cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523

Analysis

max time kernel
144s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2023, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe
Size

1.1MB
MD5

e8d3a0a91d1a74b78c7d372f500c3533
SHA1

2554be5b6ec707e04e531b094cb54ebfc7fa23fc
SHA256

cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523
SHA512

30eb1e44ea92e631cd427d837055ce06f2e0514f274ffa14b86b3bc0ba754195755adf34eba89b14e5fde464fb24fa3821ece2f2f592974b33d9843517573856
SSDEEP

24576:6yfNDmKbXlN2H9W4qR5YIwxxUrprjsGGxCg3WRnRMaTp0H:BVDmKD72HagxUJ5GxdGRnWN

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr449324.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr449324.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr449324.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr449324.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr449324.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr449324.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	si846044.exe

Executes dropped EXE 6 IoCs

pid	Process
684	un049933.exe
1300	un377168.exe
1148	pr449324.exe
3536	qu192329.exe
4920	rk706544.exe
4892	si846044.exe

Loads dropped DLL 1 IoCs

pid	Process
3376	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr449324.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr449324.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un049933.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un049933.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un377168.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un377168.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 32 IoCs

pid	pid_target	Process	procid_target
3948	1148	WerFault.exe	84
2224	3536	WerFault.exe	91
1004	4892	WerFault.exe	96
2112	4892	WerFault.exe	96
2604	4892	WerFault.exe	96
4944	4892	WerFault.exe	96
2968	4892	WerFault.exe	96
5100	4892	WerFault.exe	96
4788	4892	WerFault.exe	96
1088	4892	WerFault.exe	96
660	4892	WerFault.exe	96
4896	4892	WerFault.exe	96
316	2380	WerFault.exe	116
3532	2380	WerFault.exe	116
3148	2380	WerFault.exe	116
4280	2380	WerFault.exe	116
4964	2380	WerFault.exe	116
3152	2380	WerFault.exe	116
4144	2380	WerFault.exe	116
4948	2380	WerFault.exe	116
2880	2380	WerFault.exe	116
1644	2380	WerFault.exe	116
4708	2380	WerFault.exe	116
2012	2380	WerFault.exe	116
4344	2380	WerFault.exe	116
1972	2380	WerFault.exe	116
452	2372	WerFault.exe	161
4600	2380	WerFault.exe	116
2280	2380	WerFault.exe	116
4340	2380	WerFault.exe	116
4332	1044	WerFault.exe	171
4596	2380	WerFault.exe	116

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1148	pr449324.exe
1148	pr449324.exe
3536	qu192329.exe
3536	qu192329.exe
4920	rk706544.exe
4920	rk706544.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	pr449324.exe
Token: SeDebugPrivilege	3536	qu192329.exe
Token: SeDebugPrivilege	4920	rk706544.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 684	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	82
PID 1836 wrote to memory of 684	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	82
PID 1836 wrote to memory of 684	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	82
PID 684 wrote to memory of 1300	684	un049933.exe	83
PID 684 wrote to memory of 1300	684	un049933.exe	83
PID 684 wrote to memory of 1300	684	un049933.exe	83
PID 1300 wrote to memory of 1148	1300	un377168.exe	84
PID 1300 wrote to memory of 1148	1300	un377168.exe	84
PID 1300 wrote to memory of 1148	1300	un377168.exe	84
PID 1300 wrote to memory of 3536	1300	un377168.exe	91
PID 1300 wrote to memory of 3536	1300	un377168.exe	91
PID 1300 wrote to memory of 3536	1300	un377168.exe	91
PID 684 wrote to memory of 4920	684	un049933.exe	94
PID 684 wrote to memory of 4920	684	un049933.exe	94
PID 684 wrote to memory of 4920	684	un049933.exe	94
PID 1836 wrote to memory of 4892	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	96
PID 1836 wrote to memory of 4892	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	96
PID 1836 wrote to memory of 4892	1836	cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe	96
PID 2380 wrote to memory of 4632	2380	oneetx.exe	134
PID 2380 wrote to memory of 4632	2380	oneetx.exe	134
PID 2380 wrote to memory of 4632	2380	oneetx.exe	134
PID 2380 wrote to memory of 1212	2380	oneetx.exe	142
PID 2380 wrote to memory of 1212	2380	oneetx.exe	142
PID 2380 wrote to memory of 1212	2380	oneetx.exe	142
PID 1212 wrote to memory of 1712	1212	cmd.exe	146
PID 1212 wrote to memory of 1712	1212	cmd.exe	146
PID 1212 wrote to memory of 1712	1212	cmd.exe	146
PID 1212 wrote to memory of 1268	1212	cmd.exe	147
PID 1212 wrote to memory of 1268	1212	cmd.exe	147
PID 1212 wrote to memory of 1268	1212	cmd.exe	147
PID 1212 wrote to memory of 4888	1212	cmd.exe	148
PID 1212 wrote to memory of 4888	1212	cmd.exe	148
PID 1212 wrote to memory of 4888	1212	cmd.exe	148
PID 1212 wrote to memory of 4728	1212	cmd.exe	149
PID 1212 wrote to memory of 4728	1212	cmd.exe	149
PID 1212 wrote to memory of 4728	1212	cmd.exe	149
PID 1212 wrote to memory of 956	1212	cmd.exe	150
PID 1212 wrote to memory of 956	1212	cmd.exe	150
PID 1212 wrote to memory of 956	1212	cmd.exe	150
PID 1212 wrote to memory of 816	1212	cmd.exe	151
PID 1212 wrote to memory of 816	1212	cmd.exe	151
PID 1212 wrote to memory of 816	1212	cmd.exe	151
PID 2380 wrote to memory of 3376	2380	oneetx.exe	168
PID 2380 wrote to memory of 3376	2380	oneetx.exe	168
PID 2380 wrote to memory of 3376	2380	oneetx.exe	168

C:\Users\Admin\AppData\Local\Temp\cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe
"C:\Users\Admin\AppData\Local\Temp\cb0ddd5775cff1c3a8cfd3912e5bc60e5c9a156cedb00a7f2132824e37599523.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un049933.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un049933.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un377168.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un377168.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr449324.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr449324.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1084
        5⤵
        Program crash
        
        PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu192329.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu192329.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1912
        5⤵
        Program crash
        
        PID:2224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk706544.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk706544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846044.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846044.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 696
    3⤵
    - Program crash
    PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 780
    3⤵
    - Program crash
    PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 856
    3⤵
    - Program crash
    PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 952
    3⤵
    - Program crash
    PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 860
    3⤵
    - Program crash
    PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 860
    3⤵
    - Program crash
    PID:5100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1216
    3⤵
    - Program crash
    PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1260
    3⤵
    - Program crash
    PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1324
    3⤵
    - Program crash
    PID:660
- - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 692
      4⤵
      Program crash
      PID:316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 836
      4⤵
      Program crash
      PID:3532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 912
      4⤵
      Program crash
      PID:3148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1052
      4⤵
      Program crash
      PID:4280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1072
      4⤵
      Program crash
      PID:4964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1072
      4⤵
      Program crash
      PID:3152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1096
      4⤵
      Program crash
      PID:4144
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 992
      4⤵
      Program crash
      PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 924
      4⤵
      Program crash
      PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1712
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:1268
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4888
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        5⤵
        
        PID:956
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        5⤵
        
        PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1304
      4⤵
      Program crash
      PID:1644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 764
      4⤵
      Program crash
      PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 776
      4⤵
      Program crash
      PID:2012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 836
      4⤵
      Program crash
      PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1460
      4⤵
      Program crash
      PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1104
      4⤵
      Program crash
      PID:4600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1632
      4⤵
      Program crash
      PID:2280
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1104
      4⤵
      Program crash
      PID:4340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1652
      4⤵
      Program crash
      PID:4596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1364
    3⤵
    - Program crash
    PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1148 -ip 1148
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3536 -ip 3536
1⤵
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4892 -ip 4892
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4892 -ip 4892
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4892 -ip 4892
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4892 -ip 4892
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4892 -ip 4892
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4892 -ip 4892
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4892 -ip 4892
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4892 -ip 4892
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4892 -ip 4892
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4892 -ip 4892
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2380 -ip 2380
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2380 -ip 2380
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2380 -ip 2380
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2380 -ip 2380
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2380 -ip 2380
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2380 -ip 2380
1⤵
PID:616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2380 -ip 2380
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2380 -ip 2380
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2380 -ip 2380
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2380 -ip 2380
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2380 -ip 2380
1⤵
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2380 -ip 2380
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2380 -ip 2380
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2380 -ip 2380
1⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 312
  2⤵
  - Program crash
  PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2372 -ip 2372
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2380 -ip 2380
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2380 -ip 2380
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2380 -ip 2380
1⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 312
  2⤵
  - Program crash
  PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1044 -ip 1044
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2380 -ip 2380
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si846044.exe

Filesize
382KB

MD5
3e530e673db591c189b1cd85031e348d

SHA1
43785739a819c9b94e6e24efbbe1203215e0dbb0

SHA256
3800ba8e047a5fe5641f3c4c6a6a8fd576397c161a71de06f553988d03a64501

SHA512
5a19bc57a003e73314a3d5a8756cce5799ef227c563ac05eee5fff0dc2d124918add91a0aadf168c49d8eddb48a75544db14a7071ed4fe0978e23ea714dd0d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un049933.exe

Filesize
764KB

MD5
4ab59f49c2fa568d06bba0c06bfbe0ae

SHA1
e9efbcd59184111efa6ef70f5aa0e426060b8ac3

SHA256
8a521d4f339375155acb6cb87f83ffb8666d77a469a9e07c073c39a622767041

SHA512
9befd2cbb8a30654aab99c8884e79d3374ecc3a8788b242d76d96615f15a7ffa0c9eb93e76932cc8b12e2649c577755c07583141ffea381c737f5b4d046e8e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un049933.exe

Filesize
764KB

MD5
4ab59f49c2fa568d06bba0c06bfbe0ae

SHA1
e9efbcd59184111efa6ef70f5aa0e426060b8ac3

SHA256
8a521d4f339375155acb6cb87f83ffb8666d77a469a9e07c073c39a622767041

SHA512
9befd2cbb8a30654aab99c8884e79d3374ecc3a8788b242d76d96615f15a7ffa0c9eb93e76932cc8b12e2649c577755c07583141ffea381c737f5b4d046e8e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk706544.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk706544.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un377168.exe

Filesize
610KB

MD5
8ba79e06c3796d0625e0a68dc68cc9f4

SHA1
727f77473dde60cbb1fb4d6b2dcc589f7b64f4be

SHA256
54edf1552bbeb7b2aa8ba7dc63572db8dda28fb9d05344afd7ad33b1bdbdae7f

SHA512
d8ce73c0526f829af52112b9cf57ef447188b3750f4cfaf66cf88496500f93a814f4a511afabeabdf78ea67b56f344c45e64615e89d5bc8002dd3896423b6822

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un377168.exe

Filesize
610KB

MD5
8ba79e06c3796d0625e0a68dc68cc9f4

SHA1
727f77473dde60cbb1fb4d6b2dcc589f7b64f4be

SHA256
54edf1552bbeb7b2aa8ba7dc63572db8dda28fb9d05344afd7ad33b1bdbdae7f

SHA512
d8ce73c0526f829af52112b9cf57ef447188b3750f4cfaf66cf88496500f93a814f4a511afabeabdf78ea67b56f344c45e64615e89d5bc8002dd3896423b6822

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr449324.exe

Filesize
403KB

MD5
1362b992db8f3f5b0ae3ef8bd4e6b109

SHA1
8a750403630da9464ae7369d4d1d79671d9b97f9

SHA256
0292c61a96888a1af70a75d8d666d7840863fb5b92e1d090e9b36addbc4eea60

SHA512
c6072c6b74d1dee593b00555f7d9b1016b7798cc01c578386828c8c4579ede22d32f58f0584a2a165592445f1059924c1313dd808ae8e34c50ed453722fbac26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr449324.exe

