Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 02:03
Static task
static1
General
-
Target
585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe
-
Size
1.0MB
-
MD5
54e907e4565a0cc6f9ad53c949aa5022
-
SHA1
e33418430d809df404d2b6c7902ab868857cf752
-
SHA256
585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8
-
SHA512
ca6fd623ceb7de0545cc98c2004cd227edde5f543726947a7eb9c3ea4c37bc179d0c518d3051b6e4bba179b642abca3b2eb0c87a1dabb26527cbda28eb55e952
-
SSDEEP
12288:wMrJy90wArshk2nkOBWbFu2jx4ue1xJUxQc8dVb47idS+ltjdFo+iIZd1oveBmwG:pymrsfa8rUxQcYV8idzj4GZMv1zSk5
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nord
176.113.115.145:4125
-
auth_value
ebb7d38cdbd7c83cf6363ef3feb3a530
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor1495.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az019425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az019425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az019425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az019425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az019425.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az019425.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor1495.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
resource yara_rule behavioral1/memory/2764-230-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-231-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-233-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-235-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-237-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-239-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-241-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-243-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-245-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-247-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-249-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-251-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-253-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-255-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-257-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-259-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-261-0x0000000004BE0000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2764-1151-0x0000000004D00000-0x0000000004D10000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation bu366086.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
pid Process 1944 kina4703.exe 1212 kina0284.exe 2008 kina6396.exe 2304 az019425.exe 4524 bu366086.exe 4760 oneetx.exe 844 cor1495.exe 2764 dGM32s50.exe 3348 ge479058.exe 3684 oneetx.exe 2796 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4564 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor1495.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az019425.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina6396.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina4703.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina4703.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0284.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina0284.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina6396.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 2100 4524 WerFault.exe 91 3220 4524 WerFault.exe 91 1324 4524 WerFault.exe 91 3028 4524 WerFault.exe 91 920 4524 WerFault.exe 91 4460 4524 WerFault.exe 91 4468 4524 WerFault.exe 91 3528 4524 WerFault.exe 91 4072 4524 WerFault.exe 91 3668 4524 WerFault.exe 91 5012 4760 WerFault.exe 113 4368 4760 WerFault.exe 113 2016 4760 WerFault.exe 113 4736 4760 WerFault.exe 113 1552 4760 WerFault.exe 113 2784 4760 WerFault.exe 113 3732 4760 WerFault.exe 113 2452 4760 WerFault.exe 113 1728 4760 WerFault.exe 113 4956 4760 WerFault.exe 113 2100 4760 WerFault.exe 113 4512 844 WerFault.exe 118 4996 2764 WerFault.exe 144 3628 4760 WerFault.exe 113 4248 3684 WerFault.exe 150 4336 4760 WerFault.exe 113 1000 4760 WerFault.exe 113 2308 4760 WerFault.exe 113 4172 2796 WerFault.exe 160 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2304 az019425.exe 2304 az019425.exe 844 cor1495.exe 844 cor1495.exe 2764 dGM32s50.exe 2764 dGM32s50.exe 3348 ge479058.exe 3348 ge479058.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2304 az019425.exe Token: SeDebugPrivilege 844 cor1495.exe Token: SeDebugPrivilege 2764 dGM32s50.exe Token: SeDebugPrivilege 3348 ge479058.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4524 bu366086.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4924 wrote to memory of 1944 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 83 PID 4924 wrote to memory of 1944 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 83 PID 4924 wrote to memory of 1944 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 83 PID 1944 wrote to memory of 1212 1944 kina4703.exe 84 PID 1944 wrote to memory of 1212 1944 kina4703.exe 84 PID 1944 wrote to memory of 1212 1944 kina4703.exe 84 PID 1212 wrote to memory of 2008 1212 kina0284.exe 85 PID 1212 wrote to memory of 2008 1212 kina0284.exe 85 PID 1212 wrote to memory of 2008 1212 kina0284.exe 85 PID 2008 wrote to memory of 2304 2008 kina6396.exe 86 PID 2008 wrote to memory of 2304 2008 kina6396.exe 86 PID 2008 wrote to memory of 4524 2008 kina6396.exe 91 PID 2008 wrote to memory of 4524 2008 kina6396.exe 91 PID 2008 wrote to memory