Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 03:33
Static task
static1
General
-
Target
580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe
-
Size
940KB
-
MD5
6fecd635ce2dc2746dff58a8247fa5de
-
SHA1
bd2003f270dd076ca6a80d474b411e595f320deb
-
SHA256
580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d
-
SHA512
a67b2c42de63a15fd6e9ba0b9c13e01245bf9e61f2fb4d6f1193f01e0875c101881c3b6fd699a2c2ef7f01123c4d4db9e6648016d8e27a7a38ecece764968e53
-
SSDEEP
24576:Ky43zi70pFKol1rOgc9rSPZky8Nh5QbMvtEV6:Rai76XOgfClv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it337743.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it337743.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it337743.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it337743.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it337743.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it337743.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr397366.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 1936 ziEL6087.exe 4012 zimh5504.exe 4300 it337743.exe 2084 jr733612.exe 2284 kp334759.exe 1108 lr397366.exe 4712 oneetx.exe 3176 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 748 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it337743.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zimh5504.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziEL6087.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziEL6087.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zimh5504.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 1484 2084 WerFault.exe 90 4184 1108 WerFault.exe 94 4056 1108 WerFault.exe 94 1140 1108 WerFault.exe 94 1144 1108 WerFault.exe 94 824 1108 WerFault.exe 94 1432 1108 WerFault.exe 94 4784 1108 WerFault.exe 94 3176 1108 WerFault.exe 94 496 1108 WerFault.exe 94 4940 1108 WerFault.exe 94 3916 4712 WerFault.exe 115 4288 4712 WerFault.exe 115 1224 4712 WerFault.exe 115 3564 4712 WerFault.exe 115 956 4712 WerFault.exe 115 3720 4712 WerFault.exe 115 3716 4712 WerFault.exe 115 1364 4712 WerFault.exe 115 1824 4712 WerFault.exe 115 2928 4712 WerFault.exe 115 4448 4712 WerFault.exe 115 1324 4712 WerFault.exe 115 3328 4712 WerFault.exe 115 3136 4712 WerFault.exe 115 4452 4712 WerFault.exe 115 2724 4712 WerFault.exe 115 3760 3176 WerFault.exe 164 3856 4712 WerFault.exe 115 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1696 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4300 it337743.exe 4300 it337743.exe 2084 jr733612.exe 2084 jr733612.exe 2284 kp334759.exe 2284 kp334759.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4300 it337743.exe Token: SeDebugPrivilege 2084 jr733612.exe Token: SeDebugPrivilege 2284 kp334759.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1108 lr397366.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4360 wrote to memory of 1936 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 84 PID 4360 wrote to memory of 1936 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 84 PID 4360 wrote to memory of 1936 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 84 PID 1936 wrote to memory of 4012 1936 ziEL6087.exe 85 PID 1936 wrote to memory of 4012 1936 ziEL6087.exe 85 PID 1936 wrote to memory of 4012 1936 ziEL6087.exe 85 PID 4012 wrote to memory of 4300 4012 zimh5504.exe 86 PID 4012 wrote to memory of 4300 4012 zimh5504.exe 86 PID 4012 wrote to memory of 2084 4012 zimh5504.exe 90 PID 4012 wrote to memory of 2084 4012 zimh5504.exe 90 PID 4012 wrote to memory of 2084 4012 zimh5504.exe 90 PID 1936 wrote to memory of 2284 1936 ziEL6087.exe 93 PID 1936 wrote to memory of 2284 1936 ziEL6087.exe 93 PID 1936 wrote to memory of 2284 1936 ziEL6087.exe 93 PID 4360 wrote to memory of 1108 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 94 PID 4360 wrote to memory of 1108 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 94 PID 4360 wrote to memory of 1108 4360 580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe 94 PID 1108 wrote to memory of 4712 1108 lr397366.exe 115 PID 1108 wrote to memory of 4712 1108 lr397366.exe 115 PID 1108 wrote to memory of 4712 1108 lr397366.exe 115 PID 4712 wrote to memory of 1696 4712 oneetx.exe 135 PID 4712 wrote to memory of 1696 4712 oneetx.exe 135 PID 4712 wrote to memory of 1696 4712 oneetx.exe 135 PID 4712 wrote to memory of 1068 4712 oneetx.exe 141 PID 4712 wrote to memory of 1068 4712 oneetx.exe 141 PID 4712 wrote to memory of 1068 4712 oneetx.exe 141 