Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 03:57
Static task
static1
General
-
Target
c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe
-
Size
924KB
-
MD5
22823d836dda29fa079394d61ad241dc
-
SHA1
7ac1d38a1ca041107ddc1bef01ae16770661780b
-
SHA256
c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c
-
SHA512
6398a505830675cc5eb7c53d82877bbfdfd48ab203896abdbe81c743813e416161934e7e4d60c56964c1d7754f546b52c4481faaf2a17e2353908e8e16e62633
-
SSDEEP
24576:IynPlpA3xEhmB2JokvKTC9crO8yyhHpo+o6q:PteKAgokyYcre76
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
nahui
176.113.115.145:4125
-
auth_value
b9ed10946d21e28d58d0c72c535cde6f
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr634480.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
resource yara_rule behavioral1/memory/2280-197-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-198-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-200-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-202-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-204-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-206-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-208-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-212-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-211-0x0000000004C60000-0x0000000004C70000-memory.dmp family_redline behavioral1/memory/2280-216-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-218-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-220-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-222-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-224-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-226-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-228-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-230-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-232-0x0000000002650000-0x000000000268F000-memory.dmp family_redline behavioral1/memory/2280-234-0x0000000002650000-0x000000000268F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation si582429.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 1456 un709489.exe 432 un365207.exe 1224 pr634480.exe 2280 qu102938.exe 1068 rk280388.exe 5064 si582429.exe 2884 oneetx.exe 1648 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4360 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr634480.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr634480.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un709489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un709489.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un365207.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un365207.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
pid pid_target Process procid_target 1648 1224 WerFault.exe 86 1956 2280 WerFault.exe 94 3312 5064 WerFault.exe 102 4800 5064 WerFault.exe 102 1648 5064 WerFault.exe 102 3800 5064 WerFault.exe 102 1400 5064 WerFault.exe 102 3688 5064 WerFault.exe 102 1976 5064 WerFault.exe 102 860 5064 WerFault.exe 102 5024 5064 WerFault.exe 102 4756 5064 WerFault.exe 102 4772 2884 WerFault.exe 123 4652 2884 WerFault.exe 123 2140 2884 WerFault.exe 123 4112 2884 WerFault.exe 123 1076 2884 WerFault.exe 123 3840 2884 WerFault.exe 123 4408 2884 WerFault.exe 123 4860 2884 WerFault.exe 123 1956 2884 WerFault.exe 123 2148 2884 WerFault.exe 123 2776 2884 WerFault.exe 123 3732 2884 WerFault.exe 123 948 2884 WerFault.exe 123 2932 2884 WerFault.exe 123 3808 1648 WerFault.exe 156 4668 2884 WerFault.exe 123 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1224 pr634480.exe 1224 pr634480.exe 2280 qu102938.exe 2280 qu102938.exe 1068 rk280388.exe 1068 rk280388.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1224 pr634480.exe Token: SeDebugPrivilege 2280 qu102938.exe Token: SeDebugPrivilege 1068 rk280388.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5064 si582429.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3344 wrote to memory of 1456 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 84 PID 3344 wrote to memory of 1456 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 84 PID 3344 wrote to memory of 1456 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 84 PID 1456 wrote to memory of 432 1456 un709489.exe 85 PID 1456 wrote to memory of 432 1456 un709489.exe 85 PID 1456 wrote to memory of 432 1456 un709489.exe 85 PID 432 wrote to memory of 1224 432 un365207.exe 86 PID 432 wrote to memory of 1224 432 un365207.exe 86 PID 432 wrote to memory of 1224 432 un365207.exe 86 PID 432 wrote to memory of 2280 432 un365207.exe 94 PID 432 wrote to memory of 2280 432 un365207.exe 94 PID 432 wrote to memory of 2280 432 