Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2023, 11:02
Static task
static1
General
-
Target
6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe
-
Size
1.1MB
-
MD5
a96dfa7be7f331d373c47be877f61824
-
SHA1
aae2e7da7361c08fda17cae254373652972fff8a
-
SHA256
6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0
-
SHA512
d789dabceb2360af5a4ae8abdc753b986a21ced21195c9cc058ce38a44ac04631f7d110c2473e258c8f335946965325192dba43a25fb3402d49eb8949f64db67
-
SSDEEP
24576:tymNGaE56IFTZFKUroKuM3rNJ1ejqKp6akg37chLMDtB7S:IW4/NOUMnGejJp6aGde
Malware Config
Extracted
redline
lada
185.161.248.90:4125
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
redline
diro
185.161.248.90:4125
-
auth_value
ae95bda0dd2e95169886a3a68138568b
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr478950.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation qu008673.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si771996.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 10 IoCs
pid Process 840 un265952.exe 2316 un012339.exe 1724 pr478950.exe 3468 qu008673.exe 3156 1.exe 1252 rk700134.exe 3064 si771996.exe 3688 oneetx.exe 4704 oneetx.exe 4252 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1512 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr478950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr478950.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un012339.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un012339.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un265952.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un265952.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 2264 1724 WerFault.exe 85 3600 3468 WerFault.exe 91 2224 3064 WerFault.exe 97 3016 3064 WerFault.exe 97 3012 3064 WerFault.exe 97 4348 3064 WerFault.exe 97 4840 3064 WerFault.exe 97 4244 3064 WerFault.exe 97 3968 3064 WerFault.exe 97 2828 3064 WerFault.exe 97 4216 3064 WerFault.exe 97 4396 3064 WerFault.exe 97 3148 3688 WerFault.exe 118 3696 3688 WerFault.exe 118 2560 3688 WerFault.exe 118 2148 3688 WerFault.exe 118 4496 3688 WerFault.exe 118 3224 3688 WerFault.exe 118 3200 3688 WerFault.exe 118 2620 3688 WerFault.exe 118 2472 3688 WerFault.exe 118 3784 3688 WerFault.exe 118 3664 3688 WerFault.exe 118 1252 4704 WerFault.exe 147 1124 3688 WerFault.exe 118 4288 3688 WerFault.exe 118 4456 3688 WerFault.exe 118 3108 4252 WerFault.exe 157 4488 3688 WerFault.exe 118 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 396 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1724 pr478950.exe 1724 pr478950.exe 3156 1.exe 1252 rk700134.exe 3156 1.exe 1252 rk700134.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1724 pr478950.exe Token: SeDebugPrivilege 3468 qu008673.exe Token: SeDebugPrivilege 3156 1.exe Token: SeDebugPrivilege 1252 rk700134.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3064 si771996.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2072 wrote to memory of 840 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 83 PID 2072 wrote to memory of 840 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 83 PID 2072 wrote to memory of 840 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 83 PID 840 wrote to memory of 2316 840 un265952.exe 84 PID 840 wrote to memory of 2316 840 un265952.exe 84 PID 840 wrote to memory of 2316 840 un265952.exe 84 PID 2316 wrote to memory of 1724 2316 un012339.exe 85 PID 2316 wrote to memory of 1724 2316 un012339.exe 85 PID 2316 wrote to memory of 1724 2316 un012339.exe 85 PID 2316 wrote to memory of 3468 2316 un012339.exe 91 PID 2316 wrote to memory of 3468 2316 un012339.exe 91 PID 2316 wrote to memory of 3468 2316 un012339.exe 91 PID 3468 wrote to memory of 3156 3468 qu008673.exe 92 PID 3468 wrote to memory of 3156 3468 qu008673.exe 92 PID 3468 wrote to memory of 3156 3468 qu008673.exe 92 PID 840 wrote to memory of 1252 840 un265952.exe 95 PID 840 wrote to memory of 1252 840 un265952.exe 95 PID 840 wrote to memory of 1252 840 un265952.exe 95 PID 2072 wrote to memory of 3064 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 97 PID 2072 wrote to memory of 3064 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 97 PID 2072 wrote to memory of 3064 2072 6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe 97 PID 3064 wrote to memory of 3688 3064 si771996.exe 118 PID 3064 wrote to memory of 3688 3064 si771996.exe 118 PID 3064 wrote to memory of 3688 3064 si771996.exe 118 PID 3688 wrote to memory of 396 3688 oneetx.exe 137 PID 3688 wrote to memory of 396 3688 oneetx.exe 137 PID 3688 wrote to memory of 396 3688 oneetx.exe 137 PID 3688 wrote to memory of 1512 3688 oneetx.exe 154 PID 3688 wrote to memory of 1512 3688 oneetx.exe 154 PID 3688 wrote to memory of 1512 3688 oneetx.