PID 1068 wrote to memory of 2084 1068 cmd.exe 145 PID 1068 wrote to memory of 2084 1068 cmd.exe 145 PID 1068 wrote to memory of 2084 1068 cmd.exe 145 PID 1068 wrote to memory of 64 1068 cmd.exe 146 PID 1068 wrote to memory of 64 1068 cmd.exe 146 PID 1068 wrote to memory of 64 1068 cmd.exe 146 PID 1068 wrote to memory of 1920 1068 cmd.exe 147 PID 1068 wrote to memory of 1920 1068 cmd.exe 147 PID 1068 wrote to memory of 1920 1068 cmd.exe 147 PID 1068 wrote to memory of 3076 1068 cmd.exe 148 PID 1068 wrote to memory of 3076 1068 cmd.exe 148 PID 1068 wrote to memory of 3076 1068 cmd.exe 148 PID 1068 wrote to memory of 2852 1068 cmd.exe 149 PID 1068 wrote to memory of 2852 1068 cmd.exe 149 PID 1068 wrote to memory of 2852 1068 cmd.exe 149 PID 1068 wrote to memory of 4132 1068 cmd.exe 150 PID 1068 wrote to memory of 4132 1068 cmd.exe 150 PID 1068 wrote to memory of 4132 1068 cmd.exe 150 PID 4712 wrote to memory of 748 4712 oneetx.exe 161 PID 4712 wrote to memory of 748 4712 oneetx.exe 161 PID 4712 wrote to memory of 748 4712 oneetx.exe 161
Processes
-
C:\Users\Admin\AppData\Local\Temp\580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe"C:\Users\Admin\AppData\Local\Temp\580f9fd0c02fc7ae9e49986af42f53646eec4907eb0c4bdd6a131400925fd87d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziEL6087.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziEL6087.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimh5504.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zimh5504.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it337743.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it337743.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr733612.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr733612.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 18045⤵
- Program crash
PID:1484
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp334759.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp334759.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr397366.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr397366.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 6963⤵
- Program crash
PID:4184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 7683⤵
- Program crash
PID:4056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 8603⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 9683⤵
- Program crash
PID:1144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 9603⤵
- Program crash
PID:824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 9963⤵
- Program crash
PID:1432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 12203⤵
- Program crash
PID:4784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 12083⤵
- Program crash
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 13163⤵
- Program crash
PID:496
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 6924⤵
- Program crash
PID:3916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 8364⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 9124⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 10524⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 10724⤵
- Program crash
PID:956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 11084⤵
- Program crash
PID:3720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 11324⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 9924⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 7204⤵
- Program crash
PID:1824
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2084
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:64
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2852
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4132
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 12924⤵
- Program crash
PID:2928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 9884⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 7204⤵
- Program crash
PID:1324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 8924⤵
- Program crash
PID:3328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 11164⤵
- Program crash
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 16444⤵
- Program crash
PID:4452
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 11164⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 16644⤵
- Program crash
PID:3856
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 7483⤵
- Program crash
