e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe
Size

964KB
MD5

355d3678d3b98d260f73b5d85bbb1aef
SHA1

5b3fe0aec33700517e8a97bcef958e3cbc707bbe
SHA256

e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508
SHA512

d97c42afc256b8f45e42c47d8b2e4befb7b161986a20ce558a7b76f863b243c62e4ebac145ab2b784587678d910a18b70db687e5020c5aa5b5aecedb8efd5b7f
SSDEEP

24576:3yM2O9LheX8KLyJIzyMGHsqsFyxefvVp:CtO94bLdfGMqs0Q

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr594133.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	si602419.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
4060	un181908.exe
736	un375298.exe
3660	pr594133.exe
3380	qu612716.exe
2588	rk037754.exe
1436	si602419.exe
4872	oneetx.exe
1004	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr594133.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr594133.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un375298.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un181908.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un181908.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un375298.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
3368	3660	WerFault.exe	88
2764	3380	WerFault.exe	97
2260	1436	WerFault.exe	103
3336	1436	WerFault.exe	103
2928	1436	WerFault.exe	103
1876	1436	WerFault.exe	103
4032	1436	WerFault.exe	103
4140	1436	WerFault.exe	103
764	1436	WerFault.exe	103
1700	1436	WerFault.exe	103
4324	1436	WerFault.exe	103
3716	1436	WerFault.exe	103
4880	4872	WerFault.exe	122
4588	4872	WerFault.exe	122
4656	4872	WerFault.exe	122
5036	4872	WerFault.exe	122
1528	4872	WerFault.exe	122
4556	4872	WerFault.exe	122
2212	4872	WerFault.exe	122
1080	4872	WerFault.exe	122
540	4872	WerFault.exe	122
4868	4872	WerFault.exe	122
396	4872	WerFault.exe	122
1032	4872	WerFault.exe	122
4060	4872	WerFault.exe	122
2384	4872	WerFault.exe	122
4740	1004	WerFault.exe	163
2256	4872	WerFault.exe	122
3780	4872	WerFault.exe	122
3428	4872	WerFault.exe	122

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3660	pr594133.exe
3660	pr594133.exe
3380	qu612716.exe
3380	qu612716.exe
2588	rk037754.exe
2588	rk037754.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	pr594133.exe
Token: SeDebugPrivilege	3380	qu612716.exe
Token: SeDebugPrivilege	2588	rk037754.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1436	si602419.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4060	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	86
PID 2200 wrote to memory of 4060	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	86
PID 2200 wrote to memory of 4060	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	86
PID 4060 wrote to memory of 736	4060	un181908.exe	87
PID 4060 wrote to memory of 736	4060	un181908.exe	87
PID 4060 wrote to memory of 736	4060	un181908.exe	87
PID 736 wrote to memory of 3660	736	un375298.exe	88
PID 736 wrote to memory of 3660	736	un375298.exe	88
PID 736 wrote to memory of 3660	736	un375298.exe	88
PID 736 wrote to memory of 3380	736	un375298.exe	97
PID 736 wrote to memory of 3380	736	un375298.exe	97
PID 736 wrote to memory of 3380	736	un375298.exe	97
PID 4060 wrote to memory of 2588	4060	un181908.exe	102
PID 4060 wrote to memory of 2588	4060	un181908.exe	102
PID 4060 wrote to memory of 2588	4060	un181908.exe	102
PID 2200 wrote to memory of 1436	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	103
PID 2200 wrote to memory of 1436	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	103
PID 2200 wrote to memory of 1436	2200	e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe	103
PID 1436 wrote to memory of 4872	1436	si602419.exe	122
PID 1436 wrote to memory of 4872	1436	si602419.exe	122
PID 1436 wrote to memory of 4872	1436	si602419.exe	122
PID 4872 wrote to memory of 1680	4872	oneetx.exe	139
PID 4872 wrote to memory of 1680	4872	oneetx.exe	139
PID 4872 wrote to memory of 1680	4872	oneetx.exe	139
PID 4872 wrote to memory of 3384	4872	oneetx.exe	145
PID 4872 wrote to memory of 3384	4872	oneetx.exe	145
PID 4872 wrote to memory of 3384	4872	oneetx.exe	145
PID 3384 wrote to memory of 1280	3384	cmd.exe	149
PID 3384 wrote to memory of 1280	3384	cmd.exe	149
PID 3384 wrote to memory of 1280	3384	cmd.exe	149
PID 3384 wrote to memory of 2424	3384	cmd.exe	150
PID 3384 wrote to memory of 2424	3384	cmd.exe	150
PID 3384 wrote to memory of 2424	3384	cmd.exe	150
PID 3384 wrote to memory of 3872	3384	cmd.exe	151
PID 3384 wrote to memory of 3872	3384	cmd.exe	151
PID 3384 wrote to memory of 3872	3384	cmd.exe	151
PID 3384 wrote to memory of 4464	3384	cmd.exe	152
PID 3384 wrote to memory of 4464	3384	cmd.exe	152
PID 3384 wrote to memory of 4464	3384	cmd.exe	152
PID 3384 wrote to memory of 3308	3384	cmd.exe	153
PID 3384 wrote to memory of 3308	3384	cmd.exe	153
PID 3384 wrote to memory of 3308	3384	cmd.exe	153
PID 3384 wrote to memory of 1168	3384	cmd.exe	154
PID 3384 wrote to memory of 1168	3384	cmd.exe	154
PID 3384 wrote to memory of 1168	3384	cmd.exe	154
PID 4872 wrote to memory of 1700	4872	oneetx.exe	168
PID 4872 wrote to memory of 1700	4872	oneetx.exe	168
PID 4872 wrote to memory of 1700	4872	oneetx.exe	168

