2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe
Size

828KB
MD5

24bcefb7947a4ae86d71b9aeb0e67ea4
SHA1

e0d38d543ffbbafc100c85e7247c9b6653ff821a
SHA256

2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731
SHA512

5fc668eb5ce2e735d166b44aad87f808f28960466820dc939a10df48876cd09aa3acd0fea547d07ae97e48f6a6b8c7dd10167387d3348ef63a68d8f025057b6d
SSDEEP

24576:xylNx1tRlc7XBtSB5qeWTSD8s8CUSVZ5:klDjPoBt0pWTSAs85

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it266539.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it266539.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it266539.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it266539.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it266539.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it266539.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	lr017589.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 8 IoCs

pid	Process
492	ziMq4882.exe
4480	ziMA3715.exe
2036	it266539.exe
5092	jr230632.exe
1792	kp058889.exe
488	lr017589.exe
3160	oneetx.exe
3868	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
4220	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it266539.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziMq4882.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziMq4882.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziMA3715.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziMA3715.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
4456	5092	WerFault.exe	88
3612	488	WerFault.exe	92
1476	488	WerFault.exe	92
2396	488	WerFault.exe	92
3848	488	WerFault.exe	92
1388	488	WerFault.exe	92
3872	488	WerFault.exe	92
3692	488	WerFault.exe	92
2136	488	WerFault.exe	92
836	488	WerFault.exe	92
2384	488	WerFault.exe	92
4952	3160	WerFault.exe	112
1096	3160	WerFault.exe	112
4824	3160	WerFault.exe	112
1256	3160	WerFault.exe	112
4348	3160	WerFault.exe	112
4740	3160	WerFault.exe	112
3184	3160	WerFault.exe	112
1448	3160	WerFault.exe	112
3492	3160	WerFault.exe	112
4992	3160	WerFault.exe	112
4000	3160	WerFault.exe	112
1704	3160	WerFault.exe	112
4848	3160	WerFault.exe	112
3684	3160	WerFault.exe	112
2396	3160	WerFault.exe	112
3664	3160	WerFault.exe	112
4784	3160	WerFault.exe	112
1264	3868	WerFault.exe	164
4920	3160	WerFault.exe	112

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2036	it266539.exe
2036	it266539.exe
5092	jr230632.exe
5092	jr230632.exe
1792	kp058889.exe
1792	kp058889.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	it266539.exe
Token: SeDebugPrivilege	5092	jr230632.exe
Token: SeDebugPrivilege	1792	kp058889.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
488	lr017589.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 492	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	82
PID 2320 wrote to memory of 492	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	82
PID 2320 wrote to memory of 492	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	82
PID 492 wrote to memory of 4480	492	ziMq4882.exe	83
PID 492 wrote to memory of 4480	492	ziMq4882.exe	83
PID 492 wrote to memory of 4480	492	ziMq4882.exe	83
PID 4480 wrote to memory of 2036	4480	ziMA3715.exe	84
PID 4480 wrote to memory of 2036	4480	ziMA3715.exe	84
PID 4480 wrote to memory of 5092	4480	ziMA3715.exe	88
PID 4480 wrote to memory of 5092	4480	ziMA3715.exe	88
PID 4480 wrote to memory of 5092	4480	ziMA3715.exe	88
PID 492 wrote to memory of 1792	492	ziMq4882.exe	91
PID 492 wrote to memory of 1792	492	ziMq4882.exe	91
PID 492 wrote to memory of 1792	492	ziMq4882.exe	91
PID 2320 wrote to memory of 488	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	92
PID 2320 wrote to memory of 488	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	92
PID 2320 wrote to memory of 488	2320	2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe	92
PID 488 wrote to memory of 3160	488	lr017589.exe	112
PID 488 wrote to memory of 3160	488	lr017589.exe	112
PID 488 wrote to memory of 3160	488	lr017589.exe	112
PID 3160 wrote to memory of 1232	3160	oneetx.exe	130
PID 3160 wrote to memory of 1232	3160	oneetx.exe	130
PID 3160 wrote to memory of 1232	3160	oneetx.exe	130
PID 3160 wrote to memory of 2164	3160	oneetx.exe	138
PID 3160 wrote to memory of 2164	3160	oneetx.exe	138
PID 3160 wrote to memory of 2164	3160	oneetx.exe	138
PID 2164 wrote to memory of 3452	2164	cmd.exe	142
PID 2164 wrote to memory of 3452	2164	cmd.exe	142
PID 2164 wrote to memory of 3452	2164	cmd.exe	142
PID 2164 wrote to memory of 4164	2164	cmd.exe	143
PID 2164 wrote to memory of 4164	2164	cmd.exe	143
PID 2164 wrote to memory of 4164	2164	cmd.exe	143
PID 2164 wrote to memory of 5080	2164	cmd.exe	144
PID 2164 wrote to memory of 5080	2164	cmd.exe	144
PID 2164 wrote to memory of 5080	2164	cmd.exe	144
PID 2164 wrote to memory of 3736	2164	cmd.exe	145
PID 2164 wrote to memory of 3736	2164	cmd.exe	145
PID 2164 wrote to memory of 3736	2164	cmd.exe	145
PID 2164 wrote to memory of 768	2164	cmd.exe	146
PID 2164 wrote to memory of 768	2164	cmd.exe	146
PID 2164 wrote to memory of 768	2164	cmd.exe	146
PID 2164 wrote to memory of 224	2164	cmd.exe	147
PID 2164 wrote to memory of 224	2164	cmd.exe	147
PID 2164 wrote to memory of 224	2164	cmd.exe	147
PID 3160 wrote to memory of 4220	3160	oneetx.exe	161
PID 3160 wrote to memory of 4220	3160	oneetx.exe	161
PID 3160 wrote to memory of 4220	3160	oneetx.exe	161

