.exe PID 4072 wrote to memory of 2116 4072 net.exe net1.exe PID 4072 wrote to memory of 2116 4072 net.exe net1.exe PID 424 wrote to memory of 1728 424 cmd.exe net.exe PID 424 wrote to memory of 1728 424 cmd.exe net.exe PID 1728 wrote to memory of 3524 1728 net.exe net1.exe PID 1728 wrote to memory of 3524 1728 net.exe net1.exe PID 424 wrote to memory of 2840 424 cmd.exe net.exe PID 424 wrote to memory of 2840 424 cmd.exe net.exe PID 424 wrote to memory of 1008 424 cmd.exe net.exe PID 424 wrote to memory of 1008 424 cmd.exe net.exe PID 1008 wrote to memory of 3688 1008 net.exe net1.exe PID 1008 wrote to memory of 3688 1008 net.exe net1.exe PID 424 wrote to memory of 3700 424 cmd.exe net.exe PID 424 wrote to memory of 3700 424 cmd.exe net.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe"C:\Users\Admin\AppData\Local\Temp\a89f5e16612f2a1515ddf2c0cd49569b710eb70b5ab3a07b450867d49c263676.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3220 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/204-179-0x0000000000000000-mapping.dmp
-
memory/424-158-0x0000000000000000-mapping.dmp
-
memory/548-172-0x0000000000000000-mapping.dmp
-
memory/592-176-0x0000000000000000-mapping.dmp
-
memory/916-169-0x0000000000000000-mapping.dmp
-
memory/1008-189-0x0000000000000000-mapping.dmp
-
memory/1088-170-0x0000000000000000-mapping.dmp
-
memory/1124-159-0x0000000000000000-mapping.dmp
-
memory/1156-182-0x0000000000000000-mapping.dmp
-
memory/1264-199-0x0000000000000000-mapping.dmp
-
memory/1272-221-0x0000000000000000-mapping.dmp
-
memory/1400-214-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-208-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-225-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-223-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-222-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-220-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-219-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-218-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-217-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-216-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-226-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-215-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-213-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-212-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-211-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-210-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-209-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-224-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-207-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-206-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-205-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-204-0x0000000000000000-mapping.dmp
-
memory/1400-227-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-228-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-229-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-236-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-230-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-231-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-232-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-233-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-178-0x0000000000000000-mapping.dmp
-
memory/1400-234-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1400-235-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/1728-186-0x0000000000000000-mapping.dmp
-
memory/1856-167-0x0000000000000000-mapping.dmp
-
memory/1972-181-0x0000000000000000-mapping.dmp
-
memory/2116-185-0x0000000000000000-mapping.dmp
-
memory/2264-130-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-125-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-173-0x0000000000000000-mapping.dmp
-
memory/2264-131-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-132-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-133-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-134-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-135-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-118-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-136-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-117-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-119-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-137-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-147-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/2264-120-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-138-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-121-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-139-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-145-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2264-122-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-123-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-141-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-153-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-142-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-148-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-129-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-126-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-144-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-152-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-151-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-150-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-149-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-140-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-127-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-128-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-146-0x0000000077DC0000-0x0000000077F4E000-memory.dmpFilesize
1.6MB
-
memory/2264-143-0x0000000000490000-0x000000000053E000-memory.dmpFilesize
696KB
-
memory/2276-180-0x0000000000000000-mapping.dmp
-
memory/2276-317-0x0000000000000000-mapping.dmp
-
memory/2324-162-0x0000000000000000-mapping.dmp
-
memory/2336-198-0x0000000000000000-mapping.dmp
-
memory/2384-241-0x0000000000000000-mapping.dmp
-
memory/2400-163-0x0000000000000000-mapping.dmp
-
memory/2488-154-0x0000000000430000-0x0000000000446000-memory.dmpFilesize
88KB
-
memory/2488-157-0x0000000002510000-0x000000000251F000-memory.dmpFilesize
60KB
-
memory/2564-194-0x0000000000000000-mapping.dmp
-
memory/2636-166-0x0000000000000000-mapping.dmp
-
memory/2636-192-0x0000000000000000-mapping.dmp
-
memory/2744-183-0x0000000000000000-mapping.dmp
-
memory/2776-379-0x0000000000000000-mapping.dmp
-
memory/2840-188-0x0000000000000000-mapping.dmp
-
memory/2904-177-0x0000000000000000-mapping.dmp
-
memory/3200-376-0x0000000000000000-mapping.dmp
-
memory/3208-160-0x0000000000000000-mapping.dmp
-
memory/3220-171-0x0000000000000000-mapping.dmp
-
memory/3328-174-0x0000000000000000-mapping.dmp
-
memory/3476-268-0x0000000000000000-mapping.dmp
-
memory/3524-187-0x0000000000000000-mapping.dmp
-
memory/3540-197-0x0000000000000000-mapping.dmp
-
memory/3616-161-0x0000000000000000-mapping.dmp
-
memory/3688-190-0x0000000000000000-mapping.dmp
-
memory/3700-191-0x0000000000000000-mapping.dmp
-
memory/3808-195-0x0000000000000000-mapping.dmp
-
memory/3872-168-0x0000000000000000-mapping.dmp
-
memory/3924-196-0x0000000000000000-mapping.dmp
-
memory/3924-443-0x0000000000000000-mapping.dmp
-
memory/4072-184-0x0000000000000000-mapping.dmp
-
memory/4080-175-0x0000000000000000-mapping.dmp