Filesize
403KB

MD5
1362b992db8f3f5b0ae3ef8bd4e6b109

SHA1
8a750403630da9464ae7369d4d1d79671d9b97f9

SHA256
0292c61a96888a1af70a75d8d666d7840863fb5b92e1d090e9b36addbc4eea60

SHA512
c6072c6b74d1dee593b00555f7d9b1016b7798cc01c578386828c8c4579ede22d32f58f0584a2a165592445f1059924c1313dd808ae8e34c50ed453722fbac26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu192329.exe

Filesize
486KB

MD5
a7d443249a3f113efbc438eb54fe7dcb

SHA1
9fe032a9176bb1c353efe7ad4d4f943fa1969aea

SHA256
0ec5621de9a722aaaaede8538bd58eac256ee45528deb4d0723127df5124c409

SHA512
0cd39ab700c0bb55d6f9daa50d2a28f25b2cdae188183084007713d6e73e4eb1c87ccd8a7dd1d86d108541bc7a01c7e5c9c819d06f46de389d42e779abd8599c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu192329.exe

Filesize
486KB

MD5
a7d443249a3f113efbc438eb54fe7dcb

SHA1
9fe032a9176bb1c353efe7ad4d4f943fa1969aea

SHA256
0ec5621de9a722aaaaede8538bd58eac256ee45528deb4d0723127df5124c409

SHA512
0cd39ab700c0bb55d6f9daa50d2a28f25b2cdae188183084007713d6e73e4eb1c87ccd8a7dd1d86d108541bc7a01c7e5c9c819d06f46de389d42e779abd8599c

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1148-170-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-186-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-164-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-166-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-168-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-160-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-172-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-174-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-176-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-178-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-180-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-182-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-184-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-162-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-187-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1148-188-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1148-189-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1148-190-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1148-192-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/1148-159-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/1148-158-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1148-157-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/1148-156-0x0000000000A70000-0x0000000000A9D000-memory.dmp

Filesize
180KB

Download
memory/1148-155-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/2380-1021-0x0000000000AA0000-0x0000000000AD5000-memory.dmp

Filesize
212KB

Download
memory/3536-206-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-994-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/3536-202-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-212-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-210-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3536-214-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-216-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-218-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-220-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-222-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-224-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-226-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-228-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-230-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-232-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-234-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-993-0x0000000007950000-0x0000000007F68000-memory.dmp

Filesize
6.1MB

Download
memory/3536-205-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3536-995-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/3536-996-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/3536-997-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3536-998-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/3536-999-0x0000000008A70000-0x0000000008B02000-memory.dmp

Filesize
584KB

Download
memory/3536-1000-0x0000000008B30000-0x0000000008BA6000-memory.dmp

Filesize
472KB

Download
memory/3536-1001-0x0000000008BE0000-0x0000000008BFE000-memory.dmp

Filesize
120KB

Download
memory/3536-1002-0x0000000008C70000-0x0000000008CC0000-memory.dmp

Filesize
320KB

Download
memory/3536-1003-0x0000000008E00000-0x0000000008FC2000-memory.dmp

Filesize
1.8MB

Download
memory/3536-1004-0x0000000008FE0000-0x000000000950C000-memory.dmp

Filesize
5.2MB

Download
memory/3536-197-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-198-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-209-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/3536-207-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3536-203-0x0000000002460000-0x00000000024A6000-memory.dmp

Filesize
280KB

Download
memory/3536-200-0x0000000004DF0000-0x0000000004E25000-memory.dmp

Filesize
212KB

Download
memory/4920-1011-0x00000000077D0000-0x00000000077E0000-memory.dmp

Filesize
64KB

Download
memory/4920-1010-0x0000000000990000-0x00000000009B8000-memory.dmp

Filesize
160KB

Download