Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
29/10/2022, 18:40
General
- Target file.exe
- Size 260KB
- Sample221029-xa7bcabaaq
- SHA256 d92f82ff8ebf9780a7bd476a536efb734f4b045a52bfc36bc9d124b9aa5ec597
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 6 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 64 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 40 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 48 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F.exeC:\Users\Admin\AppData\Local\Temp\1F.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 6362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 8962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 9682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 11082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 11162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 11482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 11682⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 6003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 9963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 10003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 9963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 9963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 11243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 11443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 11283⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 6004⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 9964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 10044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 10044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 9964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 10924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 11324⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 10804⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 6005⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 9965⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10005⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 10085⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11285⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11485⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 11565⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 6006⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 9966⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 10046⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 10046⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11126⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11406⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 10006⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 6007⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 9967⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 10047⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 10687⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 10767⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 10807⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 9967⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 6008⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 9608⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 9688⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 9688⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 10808⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 9728⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 11408⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 11488⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1F.exe"C:\Users\Admin\AppData\Local\Temp\1F.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 4729⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 9969⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10049⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10049⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start8⤵
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 10048⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 11568⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start7⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 9847⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 11327⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start6⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 9846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11646⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start5⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 9845⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 8765⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140705⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 9844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 11484⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 9843⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 11323⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 10522⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 12322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4048 -ip 40481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1040 -ip 10401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1304 -ip 13041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4540 -ip 45401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3092 -ip 30921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3424 -ip 34241⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3424 -ip 34241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
1F.exe
1F.exe
1F.exe
1F.exe
1F.exe
1F.exe
1F.exe
1F.exe
1F.exe
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Dydhshsoe.dll
Seeesisuoeiaqit.tmp
dd_vcredistUI7626.txt
wct4ED3.tmp
memory/624-172-0x0000000003A57000-0x0000000004041000-memory.dmp
memory/624-171-0x0000000000400000-0x0000000003204000-memory.dmp
memory/624-186-0x0000000000400000-0x0000000003204000-memory.dmp
memory/760-170-0x0000000000400000-0x0000000003204000-memory.dmp
memory/760-194-0x0000000000400000-0x0000000003204000-memory.dmp
memory/760-166-0x000000000379C000-0x0000000003D86000-memory.dmp
memory/760-167-0x0000000000400000-0x0000000003204000-memory.dmp
memory/1040-188-0x0000000000400000-0x0000000003204000-memory.dmp
memory/1040-187-0x00000000036C6000-0x0000000003CB0000-memory.dmp
memory/1040-228-0x0000000000400000-0x0000000003204000-memory.dmp
memory/1304-230-0x0000000003755000-0x0000000003D3F000-memory.dmp
memory/1304-231-0x0000000000400000-0x0000000003204000-memory.dmp
memory/1304-244-0x0000000000400000-0x0000000003204000-memory.dmp
memory/1384-262-0x0000000002F80000-0x0000000003ADF000-memory.dmp
memory/1384-260-0x0000000002F80000-0x0000000003ADF000-memory.dmp
memory/1384-272-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-264-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-263-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-277-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-183-0x0000000002100000-0x000000000244D000-memory.dmp
memory/1384-273-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-271-0x0000000003BA0000-0x0000000003CE0000-memory.dmp
memory/1384-184-0x0000000002100000-0x000000000244D000-memory.dmp
memory/1384-259-0x0000000002F80000-0x0000000003ADF000-memory.dmp
memory/1384-218-0x0000000002100000-0x000000000244D000-memory.dmp
memory/1472-252-0x0000000002590000-0x00000000028DD000-memory.dmp
memory/1472-254-0x0000000002590000-0x00000000028DD000-memory.dmp
memory/1472-261-0x0000000002590000-0x00000000028DD000-memory.dmp
memory/2056-208-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-146-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-136-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-193-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-195-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-196-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-197-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-198-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-200-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-202-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-201-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/2056-206-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-204-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-137-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-210-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-209-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-211-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-213-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-215-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-214-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-216-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-217-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-138-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-219-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-220-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-139-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-140-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-141-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-142-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-143-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-144-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-145-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-163-0x0000000007C20000-0x0000000007C30000-memory.dmp
memory/2056-192-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-162-0x0000000007C20000-0x0000000007C30000-memory.dmp
memory/2056-147-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-232-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/2056-233-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-234-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-235-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/2056-148-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-149-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-150-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-151-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-152-0x0000000007BF0000-0x0000000007C00000-memory.dmp
memory/2056-153-0x0000000007C00000-0x0000000007C10000-memory.dmp
memory/2056-154-0x0000000007C20000-0x0000000007C30000-memory.dmp
memory/2056-155-0x0000000007C20000-0x0000000007C30000-memory.dmp
memory/2448-185-0x0000000000400000-0x000000000074D000-memory.dmp
memory/2448-176-0x0000000000400000-0x000000000074D000-memory.dmp
memory/3092-258-0x0000000000400000-0x0000000003204000-memory.dmp
memory/3092-257-0x0000000005520000-0x0000000005B40000-memory.dmp
memory/3092-256-0x000000000378C000-0x0000000003D76000-memory.dmp
memory/4048-160-0x0000000005500000-0x0000000005B20000-memory.dmp
memory/4048-159-0x00000000038F7000-0x0000000003EE1000-memory.dmp
memory/4048-177-0x0000000000400000-0x0000000003204000-memory.dmp
memory/4048-161-0x0000000000400000-0x0000000003204000-memory.dmp
memory/4060-279-0x0000029DBB340000-0x0000029DBB480000-memory.dmp
memory/4060-280-0x0000029DBB340000-0x0000029DBB480000-memory.dmp
memory/4060-282-0x00000000005B0000-0x0000000000858000-memory.dmp
memory/4060-283-0x0000029DB9A70000-0x0000029DB9D29000-memory.dmp
memory/4336-226-0x0000000002490000-0x00000000027DD000-memory.dmp
memory/4336-227-0x0000000002490000-0x00000000027DD000-memory.dmp
memory/4336-236-0x0000000002490000-0x00000000027DD000-memory.dmp
memory/4528-281-0x0000000002100000-0x000000000244D000-memory.dmp
memory/4528-284-0x0000000002A70000-0x00000000035CF000-memory.dmp
memory/4528-286-0x0000000002A70000-0x00000000035CF000-memory.dmp
memory/4540-255-0x0000000000400000-0x0000000003204000-memory.dmp
memory/4540-246-0x0000000000400000-0x0000000003204000-memory.dmp
memory/4540-245-0x000000000372C000-0x0000000003D16000-memory.dmp
memory/4876-191-0x0000000000400000-0x000000000074D000-memory.dmp
memory/4876-229-0x0000000000400000-0x000000000074D000-memory.dmp
memory/4904-132-0x0000000002DC7000-0x0000000002DDD000-memory.dmp
memory/4904-133-0x0000000002D90000-0x0000000002D99000-memory.dmp
memory/4904-134-0x0000000000400000-0x0000000002C2F000-memory.dmp
memory/4904-135-0x0000000000400000-0x0000000002C2F000-memory.dmp
memory/4936-253-0x0000000002490000-0x00000000027DD000-memory.dmp
memory/4936-243-0x0000000002490000-0x00000000027DD000-memory.dmp