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe"C:\Users\Admin\AppData\Local\Temp\6b01a6ef5d2dafc2fe58f38ad3d05a70575ebaa3bee0956fefffddd35beb77d0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un265952.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un012339.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr478950.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 10845⤵
- Program crash
PID:2264
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu008673.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 13805⤵
- Program crash
PID:3600
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk700134.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si771996.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 6963⤵
- Program crash
PID:2224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 7803⤵
- Program crash
PID:3016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 8563⤵
- Program crash
PID:3012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 9603⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 8683⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 9803⤵
- Program crash
PID:4244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 12043⤵
- Program crash
PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 12043⤵
- Program crash
PID:2828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 13123⤵
- Program crash
PID:4216
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 6924⤵
- Program crash
PID:3148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 8284⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 8764⤵
- Program crash
PID:2560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 10524⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 10604⤵
- Program crash
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 10604⤵
- Program crash
PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 11204⤵
- Program crash
PID:3200
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 9924⤵
- Program crash
PID:2620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 7764⤵
- Program crash
PID:2472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 7284⤵
- Program crash
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 12724⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 10804⤵
- Program crash
PID:1124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 15644⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 11444⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 16364⤵
- Program crash
PID:4488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 14123⤵
- Program crash
PID:4396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1724 -ip 17241⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3468 -ip 34681⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3064 -ip 30641⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 30641⤵PID:4176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3064 -ip 30641⤵PID:1488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3064 -ip 30641⤵PID:1512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 30641⤵PID:4892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3064 -ip 30641⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3064 -ip 30641⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3064 -ip 30641⤵PID:4488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3064 -ip 30641⤵PID:2628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3064 -ip 30641⤵PID:1364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3688 -ip 36881⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3688 -ip 36881⤵PID:3756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3688 -ip 36881⤵PID:1220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3688 -ip 36881⤵PID:2492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3688 -ip 36881⤵PID:2140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3688 -ip 36881⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3688 -ip 36881⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 36881⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3688 -ip 36881⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3688 -ip 36881⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3688 -ip 36881⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 3122⤵