PID:4940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2084 -ip 20841⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1108 -ip 11081⤵PID:880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1108 -ip 11081⤵PID:3784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1108 -ip 11081⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1108 -ip 11081⤵PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1108 -ip 11081⤵PID:3100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1108 -ip 11081⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1108 -ip 11081⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1108 -ip 11081⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1108 -ip 11081⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1108 -ip 11081⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4712 -ip 47121⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4712 -ip 47121⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4712 -ip 47121⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4712 -ip 47121⤵PID:1624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4712 -ip 47121⤵PID:1160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4712 -ip 47121⤵PID:1292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4712 -ip 47121⤵PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4712 -ip 47121⤵PID:212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4712 -ip 47121⤵PID:3512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4712 -ip 47121⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4712 -ip 47121⤵PID:2196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4712 -ip 47121⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4712 -ip 47121⤵PID:2488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4712 -ip 47121⤵PID:3332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4712 -ip 47121⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4712 -ip 47121⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 3202⤵
- Program crash
PID:3760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3176 -ip 31761⤵PID:796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4712 -ip 47121⤵PID:2880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
624KB
MD5888309669729873f9378b6fff5d4f2ab
SHA137a2e93a41b1368d72903fef4aa8e940a6ba3239
SHA2562664f57d59c8659963bbebae70220235f096c7c532255486eecdfc8e91f096c5
SHA512f76c1976b9a38a67718630c7509e372c0066f41ddcdcda94a5f6d2a31b299d2a8e5ef3a440a16f05921cce27d6642b64bc39cb038597ac63858a6975835ec70c
-
Filesize
624KB
MD5888309669729873f9378b6fff5d4f2ab
SHA137a2e93a41b1368d72903fef4aa8e940a6ba3239
SHA2562664f57d59c8659963bbebae70220235f096c7c532255486eecdfc8e91f096c5
SHA512f76c1976b9a38a67718630c7509e372c0066f41ddcdcda94a5f6d2a31b299d2a8e5ef3a440a16f05921cce27d6642b64bc39cb038597ac63858a6975835ec70c
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
470KB
MD5031573245e12bb684ea50c730c394346
SHA1b6e93a985f8388369e087f664bb4aa5e932e2b50
SHA256587dbc6e307b667ad8c42c6b5edf261f7406ca202595663f25476b6ea8f1b5eb
SHA51249aff1137848075d00f16ed00edf6e8b40ac56fa71f838cd9358dcd3707d7f0635d7aa5032d71b92af4b0b40aea3ee4a761486a22e141e191e0eaa3664000040
-
Filesize
470KB
MD5031573245e12bb684ea50c730c394346
SHA1b6e93a985f8388369e087f664bb4aa5e932e2b50
SHA256587dbc6e307b667ad8c42c6b5edf261f7406ca202595663f25476b6ea8f1b5eb
SHA51249aff1137848075d00f16ed00edf6e8b40ac56fa71f838cd9358dcd3707d7f0635d7aa5032d71b92af4b0b40aea3ee4a761486a22e141e191e0eaa3664000040
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
486KB
MD54eb22caeaf6269daf613abd2c3fd1a84
SHA18817225111d6817908d3637a5644b5acc1d61dc9
SHA256c295a3b11dccf54eccc6fea8f9bf262c438364ca5831ce5968d1c816022b0b29
SHA512d49bf19e0cbc8b8c5d9f6304b779c746f3271107e7976360b8baf9e2ac749a6c2cbffab950cf3d4d3ada64b356447c482bd4167b01a5e83ee7d31c3a8018afb9
-
Filesize
486KB
MD54eb22caeaf6269daf613abd2c3fd1a84
SHA18817225111d6817908d3637a5644b5acc1d61dc9
SHA256c295a3b11dccf54eccc6fea8f9bf262c438364ca5831ce5968d1c816022b0b29
SHA512d49bf19e0cbc8b8c5d9f6304b779c746f3271107e7976360b8baf9e2ac749a6c2cbffab950cf3d4d3ada64b356447c482bd4167b01a5e83ee7d31c3a8018afb9
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
382KB
MD5586c2c3c387038a375a60ed9253a87fc
SHA11c00f420f326a095a41ed7321cc7ddff83b18d07
SHA256ec7299838fde22c26fbe9a523f23eed4c763178cacaf8c3c1477d1daace27f8c
SHA5124652bd1bc436a497f45d2584186316abcbffd4cc607a622319f5727d75ef4277166fbd4064d08c54cfe80a1ff9aec4b946ac32616155a32ec346f1b3d07faeda
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5