un365207.exe 94 PID 1456 wrote to memory of 1068 1456 un709489.exe 98 PID 1456 wrote to memory of 1068 1456 un709489.exe 98 PID 1456 wrote to memory of 1068 1456 un709489.exe 98 PID 3344 wrote to memory of 5064 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 102 PID 3344 wrote to memory of 5064 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 102 PID 3344 wrote to memory of 5064 3344 c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe 102 PID 5064 wrote to memory of 2884 5064 si582429.exe 123 PID 5064 wrote to memory of 2884 5064 si582429.exe 123 PID 5064 wrote to memory of 2884 5064 si582429.exe 123 PID 2884 wrote to memory of 4584 2884 oneetx.exe 139 PID 2884 wrote to memory of 4584 2884 oneetx.exe 139 PID 2884 wrote to memory of 4584 2884 oneetx.exe 139 PID 2884 wrote to memory of 4360 2884 oneetx.exe 153 PID 2884 wrote to memory of 4360 2884 oneetx.exe 153 PID 2884 wrote to memory of 4360 2884 oneetx.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe"C:\Users\Admin\AppData\Local\Temp\c013ae39b31884165e1de61625e24b882e6f40cfb80b6b706be5b04475f6a18c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un709489.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un709489.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un365207.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un365207.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr634480.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr634480.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 10845⤵
- Program crash
PID:1648
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu102938.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu102938.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 13445⤵
- Program crash
PID:1956
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk280388.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk280388.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si582429.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si582429.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 6963⤵
- Program crash
PID:3312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 7803⤵
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 8563⤵
- Program crash
PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 9803⤵
- Program crash
PID:3800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 9963⤵
- Program crash
PID:1400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 9483⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 12163⤵
- Program crash
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 12403⤵
- Program crash
PID:860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 13163⤵
- Program crash
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 6924⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 8684⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 9124⤵
- Program crash
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 10524⤵
- Program crash
PID:4112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 10884⤵
- Program crash
PID:1076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 10884⤵
- Program crash
PID:3840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 10964⤵
- Program crash
PID:4408
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 9924⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 7524⤵
- Program crash
PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 7284⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 9884⤵
- Program crash
PID:2776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 11124⤵
- Program crash
PID:3732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 16724⤵
- Program crash
PID:948
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 15924⤵
- Program crash
PID:2932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 16884⤵
- Program crash
PID:4668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 13083⤵
- Program crash
PID:4756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1224 -ip 12241⤵PID:948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2280 -ip 22801⤵PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5064 -ip 50641⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5064 -ip 50641⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5064 -ip 50641⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5064 -ip 50641⤵PID:1800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5064 -ip 50641⤵PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5064 -ip 50641⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5064 -ip 50641⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5064 -ip 