Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2023, 21:12
Static task
static1
General
-
Target
1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe
-
Size
1.1MB
-
MD5
70394b39725fe20048e28fcda745cc25
-
SHA1
01c2cb92ece92a4c67f81bcd0577c491db6088bc
-
SHA256
1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626
-
SHA512
589dd92cbde8c680825a5a85604b18c1b1d803a7581d5e2fa474f6080160ea014e32c4bc73728661570882c89a6bf3f551bab54a5341e0e7c9029902a4a0240b
-
SSDEEP
24576:ByehACgqkGkms1rwRVTTRx/MB/WkB6o2POydYG:0ehARqkGuCPTlx/cc1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr454888.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si742803.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 3716 un450732.exe 3588 un190058.exe 2228 pr454888.exe 3516 qu335725.exe 1572 rk268300.exe 320 si742803.exe 1260 oneetx.exe 4968 oneetx.exe 1532 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4892 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr454888.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr454888.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un450732.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un450732.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un190058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un190058.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 32 IoCs
pid pid_target Process procid_target 1276 2228 WerFault.exe 81 4184 3516 WerFault.exe 89 116 320 WerFault.exe 93 3368 320 WerFault.exe 93 4492 320 WerFault.exe 93 1912 320 WerFault.exe 93 3440 320 WerFault.exe 93 5060 320 WerFault.exe 93 1536 320 WerFault.exe 93 5016 320 WerFault.exe 93 3560 320 WerFault.exe 93 1440 320 WerFault.exe 93 2076 1260 WerFault.exe 113 1560 1260 WerFault.exe 113 3808 1260 WerFault.exe 113 2112 1260 WerFault.exe 113 4496 1260 WerFault.exe 113 4776 1260 WerFault.exe 113 868 1260 WerFault.exe 113 5096 1260 WerFault.exe 113 3080 1260 WerFault.exe 113 2804 1260 WerFault.exe 113 1872 1260 WerFault.exe 113 3652 1260 WerFault.exe 113 264 1260 WerFault.exe 113 1096 4968 WerFault.exe 156 4272 1260 WerFault.exe 113 1172 1260 WerFault.exe 113 1804 1260 WerFault.exe 113 3564 1260 WerFault.exe 113 2128 1260 WerFault.exe 113 2252 1532 WerFault.exe 170 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1380 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2228 pr454888.exe 2228 pr454888.exe 3516 qu335725.exe 3516 qu335725.exe 1572 rk268300.exe 1572 rk268300.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2228 pr454888.exe Token: SeDebugPrivilege 3516 qu335725.exe Token: SeDebugPrivilege 1572 rk268300.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 320 si742803.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3760 wrote to memory of 3716 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 79 PID 3760 wrote to memory of 3716 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 79 PID 3760 wrote to memory of 3716 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 79 PID 3716 wrote to memory of 3588 3716 un450732.exe 80 PID 3716 wrote to memory of 3588 3716 un450732.exe 80 PID 3716 wrote to memory of 3588 3716 un450732.exe 80 PID 3588 wrote to memory of 2228 3588 un190058.exe 81 PID 3588 wrote to memory of 2228 3588 un190058.exe 81 PID 3588 wrote to memory of 2228 3588 un190058.exe 81 PID 3588 wrote to memory of 3516 3588 un190058.exe 89 PID 3588 wrote to memory of 3516 3588 un190058.exe 89 PID 3588 wrote to memory of 3516 3588 un190058.exe 89 PID 3716 wrote to memory of 1572 3716 un450732.exe 92 PID 3716 wrote to memory of 1572 3716 un450732.exe 92 PID 3716 wrote to memory of 1572 3716 un450732.exe 92 PID 3760 wrote to memory of 320 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 93 PID 3760 wrote to memory of 320 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 93 PID 3760 wrote to memory of 320 3760 1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe 93 PID 320 wrote to memory of 1260 320 si742803.exe 113 PID 320 wrote to memory of 1260 320 si742803.exe 113 PID 320 wrote to memory of 1260 320 si742803.exe 113 PID 1260 wrote to memory of 1380 1260 oneetx.exe 131 PID 1260 wrote to memory of 1380 1260 oneetx.exe 131 PID 1260 wrote to memory of 1380 1260 oneetx.exe 131 PID 1260 wrote to memory of 1312 1260 oneetx.exe 137 PID 1260 wrote to memory of 1312 1260 oneetx.exe 137 PID 1260 wrote to memory of 1312 1260 oneetx.exe 137 PID 1312 wrote to memory of 4612 1312 cmd.exe 141 PID 1312 wrote to memory of 4612 1312 cmd.exe 141 PID 1312 wrote to memory of 4612 1312 cmd.exe 141 PID 1312 wrote to memory of 4660 1312 cmd.exe 142 PID 1312 wrote to memory of 4660 1312 cmd.exe 142 PID 1312 wrote to memory of 4660 1312 cmd.exe 142 PID 1312 wrote to memory of 1044 1312 cmd.exe 144 PID 1312 wrote to memory of 1044 1312 cmd.exe 144 PID 1312 wrote to memory of 1044 1312 cmd.exe 144 PID 1312 wrote to memory of 4348 1312 cmd.exe 145 PID 1312 wrote to memory of 4348 1312 cmd.exe 145 PID 1312 wrote to memory of 4348 1312 cmd.exe 145 PID 1312 wrote to memory of 1844 1312 cmd.exe 146 PID 1312 wrote to memory of 1844 1312 cmd.exe 146 PID 1312 wrote to memory of 1844 1312 cmd.exe 146 PID 1312 wrote to memory of 680 1312 cmd.exe 148 PID 1312 wrote to memory of 680 1312 cmd.exe 148 PID 1312 wrote to memory of 680 1312 cmd.exe 148 PID 1260 wrote to memory of 4892 1260 oneetx.exe 165 PID 1260 wrote to memory of 4892 1260 oneetx.exe 165 PID 1260 wrote to memory of 4892 1260 oneetx.exe 165
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe"C:\Users\Admin\AppData\Local\Temp\1dd167629476f821f572c29ac69344608acebc9381918592c3c72c69833dd626.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un450732.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un450732.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un190058.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un190058.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr454888.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr454888.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 10805⤵
- Program crash
PID:1276
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu335725.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu335725.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 17365⤵
- Program crash
PID:4184
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk268300.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk268300.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si742803.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si742803.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 6963⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 7803⤵
- Program crash
PID:3368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 8563⤵
- Program crash
PID:4492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 9603⤵
- Program crash
PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 8683⤵
- Program crash
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 9923⤵
- Program crash
PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 12203⤵
- Program crash
PID:1536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 12443⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 12923⤵
- Program crash
PID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 6924⤵
- Program crash
PID:2076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 8484⤵
- Program crash
PID:1560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 8964⤵
- Program crash
PID:3808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 10524⤵
- Program crash
PID:2112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 10964⤵
- Program crash
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 11164⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 10724⤵
- Program crash
PID:868
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 10084⤵
- Program crash
PID:5096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 8644⤵
- Program crash
PID:3080
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4612
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4660
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4348
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:1844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 7764⤵
- Program crash
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 7564⤵
- Program crash
PID:1872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 13044⤵
- Program crash
PID:3652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 13564⤵
- Program crash
PID:264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 11124⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 15564⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 16324⤵
- Program crash
PID:1804
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 10964⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 16484⤵
- Program crash
PID:2128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 7483⤵
- Program crash
PID:1440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2228 -ip 22281⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3516 -ip 35161⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 320 -ip 3201⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 320 -ip 3201⤵PID:2472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 320 -ip 3201⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 320 -ip 3201⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 320 -ip 3201⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 320 -ip 3201⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 320 -ip 3201⤵PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 320 -ip 3201⤵PID:1808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 320 -ip 3201⤵PID:4104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 320 -ip 3201⤵PID:4584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1260 -ip 12601⤵PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1260 -ip 12601⤵PID:3212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1260 -ip 12601⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1260 -ip 12601⤵PID:2732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1260 -ip 12601⤵PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1260 -ip 12601⤵PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1260 -ip 12601⤵PID:4752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1260 -ip 12601⤵PID:2920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1260 -ip 12601⤵PID:1288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1260 -ip 12601⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1260 -ip 12601⤵PID:2200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1260 -ip 12601⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1260 -ip 12601⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 3122⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4968 -ip 49681⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1260 -ip 12601⤵PID:4004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1260 -ip 12601⤵PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1260 -ip 12601⤵PID:1556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1260 -ip 12601⤵PID:4700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1260 -ip 12601⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 3162⤵
- Program crash
PID:2252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1532 -ip 15321⤵PID:320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
766KB
MD57342d263cfe47e237f3fa9949df1df4b
SHA18fa4eb34d05281568c94b72073de084b8fe9ab0d
SHA256d0d6cf9c350891c4935f89633274a77c04e841ccd118d9a2c7e468261ae2e18d
SHA51242210fffd43748230573ba49cb8d57f5aebe8363eb157b7ae2de7901032ff49258946e31b2bf98fafdc41e21392af3f3a80033014db486b0a2af08b0ef0fc766
-
Filesize
766KB
MD57342d263cfe47e237f3fa9949df1df4b
SHA18fa4eb34d05281568c94b72073de084b8fe9ab0d
SHA256d0d6cf9c350891c4935f89633274a77c04e841ccd118d9a2c7e468261ae2e18d
SHA51242210fffd43748230573ba49cb8d57f5aebe8363eb157b7ae2de7901032ff49258946e31b2bf98fafdc41e21392af3f3a80033014db486b0a2af08b0ef0fc766
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
612KB
MD5c6efefefbb1e72fd3050a24457f5accf
SHA12c799e6be988ca439aabdb181cb58ef480f45a16
SHA2560bdb4569e5c73c5fc2852b4a7eff2e4819f877cd1d40e165905f8e3c1dafdb70
SHA512622dccdfaf9905e68074503a1886ced060a39706fc7a61d45a40fe0ea9403612f58470a6baa881c7d126182aef2daa1bdc239dd1bb93ec97834316e24fc93145
-
Filesize
612KB
MD5c6efefefbb1e72fd3050a24457f5accf
SHA12c799e6be988ca439aabdb181cb58ef480f45a16
SHA2560bdb4569e5c73c5fc2852b4a7eff2e4819f877cd1d40e165905f8e3c1dafdb70
SHA512622dccdfaf9905e68074503a1886ced060a39706fc7a61d45a40fe0ea9403612f58470a6baa881c7d126182aef2daa1bdc239dd1bb93ec97834316e24fc93145
-
Filesize
404KB
MD5678769c67dd78833ab06cac56ff30205
SHA15e6e065c4facda8c6fe8a4871c1be1e319c16162
SHA256f726be16d9a77e4db028e5d3c5ee0d31b67dfee6a8e951639ff337151a0d14d4
SHA512e6f12cdcf9c8d74627fe34d6a8bba1ac411bedd96d2db84c18714c73ad743c9251127b3e12f30356446de5bdcec6816b383bc4c5a41d81d54d79357d2dc58be3
-
Filesize
404KB
MD5678769c67dd78833ab06cac56ff30205
SHA15e6e065c4facda8c6fe8a4871c1be1e319c16162
SHA256f726be16d9a77e4db028e5d3c5ee0d31b67dfee6a8e951639ff337151a0d14d4
SHA512e6f12cdcf9c8d74627fe34d6a8bba1ac411bedd96d2db84c18714c73ad743c9251127b3e12f30356446de5bdcec6816b383bc4c5a41d81d54d79357d2dc58be3
-
Filesize
487KB
MD57e35744d5cbd8c149b2d160b39c88ad4
SHA13d230695c164726cb2a1c8a8a884f48fe9cd591e
SHA2565c7e555be7edd4f2037482e22012d174c7d7bf7334b0c438169294c75eb4f085
SHA51207a2ec3db1994f9b59d56dfbfb7108d918096bbdae28efd1243061cc093c06e855c9b27dd9c35b5b20535a8173e1126c034b235d6b3188bc0b0f2cc6055d82dc
-
Filesize
487KB
MD57e35744d5cbd8c149b2d160b39c88ad4
SHA13d230695c164726cb2a1c8a8a884f48fe9cd591e
SHA2565c7e555be7edd4f2037482e22012d174c7d7bf7334b0c438169294c75eb4f085
SHA51207a2ec3db1994f9b59d56dfbfb7108d918096bbdae28efd1243061cc093c06e855c9b27dd9c35b5b20535a8173e1126c034b235d6b3188bc0b0f2cc6055d82dc
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
383KB
MD52f48eceffa84683ff4b8ccdebef8faff
SHA1ea4bb2eda1e80107e9747fffbf241ae08ef51940
SHA25616aa08f548c2563ea6569e3c23213e34dea6ef04289e96d7ebb0178cb4614af7
SHA512e97983cb5af6a7c314de180a3a1e642a467406e476d6c60486e4764e1d7f3af6fa7c02fa04bfbd14cc89b4b976e1332e4a94c50a854bbab94f3a46b6e1e62696
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5