Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 21:20
Static task
static1
General
-
Target
4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe
-
Size
1.1MB
-
MD5
8a76336a5619c0d49bb323afd82fdca8
-
SHA1
76d3d152304862622bd52ac2b06aebf243ca164f
-
SHA256
4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827
-
SHA512
668397bf55cfff4ddf4e38b6d4c9ce9d86dd09eaaabb0226f195be179d81729ac2f7ad31a665dab8c5ce54c9fc6ac6af8e0a57ed841a21d4522340c3bc7ec8b1
-
SSDEEP
24576:NyawbrCIPGh7QpX069E1uukcx8RqNpRh4dG520JUFM3hxVXwK:oazIukXE1LkceR61402nW3hxVA
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr834679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr834679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr834679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr834679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr834679.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr834679.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation si279452.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation qu255822.exe -
Executes dropped EXE 10 IoCs
pid Process 368 un051936.exe 2060 un684306.exe 920 pr834679.exe 4564 qu255822.exe 4164 1.exe 524 rk915369.exe 3020 si279452.exe 548 oneetx.exe 2068 oneetx.exe 3744 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4672 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr834679.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr834679.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un051936.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un684306.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un684306.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un051936.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 1156 920 WerFault.exe 85 4320 4564 WerFault.exe 94 4052 3020 WerFault.exe 101 4628 3020 WerFault.exe 101 4128 3020 WerFault.exe 101 4536 3020 WerFault.exe 101 3960 3020 WerFault.exe 101 3316 3020 WerFault.exe 101 680 3020 WerFault.exe 101 1096 3020 WerFault.exe 101 3228 3020 WerFault.exe 101 4732 3020 WerFault.exe 101 2164 548 WerFault.exe 120 4716 548 WerFault.exe 120 4204 548 WerFault.exe 120 4400 548 WerFault.exe 120 2324 548 WerFault.exe 120 3764 548 WerFault.exe 120 5044 548 WerFault.exe 120 760 548 WerFault.exe 120 1732 548 WerFault.exe 120 4336 548 WerFault.exe 120 5024 548 WerFault.exe 120 4340 548 WerFault.exe 120 1424 2068 WerFault.exe 149 212 548 WerFault.exe 120 3704 548 WerFault.exe 120 3924 548 WerFault.exe 120 4196 3744 WerFault.exe 159 3860 548 WerFault.exe 120 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 920 pr834679.exe 920 pr834679.exe 524 rk915369.exe 4164 1.exe 4164 1.exe 524 rk915369.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 920 pr834679.exe Token: SeDebugPrivilege 4564 qu255822.exe Token: SeDebugPrivilege 524 rk915369.exe Token: SeDebugPrivilege 4164 1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 si279452.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2760 wrote to memory of 368 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 83 PID 2760 wrote to memory of 368 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 83 PID 2760 wrote to memory of 368 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 83 PID 368 wrote to memory of 2060 368 un051936.exe 84 PID 368 wrote to memory of 2060 368 un051936.exe 84 PID 368 wrote to memory of 2060 368 un051936.exe 84 PID 2060 wrote to memory of 920 2060 un684306.exe 85 PID 2060 wrote to memory of 920 2060 un684306.exe 85 PID 2060 wrote to memory of 920 2060 un684306.exe 85 PID 2060 wrote to memory of 4564 2060 un684306.exe 94 PID 2060 wrote to memory of 4564 2060 un684306.exe 94 PID 2060 wrote to memory of 4564 2060 un684306.exe 94 PID 4564 wrote to memory of 4164 4564 qu255822.exe 97 PID 4564 wrote to memory of 4164 4564 qu255822.exe 97 PID 4564 wrote to memory of 4164 4564 qu255822.exe 97 PID 368 wrote to memory of 524 368 un051936.exe 100 PID 368 wrote to memory of 524 368 un051936.exe 100 PID 368 wrote to memory of 524 368 un051936.exe 100 PID 2760 wrote to memory of 3020 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 101 PID 2760 wrote to memory of 3020 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 101 PID 2760 wrote to memory of 3020 2760 4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe 101 PID 3020 wrote to memory of 548 3020 si279452.exe 120 PID 3020 wrote to memory of 548 3020 si279452.exe 120 PID 3020 wrote to memory of 548 3020 si279452.exe 120 PID 548 wrote to memory of 1076 548 oneetx.exe 137 PID 548 wrote to memory of 1076 548 oneetx.exe 137 PID 548 wrote to memory of 1076 548 oneetx.exe 137 PID 548 wrote to memory of 4672 548 oneetx.exe 156 PID 548 wrote to memory of 4672 548 oneetx.exe 156 PID 548 wrote to memory of 4672 548 oneetx.