C:\Users\Admin\AppData\Local\Temp\e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe
"C:\Users\Admin\AppData\Local\Temp\e2f7a504f57b3333580762c1c1f444bc071618189fd31095a07d88cbb74d0508.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181908.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181908.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un375298.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un375298.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr594133.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr594133.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 1100
        5⤵
        Program crash
        
        PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu612716.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu612716.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 1528
        5⤵
        Program crash
        
        PID:2764
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk037754.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk037754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si602419.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si602419.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 712
    3⤵
    - Program crash
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 768
    3⤵
    - Program crash
    PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 828
    3⤵
    - Program crash
    PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 956
    3⤵
    - Program crash
    PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 972
    3⤵
    - Program crash
    PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1004
    3⤵
    - Program crash
    PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1220
    3⤵
    - Program crash
    PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1236
    3⤵
    - Program crash
    PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1320
    3⤵
    - Program crash
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 708
      4⤵
      Program crash
      PID:4880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 852
      4⤵
      Program crash
      PID:4588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 916
      4⤵
      Program crash
      PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1056
      4⤵
      Program crash
      PID:5036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1092
      4⤵
      Program crash
      PID:1528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1092
      4⤵
      Program crash
      PID:4556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1116
      4⤵
      Program crash
      PID:2212
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1004
      4⤵
      Program crash
      PID:1080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 780
      4⤵
      Program crash
      PID:540
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1280
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:2424
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:3872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        5⤵
        
        PID:3308
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        5⤵
        
        PID:1168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 748
      4⤵
      Program crash
      PID:4868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1004
      4⤵
      Program crash
      PID:396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 852
      4⤵
      Program crash
      PID:1032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 780
      4⤵
      Program crash
      PID:4060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1144
      4⤵
      Program crash
      PID:2384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1616
      4⤵
      Program crash
      PID:2256
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1096
      4⤵
      Program crash
      PID:3780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1632
      4⤵
      Program crash
      PID:3428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 744
    3⤵
    - Program crash
    PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3660 -ip 3660
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3380 -ip 3380
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1436 -ip 1436
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1436 -ip 1436
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1436 -ip 1436
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1436 -ip 1436
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1436 -ip 1436
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1436 -ip 1436
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1436 -ip 1436
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1436 -ip 1436
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1436 -ip 1436
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1436 -ip 1436
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4872 -ip 4872
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4872 -ip 4872
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4872 -ip 4872
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4872 -ip 4872
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4872 -ip 4872
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4872 -ip 4872
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4872 -ip 4872
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4872 -ip 4872
1⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4872 -ip 4872
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4872 -ip 4872
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4872 -ip 4872
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4872 -ip 4872
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4872 -ip 4872
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4872 -ip 4872
1⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 428
  2⤵
  - Program crash
  PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1004 -ip 1004
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4872 -ip 4872
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4872 -ip 4872
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4872 -ip 4872
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si602419.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si602419.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181908.exe

Filesize
704KB

MD5
feb772bb246317691b8aea4c04aea055

SHA1
eb22e73e21518b4b81f3cca286f72013d7626c4a

SHA256
41b74e6052f7ba66c75d591b8f94ee873ba6c86d20ce7da5369d43be562db852

SHA512
43f56689d7a74d7c357288c8c3af76d18a0bd48f6eba8cf728e6bd7e8617c0d796c1921f13e73f991a0aee79148b6fc593e31e85c0e75c8e0a38d4ba2f4bc33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un181908.exe

Filesize
704KB

MD5
feb772bb246317691b8aea4c04aea055

SHA1
eb22e73e21518b4b81f3cca286f72013d7626c4a

SHA256
41b74e6052f7ba66c75d591b8f94ee873ba6c86d20ce7da5369d43be562db852

SHA512
43f56689d7a74d7c357288c8c3af76d18a0bd48f6eba8cf728e6bd7e8617c0d796c1921f13e73f991a0aee79148b6fc593e31e85c0e75c8e0a38d4ba2f4bc33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk037754.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk037754.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un375298.exe

Filesize
550KB

MD5
77df15e94528998c9c6ecb0ed870c062

SHA1
f1d2f80aa8b8a60a5b9191c9ae60429effb67294

SHA256
0acb552fa4a8aa1d4d908c74a73794f0a031f0a993fcfb7260e071142e059ef2

SHA512
415385b2ab96488b400ac77ecd7d0ed0a2665b61b13242e11806cf8d1fe648c93cd345e12be2dc86f3c57a60f44679c407765179acdb3d425b7e97ce9ce3550b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un375298.exe

Filesize
550KB

MD5
77df15e94528998c9c6ecb0ed870c062

SHA1
f1d2f80aa8b8a60a5b9191c9ae60429effb67294

SHA256
0acb552fa4a8aa1d4d908c74a73794f0a031f0a993fcfb7260e071142e059ef2

SHA512
415385b2ab96488b400ac77ecd7d0ed0a2665b61b13242e11806cf8d1fe648c93cd345e12be2dc86f3c57a60f44679c407765179acdb3d425b7e97ce9ce3550b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr594133.exe

Filesize
277KB

MD5
1a07e5d59eec7886a320c15d41f15543

SHA1
981406d2abd4abece87cb3f2ff8d02545ad8c6d8

SHA256
0ed349997ddd45d0cabd2bcc57b1dcf30a7920c083ba973d7d7b376ebd0d8a3b

SHA512
0dfe6236ef1c1947c8a3345faa5f89b1190e7d946d04e3d900a8f4dfdca9bafde2bb67cff403db317a4cf5f54150e05fad1ce5df254a06ad540aa61490e9441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr594133.exe

Filesize
277KB

MD5
1a07e5d59eec7886a320c15d41f15543

SHA1
981406d2abd4abece87cb3f2ff8d02545ad8c6d8

SHA256
0ed349997ddd45d0cabd2bcc57b1dcf30a7920c083ba973d7d7b376ebd0d8a3b

SHA512
0dfe6236ef1c1947c8a3345faa5f89b1190e7d946d04e3d900a8f4dfdca9bafde2bb67cff403db317a4cf5f54150e05fad1ce5df254a06ad540aa61490e9441e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu612716.exe

Filesize
359KB

MD5
d7f13cf34ebe6f2d5a1fd4406b386321

SHA1
67d1b80da9ca7b023481fbaea2a68b6ba677b4f0

SHA256
3aec25de80ff4396a4d4e0833629260deb87dc73647347c19d95feb30bf7370d

SHA512
77424e105a7b0d44a99525d7528d4500e8d2dd71c02798584144097b14afce3099cace068e64774339360d2acb8cd134b294acd92eb93fa6e3bfd4e3056777f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu612716.exe