of 4524 2008 kina6396.exe 91 PID 4524 wrote to memory of 4760 4524 bu366086.exe 113 PID 4524 wrote to memory of 4760 4524 bu366086.exe 113 PID 4524 wrote to memory of 4760 4524 bu366086.exe 113 PID 1212 wrote to memory of 844 1212 kina0284.exe 118 PID 1212 wrote to memory of 844 1212 kina0284.exe 118 PID 1212 wrote to memory of 844 1212 kina0284.exe 118 PID 4760 wrote to memory of 924 4760 oneetx.exe 131 PID 4760 wrote to memory of 924 4760 oneetx.exe 131 PID 4760 wrote to memory of 924 4760 oneetx.exe 131 PID 1944 wrote to memory of 2764 1944 kina4703.exe 144 PID 1944 wrote to memory of 2764 1944 kina4703.exe 144 PID 1944 wrote to memory of 2764 1944 kina4703.exe 144 PID 4924 wrote to memory of 3348 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 147 PID 4924 wrote to memory of 3348 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 147 PID 4924 wrote to memory of 3348 4924 585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe 147 PID 4760 wrote to memory of 4564 4760 oneetx.exe 155 PID 4760 wrote to memory of 4564 4760 oneetx.exe 155 PID 4760 wrote to memory of 4564 4760 oneetx.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe"C:\Users\Admin\AppData\Local\Temp\585979355c14f5ba11c93852099b0a921196eb09335fa385c22baeb9588947d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4703.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4703.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0284.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0284.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6396.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6396.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az019425.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az019425.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu366086.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu366086.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 6966⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 7806⤵
- Program crash
PID:3220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8566⤵
- Program crash
PID:1324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 9446⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 9566⤵
- Program crash
PID:920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 9566⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 12206⤵
- Program crash
PID:4468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 12086⤵
- Program crash
PID:3528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 13206⤵
- Program crash
PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 6927⤵
- Program crash
PID:5012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 8487⤵
- Program crash
PID:4368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 8927⤵
- Program crash
PID:2016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 10527⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 10727⤵
- Program crash
PID:1552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 10727⤵
- Program crash
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 11087⤵
- Program crash
PID:3732
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 9967⤵
- Program crash
PID:2452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 7447⤵
- Program crash
PID:1728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 7767⤵
- Program crash
PID:4956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 9287⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 11527⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 11607⤵
- Program crash
PID:4336
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 15927⤵
- Program crash
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 11527⤵
- Program crash
PID:2308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 7526⤵
- Program crash
PID:3668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1495.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1495.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 10805⤵
- Program crash
PID:4512
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dGM32s50.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dGM32s50.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 16764⤵
- Program crash
PID:4996
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge479058.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ge479058.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4524 -ip 45241⤵PID:2796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4524 -ip 45241⤵PID:4188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4524 -ip 45241⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4524 -ip 45241⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4524 -ip 45241⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4524 -ip 45241⤵PID:1140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4524 -ip 45241⤵PID:436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4524 -ip 45241⤵PID:4852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4524 -ip 45241⤵PID:432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4524 -ip 45241⤵PID:4300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4760 -ip 47601⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4760 -ip 47601⤵PID:2280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4760 -ip 47601⤵PID:64
