Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2023, 07:36
Static task
static1
General
-
Target
dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe
-
Size
1.1MB
-
MD5
4bd45dce9cf28a2a2335dcc3c71504bc
-
SHA1
d6c60831f63d02f7b7c3673f0a8906be647ccec2
-
SHA256
dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e
-
SHA512
2ba4141708d23c3109160a9f4d4fd085b2e375888435fde0b981791fcaf2482880d16dc0bacd3bef4ce7d4798927337fe95b8b37816ef36a44ee67ba225ebbe0
-
SSDEEP
24576:Jy5ygTZzrKtpKRKCXdhzOVSSmtJJ/FWaNg7/4+lWXF80gNNEPHEBw:85ygprkWKCXuUSmtJlEao/4je0g8PH
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr261040.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation si968170.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation qu150346.exe -
Executes dropped EXE 10 IoCs
pid Process 2120 un257901.exe 2600 un227764.exe 216 pr261040.exe 4996 qu150346.exe 5112 1.exe 4040 rk834819.exe 1596 si968170.exe 1000 oneetx.exe 2300 oneetx.exe 2124 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1724 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr261040.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr261040.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un257901.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un257901.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un227764.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un227764.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 1680 216 WerFault.exe 85 2108 4996 WerFault.exe 92 536 1596 WerFault.exe 99 4704 1596 WerFault.exe 99 4016 1596 WerFault.exe 99 3272 1596 WerFault.exe 99 4400 1596 WerFault.exe 99 2132 1596 WerFault.exe 99 1960 1596 WerFault.exe 99 2124 1596 WerFault.exe 99 3364 1596 WerFault.exe 99 3796 1596 WerFault.exe 99 2524 1000 WerFault.exe 120 4712 1000 WerFault.exe 120 2960 1000 WerFault.exe 120 680 1000 WerFault.exe 120 4776 1000 WerFault.exe 120 1200 1000 WerFault.exe 120 1792 1000 WerFault.exe 120 4596 1000 WerFault.exe 120 1532 1000 WerFault.exe 120 2040 1000 WerFault.exe 120 4524 1000 WerFault.exe 120 4288 2300 WerFault.exe 148 2380 1000 WerFault.exe 120 2964 1000 WerFault.exe 120 2584 1000 WerFault.exe 120 2728 1000 WerFault.exe 120 3888 2124 WerFault.exe 158 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 216 pr261040.exe 216 pr261040.exe 5112 1.exe 4040 rk834819.exe 5112 1.exe 4040 rk834819.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 216 pr261040.exe Token: SeDebugPrivilege 4996 qu150346.exe Token: SeDebugPrivilege 5112 1.exe Token: SeDebugPrivilege 4040 rk834819.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1596 si968170.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2120 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 83 PID 3004 wrote to memory of 2120 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 83 PID 3004 wrote to memory of 2120 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 83 PID 2120 wrote to memory of 2600 2120 un257901.exe 84 PID 2120 wrote to memory of 2600 2120 un257901.exe 84 PID 2120 wrote to memory of 2600 2120 un257901.exe 84 PID 2600 wrote to memory of 216 2600 un227764.exe 85 PID 2600 wrote to memory of 216 2600 un227764.exe 85 PID 2600 wrote to memory of 216 2600 un227764.exe 85 PID 2600 wrote to memory of 4996 2600 un227764.exe 92 PID 2600 wrote to memory of 4996 2600 un227764.exe 92 PID 2600 wrote to memory of 4996 2600 un227764.exe 92 PID 4996 wrote to memory of 5112 4996 qu150346.exe 93 PID 4996 wrote to memory of 5112 4996 qu150346.exe 93 PID 4996 wrote to memory of 5112 4996 qu150346.exe 93 PID 2120 wrote to memory of 4040 2120 un257901.exe 96 PID 2120 wrote to memory of 4040 2120 un257901.exe 96 PID 2120 wrote to memory of 4040 2120 un257901.exe 96 PID 3004 wrote to memory of 1596 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 99 PID 3004 wrote to memory of 1596 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 99 PID 3004 wrote to memory of 1596 3004 dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe 99 PID 1596 wrote to memory of 1000 1596 si968170.exe 120 PID 1596 wrote to memory of 1000 1596 si968170.exe 120 PID 1596 wrote to memory of 1000 1596 si968170.exe 120 PID 1000 wrote to memory of 2836 1000 oneetx.exe 138 PID 1000 wrote to memory of 2836 1000 oneetx.exe 138 PID 1000 wrote to memory of 2836 1000 oneetx.exe 138 PID 1000 wrote to memory of 1724 1000 oneetx.exe 155 PID 1000 wrote to memory of 1724 1000 oneetx.exe 155 PID 1000 wrote to memory of 1724 1000 oneetx.