50641⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5064 -ip 50641⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5064 -ip 50641⤵PID:3464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2884 -ip 28841⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2884 -ip 28841⤵PID:3196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2884 -ip 28841⤵PID:2336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2884 -ip 28841⤵PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2884 -ip 28841⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2884 -ip 28841⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2884 -ip 28841⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2884 -ip 28841⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2884 -ip 28841⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2884 -ip 28841⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2884 -ip 28841⤵PID:2360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2884 -ip 28841⤵PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2884 -ip 28841⤵PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2884 -ip 28841⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 3202⤵
- Program crash
PID:3808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1648 -ip 16481⤵PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2884 -ip 28841⤵PID:1840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
230KB
MD56300508e058abec227185450c3c9547c
SHA141910122c84dcbdb2efa6c91378ce68731819d07
SHA256ad280e6fecddb25c5a3b9ff4881f51470c1bc294c958827e9de2cf1c164f975c
SHA5122216d2f631da40785c69acc788d154c5bee2dacdfd764478249c93a6684e28b2ef83091d39af4543c6930d7ec0b40a434dac3d8f6e76d9dcebe0544fce5d7892
-
Filesize
660KB
MD571924f9ac81502694a0e94bb9b71f66d
SHA1d6fb413f8747a6ae6f5824106785b1ce43e08c5e
SHA256434c2cba5a6a8440bbe372e4ac2150513d588ef27d973333196af344628070f1
SHA512e583d292222f1c41558fea47ffd5b05e14e3347cb8082ba68ebebb0d2d74656f01dab0aacfcd7ba0c5923362e6fda1bc607a2ca7cf7d4315fbcde36e471f456b
-
Filesize
660KB
MD571924f9ac81502694a0e94bb9b71f66d
SHA1d6fb413f8747a6ae6f5824106785b1ce43e08c5e
SHA256434c2cba5a6a8440bbe372e4ac2150513d588ef27d973333196af344628070f1
SHA512e583d292222f1c41558fea47ffd5b05e14e3347cb8082ba68ebebb0d2d74656f01dab0aacfcd7ba0c5923362e6fda1bc607a2ca7cf7d4315fbcde36e471f456b
-
Filesize
175KB
MD5b2e599dec0856d70ebb2ab2327ae6442
SHA1300323436b47ddafa78cb7e835deb1ab09f13698
SHA256b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43
SHA512c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065
-
Filesize
175KB
MD5b2e599dec0856d70ebb2ab2327ae6442
SHA1300323436b47ddafa78cb7e835deb1ab09f13698
SHA256b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43
SHA512c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065
-
Filesize
518KB
MD50749cb6d4ea4eeaa83ea25c466b5516f
SHA16882befc146f60cc0553b87dbc5a9226eb81060b
SHA256a334241fb99799a1ebd373b2df3418702019016aa85b2d9062c31dce6fffe4dc
SHA5126592b3a63d6af9147a0e902a0b453331b69f15a97b31d4b08516bf9114d1b61becdea0a0ea05ddbb69d741b89f6773baed000cb4a72e5ca8748b71bbb9fa87aa
-
Filesize
518KB
MD50749cb6d4ea4eeaa83ea25c466b5516f
SHA16882befc146f60cc0553b87dbc5a9226eb81060b
SHA256a334241fb99799a1ebd373b2df3418702019016aa85b2d9062c31dce6fffe4dc
SHA5126592b3a63d6af9147a0e902a0b453331b69f15a97b31d4b08516bf9114d1b61becdea0a0ea05ddbb69d741b89f6773baed000cb4a72e5ca8748b71bbb9fa87aa
-
Filesize
238KB
MD5436ed1f4729da05239bb52e1fb8b9426
SHA16e5527c7996635072a5f6ca265c4840b6c3598e1
SHA2564f74a69a0fe791cdfb98b535ee68e5b98443c8ab4a72cb97f6bf83debe4e9742
SHA512836766bcef57dcabf8df0128bb125f076d644568d5066376fd913960549f086f96de535ce92bf1287e1b9ae3242339bb7a3308b6b33325acc84acb4c7825b9f4
-
Filesize
238KB
MD5436ed1f4729da05239bb52e1fb8b9426
SHA16e5527c7996635072a5f6ca265c4840b6c3598e1
SHA2564f74a69a0fe791cdfb98b535ee68e5b98443c8ab4a72cb97f6bf83debe4e9742
SHA512836766bcef57dcabf8df0128bb125f076d644568d5066376fd913960549f086f96de535ce92bf1287e1b9ae3242339bb7a3308b6b33325acc84acb4c7825b9f4
-
Filesize
297KB
MD52b46e70d352bf9e8dff7db69be63552a
SHA192514191ede0aa5459015c339230826bb2544059
SHA256d093ec3788949baf3d8b8866d7f3b16ab6ef0797282dde223f723c5ddfc8ccd0
SHA512f442ff1830263362506d9116f17d57f4d2836a23e183a5c3f3731cb791ecb40312ddb70fa8853aa2a2d376489c0938e0cc5dd7398f25afa88dffc2a548d3cfa2
-
Filesize
297KB
MD52b46e70d352bf9e8dff7db69be63552a
SHA192514191ede0aa5459015c339230826bb2544059
SHA256d093ec3788949baf3d8b8866d7f3b16ab6ef0797282dde223f723c5ddfc8ccd0
SHA512f442ff1830263362506d9116f17d57f4d2836a23e183a5c3f3731cb791ecb40312ddb70fa8853aa2a2d376489c0938e0cc5dd7398f25afa88dffc2a548d3cfa2
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5