Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2023, 07:46
Static task
static1
General
-
Target
21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe
-
Size
1.1MB
-
MD5
8dbef5e0eab8fe1591f7ec33d8374c3b
-
SHA1
7b0b294cd41443cf0b6c3e8ee49fe4b200ac9e39
-
SHA256
21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8
-
SHA512
ef1891eee3b697fb3e949dec44790cd7196f6d1aa57bba7b7193ac023ff3821ce81f45f866eff4fbcf903242eaf59abd86ee998e2db50a35ae10a10c519a8865
-
SSDEEP
24576:LytYmNYsOj9GF8hji2Qdy4QHVDuMdqS8bSgeduVvjQNAr:+tYGUhVAdyhHpuK8bdIuQA
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diza
185.161.248.90:4125
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr587745.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr587745.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr587745.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr587745.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr587745.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr587745.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si837878.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation qu970123.exe -
Executes dropped EXE 10 IoCs
pid Process 3932 un972774.exe 4716 un843397.exe 2728 pr587745.exe 4952 qu970123.exe 4896 1.exe 3000 rk916085.exe 3736 si837878.exe 1432 oneetx.exe 1188 oneetx.exe 3920 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5028 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr587745.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr587745.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un972774.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un972774.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un843397.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un843397.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 812 2728 WerFault.exe 85 4252 4952 WerFault.exe 92 4220 3736 WerFault.exe 99 3216 3736 WerFault.exe 99 1652 3736 WerFault.exe 99 4836 3736 WerFault.exe 99 548 3736 WerFault.exe 99 4376 3736 WerFault.exe 99 4348 3736 WerFault.exe 99 4724 3736 WerFault.exe 99 1068 3736 WerFault.exe 99 2008 3736 WerFault.exe 99 2052 1432 WerFault.exe 121 3664 1432 WerFault.exe 121 2116 1432 WerFault.exe 121 1348 1432 WerFault.exe 121 4300 1432 WerFault.exe 121 2600 1432 WerFault.exe 121 276 1432 WerFault.exe 121 2292 1432 WerFault.exe 121 1940 1432 WerFault.exe 121 4600 1432 WerFault.exe 121 3400 1432 WerFault.exe 121 4732 1188 WerFault.exe 148 3308 1432 WerFault.exe 121 4480 1432 WerFault.exe 121 3608 1432 WerFault.exe 121 2728 3920 WerFault.exe 158 1116 1432 WerFault.exe 121 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2436 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2728 pr587745.exe 2728 pr587745.exe 4896 1.exe 3000 rk916085.exe 3000 rk916085.exe 4896 1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 pr587745.exe Token: SeDebugPrivilege 4952 qu970123.exe Token: SeDebugPrivilege 4896 1.exe Token: SeDebugPrivilege 3000 rk916085.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3736 si837878.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3932 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 83 PID 4936 wrote to memory of 3932 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 83 PID 4936 wrote to memory of 3932 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 83 PID 3932 wrote to memory of 4716 3932 un972774.exe 84 PID 3932 wrote to memory of 4716 3932 un972774.exe 84 PID 3932 wrote to memory of 4716 3932 un972774.exe 84 PID 4716 wrote to memory of 2728 4716 un843397.exe 85 PID 4716 wrote to memory of 2728 4716 un843397.exe 85 PID 4716 wrote to memory of 2728 4716 un843397.exe 85 PID 4716 wrote to memory of 4952 4716 un843397.exe 92 PID 4716 wrote to memory of 4952 4716 un843397.exe 92 PID 4716 wrote to memory of 4952 4716 un843397.exe 92 PID 4952 wrote to memory of 4896 4952 qu970123.exe 93 PID 4952 wrote to memory of 4896 4952 qu970123.exe 93 PID 4952 wrote to memory of 4896 4952 qu970123.exe 93 PID 3932 wrote to memory of 3000 3932 un972774.exe 96 PID 3932 wrote to memory of 3000 3932 un972774.exe 96 PID 3932 wrote to memory of 3000 3932 un972774.exe 96 PID 4936 wrote to memory of 3736 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 99 PID 4936 wrote to memory of 3736 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 99 PID 4936 wrote to memory of 3736 4936 21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe 99 PID 3736 wrote to memory of 1432 3736 si837878.exe 121 PID 3736 wrote to memory of 1432 3736 si837878.exe 121 PID 3736 wrote to memory of 1432 3736 si837878.exe 121 PID 1432 wrote to memory of 2436 1432 oneetx.exe 138 PID 1432 wrote to memory of 2436 1432 oneetx.exe 138 PID 1432 wrote to memory of 2436 1432 oneetx.exe 138 PID 1432 wrote to memory of 5028 1432 oneetx.exe 155 PID 1432 wrote to memory of 5028 1432 oneetx.exe 155 PID 1432 wrote to memory of 5028 1432 oneetx.