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe"C:\Users\Admin\AppData\Local\Temp\4f3379bf58932c0a1b94742987e3e4c12cde445d15a239bc8755df2c2ec50827.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un051936.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un051936.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un684306.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un684306.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr834679.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr834679.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 10885⤵
- Program crash
PID:1156
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu255822.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu255822.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 13805⤵
- Program crash
PID:4320
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk915369.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk915369.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si279452.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si279452.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 7083⤵
- Program crash
PID:4052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 7803⤵
- Program crash
PID:4628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 8563⤵
- Program crash
PID:4128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 8643⤵
- Program crash
PID:4536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 9843⤵
- Program crash
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 8723⤵
- Program crash
PID:3316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 12203⤵
- Program crash
PID:680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 12683⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 12963⤵
- Program crash
PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 6964⤵
- Program crash
PID:2164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 8684⤵
- Program crash
PID:4716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 8924⤵
- Program crash
PID:4204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 10524⤵
- Program crash
PID:4400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 10884⤵
- Program crash
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 10884⤵
- Program crash
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 11284⤵
- Program crash
PID:5044
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 9924⤵
- Program crash
PID:760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 7764⤵
- Program crash
PID:1732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 13004⤵
- Program crash
PID:4336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 13084⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 14764⤵
- Program crash
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 11724⤵
- Program crash
PID:212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 15644⤵
- Program crash
PID:3704
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 15964⤵
- Program crash
PID:3924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 16364⤵
- Program crash
PID:3860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 13683⤵
- Program crash
PID:4732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 920 -ip 9201⤵PID:4196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4564 -ip 45641⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3020 -ip 30201⤵PID:460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3020 -ip 30201⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3020 -ip 30201⤵PID:3840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3020 -ip 30201⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3020 -ip 30201⤵PID:3368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3020 -ip 30201⤵PID:2888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3020 -ip 30201⤵PID:1412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3020 -ip 30201⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3020 -ip 30201⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3020 -ip 30201⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 548 -ip 5481⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 548 -ip 5481⤵PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 548 -ip 5481⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 548 -ip 5481⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 548 -ip 5481⤵PID:1696
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 548 -ip 5481⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 548 -ip 5481⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 548 -ip 5481⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 548 -ip 5481⤵PID:2152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 548 -ip 5481⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 548 -ip 5481⤵PID:1132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 548 -ip 5481⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3202⤵
- Program crash
PID:1424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2068 -ip 20681⤵PID:4092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 548 -ip 5481⤵PID:228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 548 -ip 5481⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 548 -ip 5481⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 2162⤵
- Program crash
PID:4196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3744 -ip 37441⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 548 -ip 5481⤵PID:556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
247KB
MD5e6331b073c0e47766713f24473384a93
SHA16575a6992331fe3ff626c0da31e56bb505513431
SHA2564c71d72feb4dd66889856ecafd71d776dcee972ba6a07438473ad79ce2307a0f
SHA51293faa2c586417f5d1729c32d9db235b40f1b0e22a01b8187d30232c50e9d27207035b7ba2cf7bee25fd3c4f2e35fa0f9d68ccd54d5e2e98697870de86b364d40
-
Filesize
808KB
MD56f05670c446bc653156c90fd62590e2b
SHA16a7ff702bd99e72bb64d9aeb7e4d313b6b212c30
SHA2566c9dbd96a71849ec8d596e183e3c2bf1d18c8d3822099aa06f6c846796a98539
SHA5128e85ec72b92485ffc67324548483b3a525c72e32633312bd448b46d1c283c42bd28131f49f8f908fd51253f40dca7bb1ae3c11958a3c09504d9d529bfe30a44c
-
Filesize
808KB
MD56f05670c446bc653156c90fd62590e2b
SHA16a7ff702bd99e72bb64d9aeb7e4d313b6b212c30
SHA2566c9dbd96a71849ec8d596e183e3c2bf1d18c8d3822099aa06f6c846796a98539
SHA5128e85ec72b92485ffc67324548483b3a525c72e32633312bd448b46d1c283c42bd28131f49f8f908fd51253f40dca7bb1ae3c11958a3c09504d9d529bfe30a44c
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
654KB
MD510b1be75cbd0e9b989e361cea4e9c1a4
SHA18a124e879d92b866a4896d0aae1e124667affbc3
SHA256b1332ab0b73721efc82cd04489faae0f6bf379734e379614bcc8c669b8c185d7
SHA5127f9ab354f75d02437a3060f351f9b10abc1cdb0dbf4594d7c4f4b6b70742619f2f8d6a7674e583ecacc758840c6424108bcc086cb12af2070e614ec5d287899f
-
Filesize
654KB
MD510b1be75cbd0e9b989e361cea4e9c1a4
SHA18a124e879d92b866a4896d0aae1e124667affbc3
SHA256b1332ab0b73721efc82cd04489faae0f6bf379734e379614bcc8c669b8c185d7
SHA5127f9ab354f75d02437a3060f351f9b10abc1cdb0dbf4594d7c4f4b6b70742619f2f8d6a7674e583ecacc758840c6424108bcc086cb12af2070e614ec5d287899f
-
Filesize
254KB
MD5140d3d1471952e5bf8e6691fc551db2b
SHA12e01a6ae867a38831829117360a781fa02e5ce0e
SHA25604ce67c55821866513dc89d43e18d00dc25ffdbccefafa180f96517ff12c85e5
SHA5125079e044bbb65ad4c7ee4459b5144b96cf6fb95f681a6df4064bde138c14fc5973d6c6e99777240af9cd984423b5c0b806bef4da4dc890029c892fa3a2a8549a
-
Filesize
254KB
MD5140d3d1471952e5bf8e6691fc551db2b
SHA12e01a6ae867a38831829117360a781fa02e5ce0e
SHA25604ce67c55821866513dc89d43e18d00dc25ffdbccefafa180f96517ff12c85e5
SHA5125079e044bbb65ad4c7ee4459b5144b96cf6fb95f681a6df4064bde138c14fc5973d6c6e99777240af9cd984423b5c0b806bef4da4dc890029c892fa3a2a8549a
-
Filesize
438KB
MD5c5a062a66416ccef841f0d25a0394831
SHA16c7bc7083b07e86a3bebef2b8491e9af9c8fb2f8
SHA2567bb93a9322228980f34bf7e0217d4a2c58213e68765615d7910b56f3816a4b2f
SHA512895b93942e765cc9a04f61524422dfb90c244f52d27736b70ef09dd70d5ba0f42567b9cce49299360d060b4998a3bc13ebd45be8d86e688bc4618c4c7911f6c1
-
Filesize
438KB
MD5c5a062a66416ccef841f0d25a0394831
SHA16c7bc7083b07e86a3bebef2b8491e9af9c8fb2f8
SHA2567bb93a9322228980f34bf7e0217d4a2c58213e68765615d7910b56f3816a4b2f
SHA512895b93942e765cc9a04f61524422dfb90c244f52d27736b70ef09dd70d5ba0f42567b9cce49299360d060b4998a3bc13ebd45be8d86e688bc4618c4c7911f6c1
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1