- Program crash
PID:1252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4704 -ip 47041⤵PID:1868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3688 -ip 36881⤵PID:508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 36881⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3688 -ip 36881⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 3122⤵
- Program crash
PID:3108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4252 -ip 42521⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3688 -ip 36881⤵PID:1440
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
253KB
MD51c4b687ff7f7f7b8b0d0a3b1bf2cd568
SHA1442fd0c94a574490bdec94a7a8c05e231205f530
SHA256255002c9fb43a706b143e5dfd912af265387f63ad21df64b837bb0366f713932
SHA5122e6079407ed488523c1ed71aeb1224a9a5da750e671dcb1c2410e4a0e3cb4e326d2ced4b9a0269fbf77120d51910d7a0de81d523db3878115e5bb91d97f8b550
-
Filesize
807KB
MD56bd72bbcaf55179727fa2e354c48fd31
SHA183050f1f687164f9055ea9118534a19b8c030298
SHA2562a011d6cddc56f15fbdc671ecac1e7ec09549af34ac544fb455a719b2019cdc9
SHA5128a108e9f383e0a0d8322cdaf75a3f9b3e65b450d1c039b35ba8f6037e93b57574e9b24714d0b0db805ba71e72c45f001b791e1d72f1e2840ec4d195035e1be89
-
Filesize
807KB
MD56bd72bbcaf55179727fa2e354c48fd31
SHA183050f1f687164f9055ea9118534a19b8c030298
SHA2562a011d6cddc56f15fbdc671ecac1e7ec09549af34ac544fb455a719b2019cdc9
SHA5128a108e9f383e0a0d8322cdaf75a3f9b3e65b450d1c039b35ba8f6037e93b57574e9b24714d0b0db805ba71e72c45f001b791e1d72f1e2840ec4d195035e1be89
-
Filesize
168KB
MD5696bf18686dec69626a25fdd50e8988c
SHA1d19c4d20bf55bd7919342330ab4508fc54dba0d9
SHA25602a4ce8d44f7b99a7fcf3c01761d66088d746a5794e27e1a9cae6302f985108c
SHA512aafc2992fc8f70e74da96f0946050b219938f08b1820567b7664e4d51b066282652fcf9b32e567fb60c20e44b723210c2d883d12d88c6d1adf426ed312794f55
-
Filesize
168KB
MD5696bf18686dec69626a25fdd50e8988c
SHA1d19c4d20bf55bd7919342330ab4508fc54dba0d9
SHA25602a4ce8d44f7b99a7fcf3c01761d66088d746a5794e27e1a9cae6302f985108c
SHA512aafc2992fc8f70e74da96f0946050b219938f08b1820567b7664e4d51b066282652fcf9b32e567fb60c20e44b723210c2d883d12d88c6d1adf426ed312794f55
-
Filesize
653KB
MD536aefed915b8fda610b5494c0af1302b
SHA1d80c19828a7ab867ed362625afdac7de36fe91a5
SHA2569a752e53bb82b0101cbde8e1f46a28019ea8ada2d97ab2097578038f5fcddcc4
SHA512763010a1d1c4448cf5bb18570d967765b2288d20549396fb236c6be276955890cb18883830a95efa2189f64e8d34044c49297f8ae3dbc50f5aeed13a0c70fccc
-
Filesize
653KB
MD536aefed915b8fda610b5494c0af1302b
SHA1d80c19828a7ab867ed362625afdac7de36fe91a5
SHA2569a752e53bb82b0101cbde8e1f46a28019ea8ada2d97ab2097578038f5fcddcc4
SHA512763010a1d1c4448cf5bb18570d967765b2288d20549396fb236c6be276955890cb18883830a95efa2189f64e8d34044c49297f8ae3dbc50f5aeed13a0c70fccc
-
Filesize
262KB
MD54add0b2c188b70f959cb924cabd54d76
SHA167d7b243717b9dc40459ae3c80f81ef283cc07b4
SHA25603e850143d3408de50b1f4a6c18623942315b936672a154c9a7c3bb2f314eec9
SHA5121b121196f725e62f642c911312b236c6ae9c9767c8f010c3dd48019a361ad7b575582d6b037ea0ee84e7a4b5c4e06465e9bfb377debd41171b63b06bbe0657a8
-
Filesize
262KB
MD54add0b2c188b70f959cb924cabd54d76
SHA167d7b243717b9dc40459ae3c80f81ef283cc07b4
SHA25603e850143d3408de50b1f4a6c18623942315b936672a154c9a7c3bb2f314eec9
SHA5121b121196f725e62f642c911312b236c6ae9c9767c8f010c3dd48019a361ad7b575582d6b037ea0ee84e7a4b5c4e06465e9bfb377debd41171b63b06bbe0657a8
-
Filesize
445KB
MD5ad09ead49cb3077017ce06fbe5fcd57f
SHA1e78d1811365a524d3ea9d92c991baf777c061916
SHA2565030902c98382910a8fa52854c8b738be7e264d03e0ae661afbfaac26f74ae85
SHA512230f95846bcf40a902f82d8ef62e41e07ef0321c76aee9442ad199f10061f7caeb2c2ffafc4d3a915ca8633f416a715b02412f622687451a01656b030e1db38f
-
Filesize
445KB
MD5ad09ead49cb3077017ce06fbe5fcd57f
SHA1e78d1811365a524d3ea9d92c991baf777c061916
SHA2565030902c98382910a8fa52854c8b738be7e264d03e0ae661afbfaac26f74ae85
SHA512230f95846bcf40a902f82d8ef62e41e07ef0321c76aee9442ad199f10061f7caeb2c2ffafc4d3a915ca8633f416a715b02412f622687451a01656b030e1db38f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1
-
Filesize
168KB
MD503728fed675bcde5256342183b1d6f27
SHA1d13eace7d3d92f93756504b274777cc269b222a2
SHA256f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0
SHA5126e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1