Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 13:02
Static task
static1
General
-
Target
fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe
-
Size
830KB
-
MD5
a359fad3f3ba185ba01fa8e17d52dd15
-
SHA1
8a62c289d65787afafe43b73641eccc00a1c72be
-
SHA256
fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90
-
SHA512
14429b79c4ea877703d1715c905ce3d5de519674165b9cdef0db617156689b033976ea1da0ac5cfa5ec4147c62f12f282aa300323abd83bb03afdc0b562183a2
-
SSDEEP
24576:hyjIkvVTJZEjgP2IKXKe2Nn39dOBjBsZmV0rlOtlcy:Uj7vVFZEezIJ2NnNkBaZy0rlae
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it843763.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it843763.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it843763.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it843763.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it843763.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it843763.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation lr228860.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1708 ziZO6862.exe 3776 zirc1355.exe 688 it843763.exe 4572 jr354717.exe 5028 kp076322.exe 4860 lr228860.exe 3596 oneetx.exe 2844 oneetx.exe 652 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5028 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it843763.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziZO6862.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziZO6862.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zirc1355.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zirc1355.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 4772 4572 WerFault.exe 85 3968 4860 WerFault.exe 94 1456 4860 WerFault.exe 94 1364 4860 WerFault.exe 94 1928 4860 WerFault.exe 94 1908 4860 WerFault.exe 94 2212 4860 WerFault.exe 94 4364 4860 WerFault.exe 94 264 4860 WerFault.exe 94 1368 4860 WerFault.exe 94 4192 4860 WerFault.exe 94 2300 3596 WerFault.exe 113 2416 3596 WerFault.exe 113 2552 3596 WerFault.exe 113 3344 3596 WerFault.exe 113 4436 3596 WerFault.exe 113 3828 3596 WerFault.exe 113 4888 3596 WerFault.exe 113 5108 3596 WerFault.exe 113 4312 3596 WerFault.exe 113 1092 3596 WerFault.exe 113 3860 3596 WerFault.exe 113 5096 3596 WerFault.exe 113 4716 3596 WerFault.exe 113 2208 2844 WerFault.exe 152 2100 3596 WerFault.exe 113 1292 3596 WerFault.exe 113 1020 3596 WerFault.exe 113 700 652 WerFault.exe 162 5112 3596 WerFault.exe 113 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 688 it843763.exe 688 it843763.exe 4572 jr354717.exe 4572 jr354717.exe 5028 kp076322.exe 5028 kp076322.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 688 it843763.exe Token: SeDebugPrivilege 4572 jr354717.exe Token: SeDebugPrivilege 5028 kp076322.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4860 lr228860.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1708 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 76 PID 2136 wrote to memory of 1708 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 76 PID 2136 wrote to memory of 1708 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 76 PID 1708 wrote to memory of 3776 1708 ziZO6862.exe 77 PID 1708 wrote to memory of 3776 1708 ziZO6862.exe 77 PID 1708 wrote to memory of 3776 1708 ziZO6862.exe 77 PID 3776 wrote to memory of 688 3776 zirc1355.exe 78 PID 3776 wrote to memory of 688 3776 zirc1355.exe 78 PID 3776 wrote to memory of 4572 3776 zirc1355.exe 85 PID 3776 wrote to memory of 4572 3776 zirc1355.exe 85 PID 3776 wrote to memory of 4572 3776 zirc1355.exe 85 PID 1708 wrote to memory of 5028 1708 ziZO6862.exe 93 PID 1708 wrote to memory of 5028 1708 ziZO6862.exe 93 PID 1708 wrote to memory of 5028 1708 ziZO6862.exe 93 PID 2136 wrote to memory of 4860 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 94 PID 2136 wrote to memory of 4860 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 94 PID 2136 wrote to memory of 4860 2136 fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe 94 PID 4860 wrote to memory of 3596 4860 lr228860.exe 113 PID 4860 wrote to memory of 3596 4860 lr228860.exe 113 PID 4860 wrote to memory of 3596 4860 lr228860.exe 113 PID 3596 wrote to memory of 936 3596 oneetx.exe 130 PID 3596 wrote to memory of 936 3596 oneetx.exe 130 PID 3596 wrote to memory of 936 3596 oneetx.exe 130 PID 3596 wrote to memory of 4712 3596 oneetx.exe 136 PID 3596 wrote to memory of 4712 3596 oneetx.exe 136 PID 3596 wrote to memory of 4712 3596 oneetx.exe 136 PID 4712 wrote to memory of 4320 4712 cmd.exe 140 PID 4712 wrote to memory of 4320 4712 cmd.exe 140 PID 4712 wrote to memory of 4320 4712 cmd.exe 140 PID 4712 wrote to memory of 2468 4712 cmd.exe 141 PID 4712 wrote to memory of 2468 4712 cmd.exe 141 PID 4712 wrote to memory of 2468 4712 cmd.exe 141 PID 4712 wrote to memory of 2084 4712 cmd.exe 142 PID 4712 wrote to memory of 2084 4712 cmd.exe 142 PID 4712 wrote to memory of 2084 4712 cmd.exe 142 PID 4712 wrote to memory of 2756 4712 cmd.exe 144 PID 4712 wrote to memory of 2756 4712 cmd.exe 144 PID 4712 wrote to memory of 2756 4712 cmd.exe 144 PID 4712 wrote to memory of 3664 4712 cmd.exe 143 PID 4712 wrote to memory of 3664 4712 cmd.exe 143 PID 4712 wrote to memory of 3664 4712 cmd.exe 143 PID 4712 wrote to memory of 2836 4712 cmd.exe 145 PID 4712 wrote to memory of 2836 4712 cmd.exe 145 PID 4712 wrote to memory of 2836 4712 cmd.exe 145 PID 3596 wrote to memory of 5028 3596 oneetx.exe 159 PID 3596 wrote to memory of 5028 3596 oneetx.exe 159 PID 3596 wrote to memory of 5028 3596 oneetx.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe"C:\Users\Admin\AppData\Local\Temp\fa62a16e8612228f3a9aa352cc313b25f2b194dd9098c6395c831b3e61031d90.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZO6862.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziZO6862.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zirc1355.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zirc1355.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it843763.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it843763.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr354717.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr354717.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 13285⤵
- Program crash
PID:4772
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp076322.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp076322.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr228860.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr228860.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 7083⤵
- Program crash
PID:3968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 7923⤵
- Program crash
PID:1456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 8083⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9723⤵
- Program crash
PID:1928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9763⤵
- Program crash
PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 9763⤵
- Program crash
PID:2212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 12163⤵
- Program crash
PID:4364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 12643⤵
- Program crash
PID:264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 13163⤵
- Program crash
PID:1368
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7044⤵
- Program crash
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7924⤵
- Program crash
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 9044⤵
- Program crash
PID:2552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10604⤵
- Program crash
PID:3344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10484⤵
- Program crash
PID:4436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10484⤵
- Program crash
PID:3828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 10844⤵
- Program crash
PID:4888
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 9924⤵
- Program crash
PID:5108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7724⤵
- Program crash
PID:4312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4320
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2468
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2084
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2756
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:2836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 13044⤵
- Program crash
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 13164⤵
- Program crash
PID:3860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 7684⤵
- Program crash
PID:5096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 12924⤵
- Program crash
PID:4716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11244⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 16044⤵
- Program crash
PID:1292
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 11244⤵
- Program crash
PID:1020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 16204⤵
- Program crash
PID:5112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 13443⤵
- Program crash
PID:4192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4572 -ip 45721⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4860 -ip 48601⤵PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4860 -ip 48601⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4860 -ip 48601⤵PID:1252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4860 -ip 48601⤵PID:812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4860 -ip 48601⤵PID:3228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4860 -ip 48601⤵PID:2216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4860 -ip 48601⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4860 -ip 48601⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4860 -ip 48601⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4860 -ip 48601⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3596 -ip 35961⤵PID:1344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3596 -ip 35961⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3596 -ip 35961⤵PID:3340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3596 -ip 35961⤵PID:568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3596 -ip 35961⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3596 -ip 35961⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3596 -ip 35961⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3596 -ip 35961⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3596 -ip 35961⤵PID:1824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3596 -ip 35961⤵PID:1656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3596 -ip 35961⤵PID:3324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3596 -ip 35961⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3596 -ip 35961⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 4402⤵
- Program crash
PID:2208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2844 -ip 28441⤵PID:4772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3596 -ip 35961⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3596 -ip 35961⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3596 -ip 35961⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 4202⤵
- Program crash
PID:700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 652 -ip 6521⤵PID:1832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3596 -ip 35961⤵PID:3228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
569KB
MD52e8d0d68ce69a1c1b028e7fa32dade49
SHA18233e31faff99a132839b4652e654753863afc89
SHA25607885183c561dc318c21e597543814273b208bdeb051274894924feeb255a715
SHA512d29993c144990cadcd27223697dfb4e7fcce4d53b5a9209d1e724933439a2a10bda0c65457d958b6e5c40bcc8bc1337ec175a4be4ba951e9c1d6c77d1835c6e1
-
Filesize
569KB
MD52e8d0d68ce69a1c1b028e7fa32dade49
SHA18233e31faff99a132839b4652e654753863afc89
SHA25607885183c561dc318c21e597543814273b208bdeb051274894924feeb255a715
SHA512d29993c144990cadcd27223697dfb4e7fcce4d53b5a9209d1e724933439a2a10bda0c65457d958b6e5c40bcc8bc1337ec175a4be4ba951e9c1d6c77d1835c6e1
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
415KB
MD5d3b6fcb08b780281f142e17170cd64ec
SHA17b36c1b94026883cf6dcf552e01d373eaae12e53
SHA2562cf0e7fcdb885f2885706a3918707916c0a90ff39557c1e36b7bd75ff98643d4
SHA512858b527a4ba27b6f815fd239b1fd39439d37d515f0baee504be25b6ba5bdca33dba87222305387e374da0556ac1e86464050595b730c2c5fdf8ebce4b2f425b4
-
Filesize
415KB
MD5d3b6fcb08b780281f142e17170cd64ec
SHA17b36c1b94026883cf6dcf552e01d373eaae12e53
SHA2562cf0e7fcdb885f2885706a3918707916c0a90ff39557c1e36b7bd75ff98643d4
SHA512858b527a4ba27b6f815fd239b1fd39439d37d515f0baee504be25b6ba5bdca33dba87222305387e374da0556ac1e86464050595b730c2c5fdf8ebce4b2f425b4
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
360KB
MD55a72b963af68d496fad3849ed70f8ead
SHA1f8e1b149e2df160e807850fc05fcae93437b508b
SHA2563344c2decabc0ac74cdf4aaf74fbbeab0845d5db1e88917fa952ef4d93830713
SHA5123b5287c0c78efc81c2a2ccfa60305aee006214a2f74020cd3e8706a1ddbd1f254e376a5372d50a213d80d0f0d663707cf2549243e85b4f05ae8b405e4d705baf
-
Filesize
360KB
MD55a72b963af68d496fad3849ed70f8ead
SHA1f8e1b149e2df160e807850fc05fcae93437b508b
SHA2563344c2decabc0ac74cdf4aaf74fbbeab0845d5db1e88917fa952ef4d93830713
SHA5123b5287c0c78efc81c2a2ccfa60305aee006214a2f74020cd3e8706a1ddbd1f254e376a5372d50a213d80d0f0d663707cf2549243e85b4f05ae8b405e4d705baf
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
256KB
MD5c66c9b166787bc7b1ceeb347e22fdd95
SHA1228f38f71ca03a0cced6600027202275ec1f303e
SHA25680b01e4e103d213f096bb0bdf6df94f953195f751d676b502168eee3b075a7e5
SHA51224fb06af5b771fa6959054b40e10f305572a0fe8f5f26fb581cd1ddcca56073067b3eb32410605fb863f7dc129ae0536e435dd0928fe7212667061d8589cb06f
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5