Analysis
-
max time kernel
151s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2023 20:05
Static task
static1
General
-
Target
f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe
-
Size
785KB
-
MD5
918c87a85868eb2c39587ab9174584c4
-
SHA1
ba4369a6495d18ca4159654781a74e3130a15539
-
SHA256
f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535
-
SHA512
81390cb8006b277c4fdc47b900056ad4ef420f070797265f57af5b83a8266adc5e908775198de679b02231c84fb473d691407ff6d144be2ff8c85ba8c362df98
-
SSDEEP
12288:pMrey90MaVeMRxEWcjKMScWQe5QNIV+uFKsiClZSsJXgtzEZ+6K34yBM0G/J:zyscM7r6KMlEQGwuFOyZZmBg1+tM
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it210038.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it210038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it210038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it210038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it210038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it210038.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it210038.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2624-164-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-165-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-167-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-169-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-171-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-173-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-175-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-179-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-177-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-181-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-183-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-185-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-187-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-189-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-191-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-193-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-195-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-197-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-199-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-201-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-203-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-205-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-207-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-209-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-211-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-213-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-215-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-217-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-219-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-221-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-223-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-225-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline behavioral1/memory/2624-227-0x0000000002570000-0x00000000025AF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr064905.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr064905.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
Processes:
ziWS5276.exeziJI5618.exeit210038.exejr430068.exekp898942.exelr064905.exeoneetx.exeoneetx.exeoneetx.exepid process 4912 ziWS5276.exe 4200 ziJI5618.exe 1764 it210038.exe 2624 jr430068.exe 3176 kp898942.exe 1232 lr064905.exe 3740 oneetx.exe 2624 oneetx.exe 5056 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4356 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it210038.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it210038.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exeziWS5276.exeziJI5618.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziWS5276.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziWS5276.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziJI5618.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziJI5618.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4292 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1652 2624 WerFault.exe jr430068.exe 1756 1232 WerFault.exe lr064905.exe 4308 1232 WerFault.exe lr064905.exe 2264 1232 WerFault.exe lr064905.exe 1780 1232 WerFault.exe lr064905.exe 924 1232 WerFault.exe lr064905.exe 4320 1232 WerFault.exe lr064905.exe 728 1232 WerFault.exe lr064905.exe 3184 1232 WerFault.exe lr064905.exe 1912 1232 WerFault.exe lr064905.exe 1368 1232 WerFault.exe lr064905.exe 1784 3740 WerFault.exe oneetx.exe 1096 3740 WerFault.exe oneetx.exe 1092 3740 WerFault.exe oneetx.exe 4236 3740 WerFault.exe oneetx.exe 4072 3740 WerFault.exe oneetx.exe 436 3740 WerFault.exe oneetx.exe 4592 3740 WerFault.exe oneetx.exe 4284 3740 WerFault.exe oneetx.exe 540 3740 WerFault.exe oneetx.exe 1560 3740 WerFault.exe oneetx.exe 1144 3740 WerFault.exe oneetx.exe 604 2624 WerFault.exe oneetx.exe 3500 3740 WerFault.exe oneetx.exe 4652 3740 WerFault.exe oneetx.exe 4688 3740 WerFault.exe oneetx.exe 3716 5056 WerFault.exe oneetx.exe 4684 3740 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it210038.exejr430068.exekp898942.exepid process 1764 it210038.exe 1764 it210038.exe 2624 jr430068.exe 2624 jr430068.exe 3176 kp898942.exe 3176 kp898942.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it210038.exejr430068.exekp898942.exedescription pid process Token: SeDebugPrivilege 1764 it210038.exe Token: SeDebugPrivilege 2624 jr430068.exe Token: SeDebugPrivilege 3176 kp898942.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr064905.exepid process 1232 lr064905.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exeziWS5276.exeziJI5618.exelr064905.exeoneetx.exedescription pid process target process PID 2184 wrote to memory of 4912 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe ziWS5276.exe PID 2184 wrote to memory of 4912 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe ziWS5276.exe PID 2184 wrote to memory of 4912 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe ziWS5276.exe PID 4912 wrote to memory of 4200 4912 ziWS5276.exe ziJI5618.exe PID 4912 wrote to memory of 4200 4912 ziWS5276.exe ziJI5618.exe PID 4912 wrote to memory of 4200 4912 ziWS5276.exe ziJI5618.exe PID 4200 wrote to memory of 1764 4200 ziJI5618.exe it210038.exe PID 4200 wrote to memory of 1764 4200 ziJI5618.exe it210038.exe PID 4200 wrote to memory of 2624 4200 ziJI5618.exe jr430068.exe PID 4200 wrote to memory of 2624 4200 ziJI5618.exe jr430068.exe PID 4200 wrote to memory of 2624 4200 ziJI5618.exe jr430068.exe PID 4912 wrote to memory of 3176 4912 ziWS5276.exe kp898942.exe PID 4912 wrote to memory of 3176 4912 ziWS5276.exe kp898942.exe PID 4912 wrote to memory of 3176 4912 ziWS5276.exe kp898942.exe PID 2184 wrote to memory of 1232 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe lr064905.exe PID 2184 wrote to memory of 1232 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe lr064905.exe PID 2184 wrote to memory of 1232 2184 f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe lr064905.exe PID 1232 wrote to memory of 3740 1232 lr064905.exe oneetx.exe PID 1232 wrote to memory of 3740 1232 lr064905.exe oneetx.exe PID 1232 wrote to memory of 3740 1232 lr064905.exe oneetx.exe PID 3740 wrote to memory of 892 3740 oneetx.exe schtasks.exe PID 3740 wrote to memory of 892 3740 oneetx.exe schtasks.exe PID 3740 wrote to memory of 892 3740 oneetx.exe schtasks.exe PID 3740 wrote to memory of 4356 3740 oneetx.exe rundll32.exe PID 3740 wrote to memory of 4356 3740 oneetx.exe rundll32.exe PID 3740 wrote to memory of 4356 3740 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe"C:\Users\Admin\AppData\Local\Temp\f1bd8adf992a0cf5ff184f3e80830186cf1e9315516c9d518e170f1c50509535.