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe"C:\Users\Admin\AppData\Local\Temp\dc112bdf10bcc574302cee5e77f7c412a69f7d44f9c5f38e340ebdd7aa76165e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un257901.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un257901.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un227764.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un227764.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr261040.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr261040.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 10845⤵
- Program crash
PID:1680
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu150346.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu150346.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 13325⤵
- Program crash
PID:2108
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk834819.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk834819.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968170.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968170.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 7003⤵
- Program crash
PID:536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 7843⤵
- Program crash
PID:4704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 8603⤵
- Program crash
PID:4016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 9643⤵
- Program crash
PID:3272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 9563⤵
- Program crash
PID:4400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 9763⤵
- Program crash
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 12163⤵
- Program crash
PID:1960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 12283⤵
- Program crash
PID:2124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 13243⤵
- Program crash
PID:3364
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 6964⤵
- Program crash
PID:2524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9124⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9164⤵
- Program crash
PID:2960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 10844⤵
- Program crash
PID:680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9204⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 11044⤵
- Program crash
PID:1200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 9004⤵
- Program crash
PID:1792
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 7844⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 8764⤵
- Program crash
PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 6964⤵
- Program crash
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 8764⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 11164⤵
- Program crash
PID:2380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 16044⤵
- Program crash
PID:2964
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 11164⤵
- Program crash
PID:2584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 16204⤵
- Program crash
PID:2728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 8683⤵
- Program crash
PID:3796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 216 -ip 2161⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4996 -ip 49961⤵PID:3548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1596 -ip 15961⤵PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1596 -ip 15961⤵PID:4276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1596 -ip 15961⤵PID:816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1596 -ip 15961⤵PID:1320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1596 -ip 15961⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1596 -ip 15961⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1596 -ip 15961⤵PID:2676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1596 -ip 15961⤵PID:560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1596 -ip 15961⤵PID:2988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1596 -ip 15961⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1000 -ip 10001⤵PID:4700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1000 -ip 10001⤵PID:772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1000 -ip 10001⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1000 -ip 10001⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1000 -ip 10001⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1000 -ip 10001⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1000 -ip 10001⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1000 -ip 10001⤵PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1000 -ip 10001⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1000 -ip 10001⤵PID:428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1000 -ip 10001⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 3162⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2300 -ip 23001⤵PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1000 -ip 10001⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1000 -ip 10001⤵PID:1120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1000 -ip 10001⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 3162⤵
- Program crash
PID:3888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1000 -ip 10001⤵PID:2988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2124 -ip 21241⤵PID:5084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
394KB
MD5c411b120af21d525d7b07a9d59fa4b7a
SHA1bb8dc59216d6d90b997955d7e13307654bdd0f4e
SHA2562b53fa525913d9f076216ff1268067270d2aecab3232fb91786f5079c9c141dd
SHA512af5c869ba01727152fcc38cfc1a476c7c7696c6e8e5710a63eafe5c3ef2fe9f7826f290f14e5a88dd3a97e72addf1c0c882713559f192f3bf2d6f1f17ad8e37c
-
Filesize
850KB
MD53e78a00c043de2e0ce4cfbe233377028
SHA144539b3f26beda034e8bb673c1c10ffcba3e8d0a
SHA256533c132407d78dbde0fe354a798cc3537176e7ac2cac5e1584b24ab6a00dfad5
SHA512c0783a3256fdb5adcec4768630a4171eb0a537a5ca801a92413b8af163ddda7874f40849e00010a23302c7f0f7458f54c2b92824390a6400af132750700de546
-
Filesize
850KB
MD53e78a00c043de2e0ce4cfbe233377028
SHA144539b3f26beda034e8bb673c1c10ffcba3e8d0a
SHA256533c132407d78dbde0fe354a798cc3537176e7ac2cac5e1584b24ab6a00dfad5
SHA512c0783a3256fdb5adcec4768630a4171eb0a537a5ca801a92413b8af163ddda7874f40849e00010a23302c7f0f7458f54c2b92824390a6400af132750700de546
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
697KB
MD56dd2de6af7f82b41267442bef5b31f5d
SHA143c08b811cd2ec8d9084f69e55cce3a986422775
SHA2568cb9cd00a08d95404dafd5c1093ff8c3c4772eda606bd420f6a3380673723a39
SHA5120761be773a29376fe68254b83b840b1443e24ff2c77a2297228b4e45127a80a2185fb8f8f7a918f373dabf7bc2b597c58a4d23a491b39c1a334f8e9c830ed90f
-
Filesize
697KB
MD56dd2de6af7f82b41267442bef5b31f5d
SHA143c08b811cd2ec8d9084f69e55cce3a986422775
SHA2568cb9cd00a08d95404dafd5c1093ff8c3c4772eda606bd420f6a3380673723a39
SHA5120761be773a29376fe68254b83b840b1443e24ff2c77a2297228b4e45127a80a2185fb8f8f7a918f373dabf7bc2b597c58a4d23a491b39c1a334f8e9c830ed90f
-
Filesize
403KB
MD5854a3dcc7310a5e4c8c4445f6b804832
SHA17ab7cf8f31bb36bbbebd077ff6ebb02308553111
SHA256b381b271b9942f8f8a83519e0102a2e5822ef75de1cbdedbff5f6024ea84e522
SHA51293bbfb90bbb6b8d8e09498fb3e9b90dc21addc8842b7c9fb8039572dd5afdd23f13b506e2d7684ec11dc6ea2e8633d8e13e8d3946b6086413c4d9ba513210e54
-
Filesize
403KB
MD5854a3dcc7310a5e4c8c4445f6b804832
SHA17ab7cf8f31bb36bbbebd077ff6ebb02308553111
SHA256b381b271b9942f8f8a83519e0102a2e5822ef75de1cbdedbff5f6024ea84e522
SHA51293bbfb90bbb6b8d8e09498fb3e9b90dc21addc8842b7c9fb8039572dd5afdd23f13b506e2d7684ec11dc6ea2e8633d8e13e8d3946b6086413c4d9ba513210e54
-
Filesize
586KB
MD59f55babd4beba042928cd174994cb2c1
SHA1f371198c124249c3ad3309dc91c1498037024147
SHA25622ab994a35ef93c66b556069408749d2ed4022068595a069d41b1daf1ed864e4
SHA512d7e37e155e0be9bec9ae06713a172bf998c9a5521ff88062a587ed30b440e36331b5c9ad198a973529eb07365b7e16c3bf5a554c94a8f3d823cd658b71db472e
-
Filesize
586KB
MD59f55babd4beba042928cd174994cb2c1
SHA1f371198c124249c3ad3309dc91c1498037024147
SHA25622ab994a35ef93c66b556069408749d2ed4022068595a069d41b1daf1ed864e4
SHA512d7e37e155e0be9bec9ae06713a172bf998c9a5521ff88062a587ed30b440e36331b5c9ad198a973529eb07365b7e16c3bf5a554c94a8f3d823cd658b71db472e
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1