Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:43
Static task
static1
General
-
Target
0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe
-
Size
790KB
-
MD5
f67eb222efd9c6736785c0a7a624226c
-
SHA1
1c46a993f57b34ae46059c965def3a779a268fef
-
SHA256
0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471
-
SHA512
3b58539c103dc5e5ed0d30729b1ca17c8989503ecef6f5763fc093a1a316493a0dbb81c2ac6df5b72967859c7bbe3e7a30b2335e377e70c3bf04203ecfc22f3f
-
SSDEEP
12288:NMroy90cJhfV2ue2TwQ1/yc2xK7CZEKMOIntnLOMzrua1OUguT8IxG:FyzJ8swQFyfxfZiFKipOQT8EG
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
it429605.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it429605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it429605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it429605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it429605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it429605.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it429605.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-162-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-165-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-163-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-172-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-168-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-174-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-176-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-178-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-180-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-182-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-184-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-186-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-188-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-190-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-192-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-194-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-196-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-198-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-200-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-202-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-204-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-206-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-208-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-210-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-212-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-214-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-216-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-218-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-220-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-222-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-224-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-226-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-228-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1956-1079-0x0000000004BA0000-0x0000000004BB0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lr384493.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr384493.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
Processes:
zisJ2768.exezilO5272.exeit429605.exejr195356.exekp571801.exelr384493.exeoneetx.exeoneetx.exepid process 2104 zisJ2768.exe 2768 zilO5272.exe 4464 it429605.exe 1956 jr195356.exe 2672 kp571801.exe 5056 lr384493.exe 2744 oneetx.exe 756 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3820 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
it429605.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it429605.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exezisJ2768.exezilO5272.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zisJ2768.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zisJ2768.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zilO5272.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zilO5272.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4172 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3756 1956 WerFault.exe jr195356.exe 4448 5056 WerFault.exe lr384493.exe 1220 5056 WerFault.exe lr384493.exe 1516 5056 WerFault.exe lr384493.exe 3828 5056 WerFault.exe lr384493.exe 4116 5056 WerFault.exe lr384493.exe 3064 5056 WerFault.exe lr384493.exe 4836 5056 WerFault.exe lr384493.exe 372 5056 WerFault.exe lr384493.exe 4420 5056 WerFault.exe lr384493.exe 3744 5056 WerFault.exe lr384493.exe 3104 2744 WerFault.exe oneetx.exe 3456 2744 WerFault.exe oneetx.exe 3080 2744 WerFault.exe oneetx.exe 836 2744 WerFault.exe oneetx.exe 4408 2744 WerFault.exe oneetx.exe 4208 2744 WerFault.exe oneetx.exe 3784 2744 WerFault.exe oneetx.exe 4476 2744 WerFault.exe oneetx.exe 4592 2744 WerFault.exe oneetx.exe 1648 2744 WerFault.exe oneetx.exe 3396 2744 WerFault.exe oneetx.exe 1144 2744 WerFault.exe oneetx.exe 3284 2744 WerFault.exe oneetx.exe 2832 2744 WerFault.exe oneetx.exe 1620 756 WerFault.exe oneetx.exe 2804 2744 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
it429605.exejr195356.exekp571801.exepid process 4464 it429605.exe 4464 it429605.exe 1956 jr195356.exe 1956 jr195356.exe 2672 kp571801.exe 2672 kp571801.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
it429605.exejr195356.exekp571801.exedescription pid process Token: SeDebugPrivilege 4464 it429605.exe Token: SeDebugPrivilege 1956 jr195356.exe Token: SeDebugPrivilege 2672 kp571801.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
lr384493.exepid process 5056 lr384493.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exezisJ2768.exezilO5272.exelr384493.exeoneetx.exedescription pid process target process PID 1684 wrote to memory of 2104 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe zisJ2768.exe PID 1684 wrote to memory of 2104 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe zisJ2768.exe PID 1684 wrote to memory of 2104 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe zisJ2768.exe PID 2104 wrote to memory of 2768 2104 zisJ2768.exe zilO5272.exe PID 2104 wrote to memory of 2768 2104 zisJ2768.exe zilO5272.exe PID 2104 wrote to memory of 2768 2104 zisJ2768.exe zilO5272.exe PID 2768 wrote to memory of 4464 2768 zilO5272.exe it429605.exe PID 2768 wrote to memory of 4464 2768 zilO5272.exe it429605.exe PID 2768 wrote to memory of 1956 2768 zilO5272.exe jr195356.exe PID 2768 wrote to memory of 1956 2768 zilO5272.exe jr195356.exe PID 2768 wrote to memory of 1956 2768 zilO5272.exe jr195356.exe PID 2104 wrote to memory of 2672 2104 zisJ2768.exe kp571801.exe PID 2104 wrote to memory of 2672 2104 zisJ2768.exe kp571801.exe PID 2104 wrote to memory of 2672 2104 zisJ2768.exe kp571801.exe PID 1684 wrote to memory of 5056 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe lr384493.exe PID 1684 wrote to memory of 5056 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe lr384493.exe PID 1684 wrote to memory of 5056 1684 0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe lr384493.exe PID 5056 wrote to memory of 2744 5056 lr384493.exe oneetx.exe PID 5056 wrote to memory of 2744 5056 lr384493.exe oneetx.exe PID 5056 wrote to memory of 2744 5056 lr384493.exe oneetx.exe PID 2744 wrote to memory of 732 2744 oneetx.exe schtasks.exe PID 2744 wrote to memory of 732 2744 oneetx.exe schtasks.exe PID 2744 wrote to memory of 732 2744 oneetx.exe schtasks.exe PID 2744 wrote to memory of 3820 2744 oneetx.exe rundll32.exe PID 2744 wrote to memory of 3820 2744 oneetx.exe rundll32.exe PID 2744 wrote to memory of 3820 2744 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe"C:\Users\Admin\AppData\Local\Temp\0b30996c2c79256f29eddd65fbdff0d1c13065d935afadac630c68dbbd1b9471.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisJ2768.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisJ2768.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zilO5272.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zilO5272.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it429605.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it429605.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr195356.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr195356.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 13445⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp571801.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp571801.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr384493.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr384493.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 9603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 8123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 9483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 12123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 12483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 13163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 6924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 8644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 10524⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 13004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 13204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 11364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 15844⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 16004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 11044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 17323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1956 -ip 19561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5056 -ip 50561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2744 -ip 27441⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 756 -ip 7561⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2744 -ip 27441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr384493.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr384493.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisJ2768.exeFilesize
524KB
MD5fe835e4da5e909c6bf76ed08b8f78c66
SHA13557e445b48d57f995d50bb9a4408c140624a2dd
SHA256943492ead3758a568f2dcc1cb4cbe714c0495f148f77ce969b80f3e3a4368f69
SHA5128babbdefb4e8e806958dcb63d087de22b21c7fd33e9c616bbb8896d364097641ff851526919017deef326989e7791df14bb6891332e33ab2d1b0e8bfddc8157b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zisJ2768.exeFilesize
524KB
MD5fe835e4da5e909c6bf76ed08b8f78c66
SHA13557e445b48d57f995d50bb9a4408c140624a2dd
SHA256943492ead3758a568f2dcc1cb4cbe714c0495f148f77ce969b80f3e3a4368f69
SHA5128babbdefb4e8e806958dcb63d087de22b21c7fd33e9c616bbb8896d364097641ff851526919017deef326989e7791df14bb6891332e33ab2d1b0e8bfddc8157b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp571801.exeFilesize
176KB
MD5e6c56bc97cb0068046ffd52c1432f620
SHA1363645af2739529dd46976b75b9eb592ef978cb6
SHA256d0bf1c6090d3a06cdcd2636eaa9bf725e3d74052895aa8b9f1a8bc5b7b87856c
SHA512d5eaf233517b85f8f0c3d406b6b06bccc7c615c8c2512d422663a6d93fc6908927a9bdcab92cca05194087b68653d04d33b6d2bcea76b97e6e8212d9506b8773
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp571801.exeFilesize
176KB
MD5e6c56bc97cb0068046ffd52c1432f620
SHA1363645af2739529dd46976b75b9eb592ef978cb6
SHA256d0bf1c6090d3a06cdcd2636eaa9bf725e3d74052895aa8b9f1a8bc5b7b87856c
SHA512d5eaf233517b85f8f0c3d406b6b06bccc7c615c8c2512d422663a6d93fc6908927a9bdcab92cca05194087b68653d04d33b6d2bcea76b97e6e8212d9506b8773
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zilO5272.exeFilesize
382KB
MD5f6c38a843246254912fc6a44427b8d37
SHA1049200eef76053a0a9268e1cef434c15512ebb7b
SHA2562cde6468936629829da2dd2df8c6dc26b674501a9901805ab07356ffbb926fed
SHA5120182a11d4c0fe18a2f08f7e9bac3b5ad0f9e77c382fbd83d9e531cb7134f04472bb33d22e2c21299603a84590d4b4cce0afe030d4372429044ee36af6f7b791d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zilO5272.exeFilesize
382KB
MD5f6c38a843246254912fc6a44427b8d37
SHA1049200eef76053a0a9268e1cef434c15512ebb7b
SHA2562cde6468936629829da2dd2df8c6dc26b674501a9901805ab07356ffbb926fed
SHA5120182a11d4c0fe18a2f08f7e9bac3b5ad0f9e77c382fbd83d9e531cb7134f04472bb33d22e2c21299603a84590d4b4cce0afe030d4372429044ee36af6f7b791d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it429605.exeFilesize
11KB
MD55bf6bc3d5a8523694995b75a9a2f132f
SHA1ad56cb421bc1e1fb54f6328d79a3c8fab167d72d
SHA2561750c0ac6b1ac15d6764a920221efd05b1d5272ebb3ade0ce327142bc9097db2
SHA51241e33b009a5ab6bce5ebe4d2f28190debe59b8728ba7384a5e42f40b5594a9ee270f19f91856ba915ce3d84735bb2de96f1c888076798be6e9b7c485e5b7a302
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it429605.exeFilesize
11KB
MD55bf6bc3d5a8523694995b75a9a2f132f
SHA1ad56cb421bc1e1fb54f6328d79a3c8fab167d72d
SHA2561750c0ac6b1ac15d6764a920221efd05b1d5272ebb3ade0ce327142bc9097db2
SHA51241e33b009a5ab6bce5ebe4d2f28190debe59b8728ba7384a5e42f40b5594a9ee270f19f91856ba915ce3d84735bb2de96f1c888076798be6e9b7c485e5b7a302
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr195356.exeFilesize
297KB
MD5ea8e47c6648dd63cd1f9aa3cf4285587
SHA1a2913290405dc89c079da1ab8de6f691d2f785a8
SHA256629ae7eebe8e45aa560c2438bde7a702ca739b64595a6b4ec1fcc40e940fae61
SHA51253020ce0d4578062d71d4c18944c1ff7b2313f381d360f81e04fda6b7c596430223f5f6928d2e73771aee2fd20f45367d43db5870f1b822b760fb57999a14ebc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr195356.exeFilesize
297KB
MD5ea8e47c6648dd63cd1f9aa3cf4285587
SHA1a2913290405dc89c079da1ab8de6f691d2f785a8
SHA256629ae7eebe8e45aa560c2438bde7a702ca739b64595a6b4ec1fcc40e940fae61
SHA51253020ce0d4578062d71d4c18944c1ff7b2313f381d360f81e04fda6b7c596430223f5f6928d2e73771aee2fd20f45367d43db5870f1b822b760fb57999a14ebc
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1956-210-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-1072-0x0000000005780000-0x000000000588A000-memory.dmpFilesize
1.0MB
-
memory/1956-178-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-180-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-182-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-184-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-186-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-188-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-190-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-192-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-194-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-196-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-198-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-200-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-202-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-204-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-206-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-208-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-174-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-212-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-214-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-216-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-218-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-220-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-222-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-224-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-226-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-228-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-1071-0x0000000005160000-0x0000000005778000-memory.dmpFilesize
6.1MB
-
memory/1956-176-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-1074-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-1073-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1956-1075-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1956-1077-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-1078-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-1079-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-1080-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/1956-1081-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/1956-1082-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/1956-1083-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/1956-1084-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-1085-0x0000000006DE0000-0x0000000006E56000-memory.dmpFilesize
472KB
-
memory/1956-1086-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/1956-160-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/1956-161-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/1956-168-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-171-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-162-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-165-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-172-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1956-169-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-167-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/1956-163-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/2672-1093-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/2672-1092-0x0000000000B70000-0x0000000000BA2000-memory.dmpFilesize
200KB
-
memory/4464-154-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/5056-1115-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/5056-1099-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB