Analysis
-
max time kernel
144s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 23:00
Static task
static1
General
-
Target
85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe
-
Size
827KB
-
MD5
799a69d9615be0b5e2c008e6e5ecd7ce
-
SHA1
27ca8f469984fbb75aa5c2df85cdc090ef30cb52
-
SHA256
85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398
-
SHA512
a4ca85e4cb0f6ac13b99b3a4d6a8a37ebf4d85931db4137c9c9642f6baf637342cf6815a3d2bf8df53b7b17d3f28b6fe2d0a3ab42ae4646b64f22ca2aa6513cd
-
SSDEEP
12288:Ry90OWf2g9nldHqbzsRKPKDuhetmmncIqAgTpxBU3prqkwYEw0l7nBLAwypDRKK:RyD69nlFMYEiD/lnkAQqFwNwWAXpb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it648180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it648180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it648180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it648180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it648180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it648180.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr335852.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1432 zikq1245.exe 1164 zizc1554.exe 1712 it648180.exe 4860 jr759017.exe 3912 kp225808.exe 2152 lr335852.exe 3780 oneetx.exe 1168 oneetx.exe 3480 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1500 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it648180.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zikq1245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zikq1245.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizc1554.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zizc1554.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 4812 4860 WerFault.exe 92 4484 2152 WerFault.exe 98 4680 2152 WerFault.exe 98 1948 2152 WerFault.exe 98 1752 2152 WerFault.exe 98 2988 2152 WerFault.exe 98 1172 2152 WerFault.exe 98 3392 2152 WerFault.exe 98 60 2152 WerFault.exe 98 3516 2152 WerFault.exe 98 3840 2152 WerFault.exe 98 1924 3780 WerFault.exe 118 2020 3780 WerFault.exe 118 3776 3780 WerFault.exe 118 4612 3780 WerFault.exe 118 3828 3780 WerFault.exe 118 1028 3780 WerFault.exe 118 4348 3780 WerFault.exe 118 1792 3780 WerFault.exe 118 1592 3780 WerFault.exe 118 3996 3780 WerFault.exe 118 2348 3780 WerFault.exe 118 5112 3780 WerFault.exe 118 3284 3780 WerFault.exe 118 880 3780 WerFault.exe 118 4680 1168 WerFault.exe 157 4136 3780 WerFault.exe 118 2736 3780 WerFault.exe 118 1812 3780 WerFault.exe 118 5000 3480 WerFault.exe 169 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1712 it648180.exe 1712 it648180.exe 4860 jr759017.exe 4860 jr759017.exe 3912 kp225808.exe 3912 kp225808.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1712 it648180.exe Token: SeDebugPrivilege 4860 jr759017.exe Token: SeDebugPrivilege 3912 kp225808.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2152 lr335852.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4972 wrote to memory of 1432 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 83 PID 4972 wrote to memory of 1432 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 83 PID 4972 wrote to memory of 1432 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 83 PID 1432 wrote to memory of 1164 1432 zikq1245.exe 84 PID 1432 wrote to memory of 1164 1432 zikq1245.exe 84 PID 1432 wrote to memory of 1164 1432 zikq1245.exe 84 PID 1164 wrote to memory of 1712 1164 zizc1554.exe 85 PID 1164 wrote to memory of 1712 1164 zizc1554.exe 85 PID 1164 wrote to memory of 4860 1164 zizc1554.exe 92 PID 1164 wrote to memory of 4860 1164 zizc1554.exe 92 PID 1164 wrote to memory of 4860 1164 zizc1554.exe 92 PID 1432 wrote to memory of 3912 1432 zikq1245.exe 97 PID 1432 wrote to memory of 3912 1432 zikq1245.exe 97 PID 1432 wrote to memory of 3912 1432 zikq1245.exe 97 PID 4972 wrote to memory of 2152 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 98 PID 4972 wrote to memory of 2152 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 98 PID 4972 wrote to memory of 2152 4972 85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe 98 PID 2152 wrote to memory of 3780 2152 lr335852.exe 118 PID 2152 wrote to memory of 3780 2152 lr335852.exe 118 PID 2152 wrote to memory of 3780 2152 lr335852.exe 118 PID 3780 wrote to memory of 2852 3780 oneetx.exe 135 PID 3780 wrote to memory of 2852 3780 oneetx.exe 135 PID 3780 wrote to memory of 2852 3780 oneetx.exe 135 PID 3780 wrote to memory of 392 3780 oneetx.exe 141 PID 3780 wrote to memory of 392 3780 oneetx.exe 141 PID 3780 wrote to memory of 392 3780 oneetx.exe 141 PID 392 wrote to memory of 432 392 cmd.exe 145 PID 392 wrote to memory of 432 392 cmd.exe 145 PID 392 wrote to memory of 432 392 cmd.exe 145 PID 392 wrote to memory of 4604 392 cmd.exe 146 PID 392 wrote to memory of 4604 392 cmd.exe 146 PID 392 wrote to memory of 4604 392 cmd.exe 146 PID 392 wrote to memory of 1720 392 cmd.exe 147 PID 392 wrote to memory of 1720 392 cmd.exe 147 PID 392 wrote to memory of 1720 392 cmd.exe 147 PID 392 wrote to memory of 3360 392 cmd.exe 148 PID 392 wrote to memory of 3360 392 cmd.exe 148 PID 392 wrote to memory of 3360 392 cmd.exe 148 PID 392 wrote to memory of 2812 392 cmd.exe 149 PID 392 wrote to memory of 2812 392 cmd.exe 149 PID 392 wrote to memory of 2812 392 cmd.exe 149 PID 392 wrote to memory of 1520 392 cmd.exe 150 PID 392 wrote to memory of 1520 392 cmd.exe 150 PID 392 wrote to memory of 1520 392 cmd.exe 150 PID 3780 wrote to memory of 1500 3780 oneetx.exe 164 PID 3780 wrote to memory of 1500 3780 oneetx.exe 164 PID 3780 wrote to memory of 1500 3780 oneetx.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe"C:\Users\Admin\AppData\Local\Temp\85c17ca384357981fc6a641a7f92eb2af7b52b2a2d36698803d38b4a1966e398.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikq1245.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zikq1245.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizc1554.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizc1554.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it648180.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it648180.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr759017.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr759017.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 14405⤵
- Program crash
PID:4812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp225808.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp225808.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr335852.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr335852.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 6963⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 7723⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 7723⤵
- Program crash
PID:1948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 9683⤵
- Program crash
PID:1752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 9483⤵
- Program crash
PID:2988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 8683⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 12243⤵
- Program crash
PID:3392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 12523⤵
- Program crash
PID:60
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 13203⤵
- Program crash
PID:3516
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 6924⤵
- Program crash
PID:1924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 8204⤵
- Program crash
PID:2020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 8884⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10524⤵
- Program crash
PID:4612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10724⤵
- Program crash
PID:3828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10724⤵
- Program crash
PID:1028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 11244⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 9924⤵
- Program crash
PID:1792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 7764⤵
- Program crash
PID:1592
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:432
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4604
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3360
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2812
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:1520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 13044⤵
- Program crash
PID:3996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 9924⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1324⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 13524⤵
- Program crash
PID:3284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10524⤵
- Program crash
PID:880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 16204⤵
- Program crash
PID:4136
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10524⤵
- Program crash
PID:2736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 16284⤵
- Program crash
PID:1812
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 8643⤵
- Program crash
PID:3840
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4860 -ip 48601⤵PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2152 -ip 21521⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2152 -ip 21521⤵PID:408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2152 -ip 21521⤵PID:1272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2152 -ip 21521⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2152 -ip 21521⤵PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2152 -ip 21521⤵PID:4412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2152 -ip 21521⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2152 -ip 21521⤵PID:1116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2152 -ip 21521⤵PID:1284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2152 -ip 21521⤵PID:4260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3780 -ip 37801⤵PID:2688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3780 -ip 37801⤵PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3780 -ip 37801⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3780 -ip 37801⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3780 -ip 37801⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3780 -ip 37801⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3780 -ip 37801⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3780 -ip 37801⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3780 -ip 37801⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3780 -ip 37801⤵PID:1664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3780 -ip 37801⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3780 -ip 37801⤵PID:2280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3780 -ip 37801⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 3162⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3780 -ip 37801⤵PID:4280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1168 -ip 11681⤵PID:4992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3780 -ip 37801⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3780 -ip 37801⤵PID:3724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3780 -ip 37801⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 3162⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3480 -ip 34801⤵PID:3860
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
568KB
MD5b941025d7acb9c79172424b9976dea4b
SHA1856250d2c811a24b918d84fd5a47f32c68a3ba3b
SHA25667d85909a155068c669ce9683ff048783ddb6e162c83b66dc65a6458d8cb1221
SHA51205628f77a048ad997e493f5c4af9cba0612df481bc2a82870da829f6d01d367e6ff330a6784490ff3096083b3274ae71ad459898700b6167426ed364c7756b09
-
Filesize
568KB
MD5b941025d7acb9c79172424b9976dea4b
SHA1856250d2c811a24b918d84fd5a47f32c68a3ba3b
SHA25667d85909a155068c669ce9683ff048783ddb6e162c83b66dc65a6458d8cb1221
SHA51205628f77a048ad997e493f5c4af9cba0612df481bc2a82870da829f6d01d367e6ff330a6784490ff3096083b3274ae71ad459898700b6167426ed364c7756b09
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
414KB
MD5523781e573e96febfd64cd535ac89d9f
SHA1199290a78de8c54e3385e34d04bcd2c4649055f4
SHA25699ed9975a11efefa5f83f9d5098864eac96f129840fb0005821f7d6e1e5f8973
SHA51288dd28b86b9b144e183db1c9c1b3d1f7f9f3260abe610bf9b37ad77936e1ecd9a940ab6e03b7dd1019597588f1e7d6c212feef64e1ee3aabdc01817fcc3154a9
-
Filesize
414KB
MD5523781e573e96febfd64cd535ac89d9f
SHA1199290a78de8c54e3385e34d04bcd2c4649055f4
SHA25699ed9975a11efefa5f83f9d5098864eac96f129840fb0005821f7d6e1e5f8973
SHA51288dd28b86b9b144e183db1c9c1b3d1f7f9f3260abe610bf9b37ad77936e1ecd9a940ab6e03b7dd1019597588f1e7d6c212feef64e1ee3aabdc01817fcc3154a9
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD576ffbc53c3eca92c4a4b6dddded078e2
SHA14e6d02b6ef4204e8d6b499a8c032674c63782d24
SHA256cc210ee6c4e20d148f95c465c95fb4080497662bb70b7b38fdbb0eb4aacdbae5
SHA5123a1c111a54c8478475808d69befbd94b3ddf28c4acbae15e13fd6485c3e907a612f6ee1f5487dfad1d0059564cea8b5fb2029037f38b711090fdf4fb6d0013f6
-
Filesize
360KB
MD576ffbc53c3eca92c4a4b6dddded078e2
SHA14e6d02b6ef4204e8d6b499a8c032674c63782d24
SHA256cc210ee6c4e20d148f95c465c95fb4080497662bb70b7b38fdbb0eb4aacdbae5
SHA5123a1c111a54c8478475808d69befbd94b3ddf28c4acbae15e13fd6485c3e907a612f6ee1f5487dfad1d0059564cea8b5fb2029037f38b711090fdf4fb6d0013f6
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
256KB
MD573bb255a8a87ad602f1f8ceb0314fa5b
SHA1488ad2a75f4ed275198194cf4b1b5a68505fc98f
SHA256e95fdd195ebcd9fb74a63ea3774899fd96cb4b2068c1e6b9b8e0b3dd0f82392f
SHA512234a27f8fe3a883280eeaae179efb5080f7cb8fe15c1758377921eeedff1681979e537c66b7b65860efed5c8f100e26630e30d5c5d580076e4604ced5ae6bee3
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5