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWS5276.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWS5276.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJI5618.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJI5618.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it210038.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it210038.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr430068.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr430068.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 13525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp898942.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp898942.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr064905.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr064905.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 12163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 10884⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 16164⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 16604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 16324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 13563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1232 -ip 12321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3740 -ip 37401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2624 -ip 26241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3740 -ip 37401⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 3282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3740 -ip 37401⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr064905.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr064905.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWS5276.exeFilesize
522KB
MD5689d9ff1f8d919d53fb74265459dcf67
SHA1edf0eabf77be2ecfdd197c394701f13bc481c13b
SHA256a17fa637431557db132b15926414a423fe8ee08cac55306ffb0fbe1481ed6504
SHA51250261c037c2ea11d657717ec6340b6443d6c7cbb8740af6565502b11ee9a013b908df015c00e385cd914a26244fc7e83f29744306b41c14a1fefbd0e444e37ab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWS5276.exeFilesize
522KB
MD5689d9ff1f8d919d53fb74265459dcf67
SHA1edf0eabf77be2ecfdd197c394701f13bc481c13b
SHA256a17fa637431557db132b15926414a423fe8ee08cac55306ffb0fbe1481ed6504
SHA51250261c037c2ea11d657717ec6340b6443d6c7cbb8740af6565502b11ee9a013b908df015c00e385cd914a26244fc7e83f29744306b41c14a1fefbd0e444e37ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp898942.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp898942.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJI5618.exeFilesize
379KB
MD51d8560031ca55677feab3f65e278866f
SHA1064806eaee3c6c4309e6b5416195aaff3906adc2
SHA256516f278d9884612a18ef03a5abbba8aa7ba6a69a381b2130c73c41ef91107a74
SHA5127d0dccae373219ce736485ff63fed992c998568963ffb4e42cac4b6e669c8abf0594446d3acec3e672250b39bd46be5a0bc14cbc70e68b6e8d382b42d2cd2162
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJI5618.exeFilesize
379KB
MD51d8560031ca55677feab3f65e278866f
SHA1064806eaee3c6c4309e6b5416195aaff3906adc2
SHA256516f278d9884612a18ef03a5abbba8aa7ba6a69a381b2130c73c41ef91107a74
SHA5127d0dccae373219ce736485ff63fed992c998568963ffb4e42cac4b6e669c8abf0594446d3acec3e672250b39bd46be5a0bc14cbc70e68b6e8d382b42d2cd2162
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it210038.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it210038.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr430068.exeFilesize
292KB
MD55739815eca23c600ff9adfb82b7e2b1c
SHA11914cca31c49241050b2194ce91de6f5f4f83eea
SHA2561056ccf0869632a8d8104265620e202083b8e0aefd473aac3ed7609e048b061f
SHA5127cdd22525dac2826206ebf3059f128ab0be0133477d75a8093de66a68648ef5d00eb19af52f3db5b12c1fe32ac6e051b5cf8f4d764dbf9d011ce9ce6350c0fbb
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr430068.exeFilesize
292KB
MD55739815eca23c600ff9adfb82b7e2b1c
SHA11914cca31c49241050b2194ce91de6f5f4f83eea
SHA2561056ccf0869632a8d8104265620e202083b8e0aefd473aac3ed7609e048b061f
SHA5127cdd22525dac2826206ebf3059f128ab0be0133477d75a8093de66a68648ef5d00eb19af52f3db5b12c1fe32ac6e051b5cf8f4d764dbf9d011ce9ce6350c0fbb
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1232-1099-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/1764-154-0x0000000000B40000-0x0000000000B4A000-memory.dmpFilesize
40KB
-
memory/2624-205-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-1070-0x0000000005160000-0x0000000005778000-memory.dmpFilesize
6.1MB
-
memory/2624-177-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-181-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-183-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-185-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-187-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-189-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-191-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-193-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-195-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-197-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-199-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-201-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-203-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-175-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-207-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-209-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-211-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-213-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-215-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-217-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-219-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-221-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-223-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-225-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-227-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-179-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-1071-0x0000000005780000-0x000000000588A000-memory.dmpFilesize
1.0MB
-
memory/2624-1072-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/2624-1073-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-1074-0x0000000005900000-0x000000000593C000-memory.dmpFilesize
240KB
-
memory/2624-1076-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-1077-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-1078-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-1079-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/2624-1080-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/2624-1081-0x0000000006480000-0x0000000006642000-memory.dmpFilesize
1.8MB
-
memory/2624-1082-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/2624-1083-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/2624-1084-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/2624-1085-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-160-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/2624-173-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-171-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-169-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-167-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-165-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-164-0x0000000002570000-0x00000000025AF000-memory.dmpFilesize
252KB
-
memory/2624-163-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-162-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/2624-161-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/3176-1091-0x0000000000BD0000-0x0000000000C02000-memory.dmpFilesize
200KB
-
memory/3176-1092-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3176-1093-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB