Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2023, 21:21
Static task
static1
General
-
Target
7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe
-
Size
981KB
-
MD5
5f2497db5ad1a6686ff59f3c87ef9013
-
SHA1
6337267e194af7cf61c5625698e4623ee129696a
-
SHA256
7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6
-
SHA512
637aeae88a305f96d56303be5fb9afd92d694d172c07bc442146217e7d27bc6135286ffc76f03c3037361b2c19fceca844ad4bc4b7eef7b8e33ad403f6e1b264
-
SSDEEP
24576:LyoX9IHmUAl45on8yQVze0VMQ7xU1XgexYMq1chV:+8eHmFsW5QZe056eeb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr770907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr770907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr770907.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr770907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr770907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr770907.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation si775372.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2916 un917377.exe 1148 un697378.exe 1868 pr770907.exe 5024 qu031147.exe 932 rk779130.exe 3316 si775372.exe 352 oneetx.exe 4404 oneetx.exe 2716 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2876 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr770907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr770907.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un917377.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un917377.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un697378.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un697378.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3084 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 2904 1868 WerFault.exe 87 2348 5024 WerFault.exe 93 724 3316 WerFault.exe 98 3920 3316 WerFault.exe 98 636 3316 WerFault.exe 98 1876 3316 WerFault.exe 98 4212 3316 WerFault.exe 98 2372 3316 WerFault.exe 98 764 3316 WerFault.exe 98 2544 3316 WerFault.exe 98 1680 3316 WerFault.exe 98 4180 3316 WerFault.exe 98 4676 352 WerFault.exe 117 2600 352 WerFault.exe 117 3776 352 WerFault.exe 117 1868 352 WerFault.exe 117 4660 352 WerFault.exe 117 3788 352 WerFault.exe 117 1508 352 WerFault.exe 117 752 352 WerFault.exe 117 1296 352 WerFault.exe 117 3668 352 WerFault.exe 117 1148 352 WerFault.exe 117 1412 352 WerFault.exe 117 4664 4404 WerFault.exe 150 2236 352 WerFault.exe 117 508 352 WerFault.exe 117 4076 352 WerFault.exe 117 3684 2716 WerFault.exe 160 4620 352 WerFault.exe 117 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3364 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1868 pr770907.exe 1868 pr770907.exe 5024 qu031147.exe 5024 qu031147.exe 932 rk779130.exe 932 rk779130.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1868 pr770907.exe Token: SeDebugPrivilege 5024 qu031147.exe Token: SeDebugPrivilege 932 rk779130.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3316 si775372.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 5036 wrote to memory of 2916 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 85 PID 5036 wrote to memory of 2916 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 85 PID 5036 wrote to memory of 2916 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 85 PID 2916 wrote to memory of 1148 2916 un917377.exe 86 PID 2916 wrote to memory of 1148 2916 un917377.exe 86 PID 2916 wrote to memory of 1148 2916 un917377.exe 86 PID 1148 wrote to memory of 1868 1148 un697378.exe 87 PID 1148 wrote to memory of 1868 1148 un697378.exe 87 PID 1148 wrote to memory of 1868 1148 un697378.exe 87 PID 1148 wrote to memory of 5024 1148 un697378.exe 93 PID 1148 wrote to memory of 5024 1148 un697378.exe 93 PID 1148 wrote to memory of 5024 1148 un697378.exe 93 PID 2916 wrote to memory of 932 2916 un917377.exe 96 PID 2916 wrote to memory of 932 2916 un917377.exe 96 PID 2916 wrote to memory of 932 2916 un917377.exe 96 PID 5036 wrote to memory of 3316 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 98 PID 5036 wrote to memory of 3316 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 98 PID 5036 wrote to memory of 3316 5036 7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe 98 PID 3316 wrote to memory of 352 3316 si775372.exe 117 PID 3316 wrote to memory of 352 3316 si775372.exe 117 PID 3316 wrote to memory of 352 3316 si775372.exe 117 PID 352 wrote to memory of 3364 352 oneetx.exe 137 PID 352 wrote to memory of 3364 352 oneetx.exe 137 PID 352 wrote to memory of 3364 352 oneetx.exe 137 PID 352 wrote to memory of 2876 352 oneetx.exe 157 PID 352 wrote to memory of 2876 352 oneetx.exe 157 PID 352 wrote to memory of 2876 352 oneetx.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe"C:\Users\Admin\AppData\Local\Temp\7674aeb3f388d96bf9740d878828db34ba531d1c568257cf1d98f7b7bd3dd5b6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un917377.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un917377.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un697378.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un697378.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr770907.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr770907.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 10845⤵
- Program crash
PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu031147.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu031147.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 13285⤵
- Program crash
PID:2348
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk779130.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk779130.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si775372.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si775372.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 7123⤵
- Program crash
PID:724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 7963⤵
- Program crash
PID:3920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 8203⤵
- Program crash
PID:636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 9563⤵
- Program crash
PID:1876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 8203⤵
- Program crash
PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 8203⤵
- Program crash
PID:2372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 12243⤵
- Program crash
PID:764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 12363⤵
- Program crash
PID:2544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 13203⤵
- Program crash
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 7084⤵
- Program crash
PID:4676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 7964⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 8404⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 10564⤵
- Program crash
PID:1868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 10924⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 10924⤵
- Program crash
PID:3788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 11124⤵
- Program crash
PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 9964⤵
- Program crash
PID:752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 13244⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 13324⤵
- Program crash
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 7124⤵
- Program crash
PID:1148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 14404⤵
- Program crash
PID:1412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 10884⤵
- Program crash
PID:2236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 16284⤵
- Program crash
PID:508
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 10884⤵
- Program crash
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 16444⤵
- Program crash
PID:4620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 7603⤵
- Program crash
PID:4180
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1868 -ip 18681⤵PID:4124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5024 -ip 50241⤵PID:3420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3316 -ip 33161⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3316 -ip 33161⤵PID:3412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3316 -ip 33161⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3316 -ip 33161⤵PID:4268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3316 -ip 33161⤵PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3316 -ip 33161⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3316 -ip 33161⤵PID:508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3316 -ip 33161⤵PID:828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3316 -ip 33161⤵PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3316 -ip 33161⤵PID:1340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 352 -ip 3521⤵PID:532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 352 -ip 3521⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 352 -ip 3521⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 352 -ip 3521⤵PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 352 -ip 3521⤵PID:2892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 352 -ip 3521⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 352 -ip 3521⤵PID:452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 352 -ip 3521⤵PID:3180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 352 -ip 3521⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 352 -ip 3521⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 352 -ip 3521⤵PID:5024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 352 -ip 3521⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 4242⤵
- Program crash
PID:4664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4404 -ip 44041⤵PID:4108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 352 -ip 3521⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 352 -ip 3521⤵PID:2276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 352 -ip 3521⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 4242⤵
- Program crash
PID:3684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2716 -ip 27161⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 352 -ip 3521⤵PID:1544
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
246KB
MD5d2705d3d7f8598985e026b7466e6a150
SHA1a7803b66d9ae5b0e261dbceda49949bef2a357c1
SHA256279edcd52f4faef12fe808ae86ebfc33e9fd82f5a2ffc7033d913805bec10117
SHA512dc0176053f74a2db539ac171ef6a9352b56692387dc3531acb69467e0fb81bb4b249e69eb760c90a67ce3e3ed9489e3893d13316702a43777d8cc10623668ff4
-
Filesize
707KB
MD5235edf9d285fca2649667b33dca0bf50
SHA1d13aa4c101debf7ce3cd71c8d7f0a8cd81ada1c4
SHA2563816d6c272454490947071f4ed41bfd49f56e057a53b0ed0a21e059d509362fb
SHA5122dd52a40cc5913b94f4368710fee646a1866bbb9e32d51e71500358b9bcd4437fdf7ed1a10e33b87dbdf9de852407e02ee24ce940f11d9ec8164de805af274cd
-
Filesize
707KB
MD5235edf9d285fca2649667b33dca0bf50
SHA1d13aa4c101debf7ce3cd71c8d7f0a8cd81ada1c4
SHA2563816d6c272454490947071f4ed41bfd49f56e057a53b0ed0a21e059d509362fb
SHA5122dd52a40cc5913b94f4368710fee646a1866bbb9e32d51e71500358b9bcd4437fdf7ed1a10e33b87dbdf9de852407e02ee24ce940f11d9ec8164de805af274cd
-
Filesize
136KB
MD5359db2338ae0f977dcf10e90cf9816fb
SHA194126cb670e5f434e555c991c967e0ee98fae552
SHA2565f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc
SHA512d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc
-
Filesize
136KB
MD5359db2338ae0f977dcf10e90cf9816fb
SHA194126cb670e5f434e555c991c967e0ee98fae552
SHA2565f9eff953d7ca49f594a864517dfdf37950a41693e53b79aa3a5c396613031bc
SHA512d2202c1f9dfe7c18993b834f3ccb34e9436c4bf814aca1ed38941ad41a4cf8326dda767389a5e39e64de74aacf76845464fdee73b61a926a1622a33c87382dbc
-
Filesize
553KB
MD534cbda5e55074e309c9c53f422438bc1
SHA19e5eabb712ed2433297a4b342c3830201632ed45
SHA2561bef586a85238678a5d2458ddf571628922b877a465c2832941fcb28981247f8
SHA51288f0c6fd72ba66f35f797d1d19fbc2303c6da5cb99d06e52a91a6e7e22d1be11493772f76be4c20bf42a20cdc74d93827af79eb77edec5db0715d09d04938dbd
-
Filesize
553KB
MD534cbda5e55074e309c9c53f422438bc1
SHA19e5eabb712ed2433297a4b342c3830201632ed45
SHA2561bef586a85238678a5d2458ddf571628922b877a465c2832941fcb28981247f8
SHA51288f0c6fd72ba66f35f797d1d19fbc2303c6da5cb99d06e52a91a6e7e22d1be11493772f76be4c20bf42a20cdc74d93827af79eb77edec5db0715d09d04938dbd
-
Filesize
254KB
MD506db38aabdcf2a5b37744986b060ecd2
SHA1fdc341eaf0e55b2f954a7a75fcbba8fe863ae4fa
SHA2569182b520c91f824c6474adfe438fef903b8c5ee351c392e33dae799c4336166f
SHA5128c004ac2464206a4e74a144a13513005f898b00c5d6b958f1bdad277910a8988d00d39c724e700dfff3d64a0cd6147fe6236417b3b59c70b4df25661291e7f92
-
Filesize
254KB
MD506db38aabdcf2a5b37744986b060ecd2
SHA1fdc341eaf0e55b2f954a7a75fcbba8fe863ae4fa
SHA2569182b520c91f824c6474adfe438fef903b8c5ee351c392e33dae799c4336166f
SHA5128c004ac2464206a4e74a144a13513005f898b00c5d6b958f1bdad277910a8988d00d39c724e700dfff3d64a0cd6147fe6236417b3b59c70b4df25661291e7f92
-
Filesize
337KB
MD5f74b6850f6abb0848b431a970d1da3e5
SHA13119a9cef323f9d6abd8f4e74bbcf1d2a0808d53
SHA2567017168dc25b308a44872f30c268d5403293d723134ccbc45ba99e9362f18044
SHA512b797c58213e7e87fb9774454b2ad6f0d6150c09fe4d50479f7595733cbcca4006625f97c35f0c57fbe39ff46b4504a548385becb99ea3d355bd91dfdb77ced83
-
Filesize
337KB
MD5f74b6850f6abb0848b431a970d1da3e5
SHA13119a9cef323f9d6abd8f4e74bbcf1d2a0808d53
SHA2567017168dc25b308a44872f30c268d5403293d723134ccbc45ba99e9362f18044
SHA512b797c58213e7e87fb9774454b2ad6f0d6150c09fe4d50479f7595733cbcca4006625f97c35f0c57fbe39ff46b4504a548385becb99ea3d355bd91dfdb77ced83
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5