Filesize
359KB

MD5
d7f13cf34ebe6f2d5a1fd4406b386321

SHA1
67d1b80da9ca7b023481fbaea2a68b6ba677b4f0

SHA256
3aec25de80ff4396a4d4e0833629260deb87dc73647347c19d95feb30bf7370d

SHA512
77424e105a7b0d44a99525d7528d4500e8d2dd71c02798584144097b14afce3099cace068e64774339360d2acb8cd134b294acd92eb93fa6e3bfd4e3056777f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
7053a1a708ff2d9351e604337aa488ea

SHA1
00e06b05a10e89af85cb4b33eeff105072df5071

SHA256
ed49f01f11849ba95d2f5da8fb19bb4aa5d729323a47501eb7a21507aea62a25

SHA512
2d57f7de317d59363eb950b4e8ac3f0733e8e54152cd40847640896c44105ec9627836e9ce6f27d39c8e7c34960345f4dc526d4d8aa601aab247a6824ddf84ed

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1436-1018-0x0000000002CF0000-0x0000000002D25000-memory.dmp

Filesize
212KB

Download
memory/2588-1012-0x0000000007700000-0x0000000007710000-memory.dmp

Filesize
64KB

Download
memory/2588-1011-0x00000000008D0000-0x00000000008F8000-memory.dmp

Filesize
160KB

Download
memory/3380-999-0x000000000B290000-0x000000000B7BC000-memory.dmp

Filesize
5.2MB

Download
memory/3380-991-0x000000000A310000-0x000000000A322000-memory.dmp

Filesize
72KB

Download
memory/3380-1005-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-1004-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-1003-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-1002-0x0000000004A10000-0x0000000004A60000-memory.dmp

Filesize
320KB

Download
memory/3380-194-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-195-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-197-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-199-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-201-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-203-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-205-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-207-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-209-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-211-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-213-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-215-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-217-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-218-0x0000000002D70000-0x0000000002DB6000-memory.dmp

Filesize
280KB

Download
memory/3380-221-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-225-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-222-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-224-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-220-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-227-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-229-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-231-0x0000000004C00000-0x0000000004C35000-memory.dmp

Filesize
212KB

Download
memory/3380-990-0x0000000009CA0000-0x000000000A2B8000-memory.dmp

Filesize
6.1MB

Download
memory/3380-1001-0x000000000B8D0000-0x000000000B8EE000-memory.dmp

Filesize
120KB

Download
memory/3380-992-0x000000000A330000-0x000000000A43A000-memory.dmp

Filesize
1.0MB

Download
memory/3380-993-0x000000000A450000-0x000000000A48C000-memory.dmp

Filesize
240KB

Download
memory/3380-994-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/3380-995-0x000000000A750000-0x000000000A7B6000-memory.dmp

Filesize
408KB

Download
memory/3380-996-0x000000000AE20000-0x000000000AEB2000-memory.dmp

Filesize
584KB

Download
memory/3380-997-0x000000000AFE0000-0x000000000B056000-memory.dmp

Filesize
472KB

Download
memory/3380-998-0x000000000B0B0000-0x000000000B272000-memory.dmp

Filesize
1.8MB

Download
memory/3660-171-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-169-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-183-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-185-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-189-0x0000000000400000-0x0000000002B9F000-memory.dmp

Filesize
39.6MB

Download
memory/3660-187-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/3660-179-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-177-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-175-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-173-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-186-0x0000000000400000-0x0000000002B9F000-memory.dmp

Filesize
39.6MB

Download
memory/3660-167-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-181-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-165-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-163-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-161-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-159-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-158-0x0000000004BE0000-0x0000000004BF2000-memory.dmp

Filesize
72KB

Download
memory/3660-157-0x0000000007260000-0x0000000007804000-memory.dmp

Filesize
5.6MB

Download
memory/3660-156-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/3660-155-0x0000000002EE0000-0x0000000002F0D000-memory.dmp

Filesize
180KB

Download