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4760 -ip 47601⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4760 -ip 47601⤵PID:1540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4760 -ip 47601⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4760 -ip 47601⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4760 -ip 47601⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4760 -ip 47601⤵PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4760 -ip 47601⤵PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4760 -ip 47601⤵PID:4172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 844 -ip 8441⤵PID:736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2764 -ip 27641⤵PID:5104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4760 -ip 47601⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 3162⤵
- Program crash
PID:4248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3684 -ip 36841⤵PID:1396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4760 -ip 47601⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4760 -ip 47601⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4760 -ip 47601⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 3202⤵
- Program crash
PID:4172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2796 -ip 27961⤵PID:1696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
175KB
MD547b52e7049909e34f093a814f4d0a4aa
SHA1af61fcd6bba0cba8fd43d5082cadd754a58db5c1
SHA256ab6ea41c93266c2e20a168fdc19f03efb8d2296e268868b2898704023318e02d
SHA5124a6315154352c8b16a2fecc70db4ad5a48e6ed9bbc16d7e030c2bb87a9a7314e6c131fb232066267fcb8122c96b8fbb3c639569438c75fb42268c02a199ded43
-
Filesize
175KB
MD547b52e7049909e34f093a814f4d0a4aa
SHA1af61fcd6bba0cba8fd43d5082cadd754a58db5c1
SHA256ab6ea41c93266c2e20a168fdc19f03efb8d2296e268868b2898704023318e02d
SHA5124a6315154352c8b16a2fecc70db4ad5a48e6ed9bbc16d7e030c2bb87a9a7314e6c131fb232066267fcb8122c96b8fbb3c639569438c75fb42268c02a199ded43
-
Filesize
919KB
MD5faa84c02f330a1f611aa01fa74931437
SHA130fe0a03d51ebdf03c97a1139091f2eefd5a61f0
SHA25699c73b519d637a0db134a754004a12899f9b7ea7d1c7aa265d46acc8f9b827ae
SHA512390a0483c7fe3a2d627b3f553f5c6263816333ede2bd40dba4b674211120c000560225bf88344e97373c5e366456ff37061b084e829b539e9d58b3fe3fe57821
-
Filesize
919KB
MD5faa84c02f330a1f611aa01fa74931437
SHA130fe0a03d51ebdf03c97a1139091f2eefd5a61f0
SHA25699c73b519d637a0db134a754004a12899f9b7ea7d1c7aa265d46acc8f9b827ae
SHA512390a0483c7fe3a2d627b3f553f5c6263816333ede2bd40dba4b674211120c000560225bf88344e97373c5e366456ff37061b084e829b539e9d58b3fe3fe57821
-
Filesize
297KB
MD5f8d1076837f2de0e0077f1729d9ea571
SHA1fe258781da5f665e23be172948f9b026bd765eba
SHA2562eba1fcc1c222bdabe994f086da50ffdc15d7ebb5f7bee1db2845accbf26f882
SHA512aa31dd2709f36cff5dffb4d62cc528a6d70dbae7b84184d9b1e44008d6e66ff7164d588f68aca40b417922f643ccd5f4dd39998ea922658e9bb0f787f60d9869
-
Filesize
297KB
MD5f8d1076837f2de0e0077f1729d9ea571
SHA1fe258781da5f665e23be172948f9b026bd765eba
SHA2562eba1fcc1c222bdabe994f086da50ffdc15d7ebb5f7bee1db2845accbf26f882
SHA512aa31dd2709f36cff5dffb4d62cc528a6d70dbae7b84184d9b1e44008d6e66ff7164d588f68aca40b417922f643ccd5f4dd39998ea922658e9bb0f787f60d9869
-
Filesize
588KB
MD5f71acdb926fe48c8bf2e4818452e375d
SHA102ab32f38507124b713bf3040b5d2bb3f96d6b6a
SHA256050f82e664351cbc5c0af797908137d5bcfa9cdb8ad593f5b6a44bc09a859159
SHA51201d9b703a1368f73f6fcbbcfc6e8246f65798ce620a68d1a8ec2d28f032cc2c9522642730dc0b3101f599c926dc7ba91c83121212b887fd2d41d76dce8fc65f8
-
Filesize
588KB
MD5f71acdb926fe48c8bf2e4818452e375d
SHA102ab32f38507124b713bf3040b5d2bb3f96d6b6a
SHA256050f82e664351cbc5c0af797908137d5bcfa9cdb8ad593f5b6a44bc09a859159
SHA51201d9b703a1368f73f6fcbbcfc6e8246f65798ce620a68d1a8ec2d28f032cc2c9522642730dc0b3101f599c926dc7ba91c83121212b887fd2d41d76dce8fc65f8
-
Filesize
238KB
MD57a17613a4ac98d1825b3ec20c6b59ddb
SHA1300aab89f1da5e5b3c799a9cd3f0cfe7c7d53b53
SHA256fe0c711fc88e2ad47ee79ce5f037e34cb226a25dd68c92a6ad087b96c4bbdf2d
SHA51298cd710c0c2c40f220572ee4b4f70b9fec654e64e0d69ec93e26f99574ebb47e12a93d50f5f7840adced069d7d5687d3370029c0b1312949eddb4f1d6d37b16f
-
Filesize
238KB
MD57a17613a4ac98d1825b3ec20c6b59ddb
SHA1300aab89f1da5e5b3c799a9cd3f0cfe7c7d53b53
SHA256fe0c711fc88e2ad47ee79ce5f037e34cb226a25dd68c92a6ad087b96c4bbdf2d
SHA51298cd710c0c2c40f220572ee4b4f70b9fec654e64e0d69ec93e26f99574ebb47e12a93d50f5f7840adced069d7d5687d3370029c0b1312949eddb4f1d6d37b16f
-
Filesize
315KB
MD53971156792c9096c5860026529619fa1
SHA1f1b7ab3bbcb13978b9ead16bffab1f8039a6d2d7
SHA25690395471b67112d70438af93af3e9d293bf0b0b800cfc3b1a51130badfffb183
SHA512875e1d7aa9da7bc8a5b779dea9ed7c3cd2cccbada993cbbec427b23ad79547a8cb848cc55446a9ff332b0abdae24e1adc1cd4d69f2d30bbf71a64cdb66d77586
-
Filesize
315KB
MD53971156792c9096c5860026529619fa1
SHA1f1b7ab3bbcb13978b9ead16bffab1f8039a6d2d7
SHA25690395471b67112d70438af93af3e9d293bf0b0b800cfc3b1a51130badfffb183
SHA512875e1d7aa9da7bc8a5b779dea9ed7c3cd2cccbada993cbbec427b23ad79547a8cb848cc55446a9ff332b0abdae24e1adc1cd4d69f2d30bbf71a64cdb66d77586
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
230KB
MD554c44f28117c042e00f54b4f44aa89bb
SHA13c8668e8500216e31e4e7943dc5dc7a045619dec
SHA2565ad202f9785ad847380ef33c36d00446a06eadb03bb0c1e7e7e7cc87b6b841f3
SHA512bbd3037dc11758fb17d1973fd904c99e2c2ad3ff84a94adde9b6e50f5493e55b09fb30bbef825b2dc31debaa6fa7427fe97b7fbb277fa8f79965b2ba36232d4e
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5