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe"C:\Users\Admin\AppData\Local\Temp\21b6033f89058cadf1ae02f35074316250234dc65c1fe91daa2d02a5664eeae8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un972774.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un972774.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un843397.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un843397.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr587745.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr587745.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 10885⤵
- Program crash
PID:812
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu970123.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu970123.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 13885⤵
- Program crash
PID:4252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk916085.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk916085.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si837878.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si837878.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 7003⤵
- Program crash
PID:4220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 7843⤵
- Program crash
PID:3216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 8603⤵
- Program crash
PID:1652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 9563⤵
- Program crash
PID:4836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 9643⤵
- Program crash
PID:548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 9563⤵
- Program crash
PID:4376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 12243⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 12603⤵
- Program crash
PID:4724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 13283⤵
- Program crash
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 6964⤵
- Program crash
PID:2052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9124⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9164⤵
- Program crash
PID:2116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 10884⤵
- Program crash
PID:1348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 10364⤵
- Program crash
PID:4300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9604⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 11124⤵
- Program crash
PID:276
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 10284⤵
- Program crash
PID:2292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 10204⤵
- Program crash
PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 12804⤵
- Program crash
PID:4600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 7324⤵
- Program crash
PID:3400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 9164⤵
- Program crash
PID:3308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 16044⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 16524⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 16204⤵
- Program crash
PID:1116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 13683⤵
- Program crash
PID:2008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2728 -ip 27281⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4952 -ip 49521⤵PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3736 -ip 37361⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3736 -ip 37361⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3736 -ip 37361⤵PID:860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3736 -ip 37361⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3736 -ip 37361⤵PID:1844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3736 -ip 37361⤵PID:560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3736 -ip 37361⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3736 -ip 37361⤵PID:3420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3736 -ip 37361⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3736 -ip 37361⤵PID:1724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1432 -ip 14321⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1432 -ip 14321⤵PID:2960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1432 -ip 14321⤵PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1432 -ip 14321⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1432 -ip 14321⤵PID:1788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1432 -ip 14321⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1432 -ip 14321⤵PID:772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1432 -ip 14321⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1432 -ip 14321⤵PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1432 -ip 14321⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1432 -ip 14321⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 3162⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1188 -ip 11881⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1432 -ip 14321⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1432 -ip 14321⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1432 -ip 14321⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 3162⤵
- Program crash
PID:2728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3920 -ip 39201⤵PID:412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1432 -ip 14321⤵PID:4724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
394KB
MD503f5bf5bd059a4e73eda0b58a65be05e
SHA110fbe03ddec560b4c7e196dad843e53d77330638
SHA256ff6237ee2c9ecd1ab6d05bb67e90f55f55e14af1c29f6ec3d8f2a1b7cffe82b3
SHA512a927af7020e04438c531755e03cf47b5bf9280e4eb068978a75069fb78366c6a3146cf28dc73d50e2a3b9c2040155693af9d305623662f9f21d4b3cc339c2332
-
Filesize
851KB
MD538417c34b1055aeb2c88a73c647e0b2f
SHA1d6f1d1b9e32b15874c9ddf4b3d2d3de98919fbdc
SHA2564a22d18629be8667955ea966bc33f834f3ede82a3e43f26f1e897967670ff01c
SHA5121194586d32d85320a3fe77bd24dc29b677bd1ad3cbbe41ad6c09d71af317c4e0cf09954072de271cbc1d12faa16a9b478c4e15a0ac040fa6e4cec4573b5edb75
-
Filesize
851KB
MD538417c34b1055aeb2c88a73c647e0b2f
SHA1d6f1d1b9e32b15874c9ddf4b3d2d3de98919fbdc
SHA2564a22d18629be8667955ea966bc33f834f3ede82a3e43f26f1e897967670ff01c
SHA5121194586d32d85320a3fe77bd24dc29b677bd1ad3cbbe41ad6c09d71af317c4e0cf09954072de271cbc1d12faa16a9b478c4e15a0ac040fa6e4cec4573b5edb75
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
168KB
MD5c52ebada00a59ec1f651a0e9fbcef2eb
SHA1e1941278df76616f1ca3202ef2a9f99d2592d52f
SHA25635d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e
SHA5126b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2
-
Filesize
697KB
MD5f49b4fc00ae517e1a63e2ad08e2c41a3
SHA19d93f953417307ac0e32bf1ad97b8fa307a4f0c8
SHA256aa80264f5a2bb3f9615f8c47324fb1bccf255919fa122a92352a846407492fc6
SHA5125583a047944781fb81eab5be8801581e8ed40d6c498e2e125a4d90eef97f5fe53c3d6f449303a9f772fc0e5f50ea1573275fe47d83aa19aa7749ac71e1ed877c
-
Filesize
697KB
MD5f49b4fc00ae517e1a63e2ad08e2c41a3
SHA19d93f953417307ac0e32bf1ad97b8fa307a4f0c8
SHA256aa80264f5a2bb3f9615f8c47324fb1bccf255919fa122a92352a846407492fc6
SHA5125583a047944781fb81eab5be8801581e8ed40d6c498e2e125a4d90eef97f5fe53c3d6f449303a9f772fc0e5f50ea1573275fe47d83aa19aa7749ac71e1ed877c
-
Filesize
403KB
MD526ed2960d5c2ef7e6dd3d937e0268cfa
SHA1e1c62a41073df26dba2564397079eb0f85f59820
SHA256adf5d2c05e7bf34df76c24fef3026fa239ef573757f0bd324bcf7b8a6f9c667c
SHA512061f102612b55e7e846c9cd7563b58dacfd98ce7a504436455ce1e06c43bb75955285ae94d3848505c4d509c44e4e37a7e67705055105e3887998bec7d2c88d9
-
Filesize
403KB
MD526ed2960d5c2ef7e6dd3d937e0268cfa
SHA1e1c62a41073df26dba2564397079eb0f85f59820
SHA256adf5d2c05e7bf34df76c24fef3026fa239ef573757f0bd324bcf7b8a6f9c667c
SHA512061f102612b55e7e846c9cd7563b58dacfd98ce7a504436455ce1e06c43bb75955285ae94d3848505c4d509c44e4e37a7e67705055105e3887998bec7d2c88d9
-
Filesize
586KB
MD54c1827ddd88906d9d9eafd8b3ec6fb49
SHA1ca01ac3c1157d53b6ecaa7ed08fb7075a0d1d8ea
SHA2562a4aca3fe46dac67b016b59f8b6c3135182b43508bccc2b52f7d1457e2ee696a
SHA5127087821b9662ab162b22556c090fed5caa60b641d0c36f2953cdfac58db2126dfc1ab496736cb733665a28f85bb2246942530ee2ec09655b1046d9a45bfdd60b
-
Filesize
586KB
MD54c1827ddd88906d9d9eafd8b3ec6fb49
SHA1ca01ac3c1157d53b6ecaa7ed08fb7075a0d1d8ea
SHA2562a4aca3fe46dac67b016b59f8b6c3135182b43508bccc2b52f7d1457e2ee696a
SHA5127087821b9662ab162b22556c090fed5caa60b641d0c36f2953cdfac58db2126dfc1ab496736cb733665a28f85bb2246942530ee2ec09655b1046d9a45bfdd60b
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1