C:\Users\Admin\AppData\Local\Temp\2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe
"C:\Users\Admin\AppData\Local\Temp\2562803b62a3c2f8f91a5efc11119724fc256d0e9fb18ee26339d5fbe80ca731.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMq4882.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMq4882.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMA3715.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMA3715.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it266539.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it266539.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230632.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230632.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1848
        5⤵
        Program crash
        
        PID:4456
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp058889.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp058889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr017589.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr017589.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 708
    3⤵
    - Program crash
    PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 788
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 808
    3⤵
    - Program crash
    PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 812
    3⤵
    - Program crash
    PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 968
    3⤵
    - Program crash
    PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 968
    3⤵
    - Program crash
    PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1212
    3⤵
    - Program crash
    PID:3692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1232
    3⤵
    - Program crash
    PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1316
    3⤵
    - Program crash
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 704
      4⤵
      Program crash
      PID:4952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 856
      4⤵
      Program crash
      PID:1096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 868
      4⤵
      Program crash
      PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1052
      4⤵
      Program crash
      PID:1256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1052
      4⤵
      Program crash
      PID:4348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1052
      4⤵
      Program crash
      PID:4740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1108
      4⤵
      Program crash
      PID:3184
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 992
      4⤵
      Program crash
      PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 776
      4⤵
      Program crash
      PID:3492
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3452
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:5080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3736
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        5⤵
        
        PID:768
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        5⤵
        
        PID:224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 744
      4⤵
      Program crash
      PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 776
      4⤵
      Program crash
      PID:4000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 768
      4⤵
      Program crash
      PID:1704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 896
      4⤵
      Program crash
      PID:4848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1484
      4⤵
      Program crash
      PID:3684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1100
      4⤵
      Program crash
      PID:2396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1564
      4⤵
      Program crash
      PID:3664
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1584
      4⤵
      Program crash
      PID:4784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1636
      4⤵
      Program crash
      PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1368
    3⤵
    - Program crash
    PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5092 -ip 5092
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 488 -ip 488
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 488 -ip 488
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 488 -ip 488
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 488 -ip 488
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 488 -ip 488
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 488 -ip 488
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 488 -ip 488
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 488 -ip 488
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 488 -ip 488
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 488 -ip 488
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3160 -ip 3160
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3160 -ip 3160
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3160 -ip 3160
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3160 -ip 3160
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3160 -ip 3160
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3160 -ip 3160
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3160 -ip 3160
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3160 -ip 3160
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3160 -ip 3160
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3160 -ip 3160
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3160 -ip 3160
1⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3160 -ip 3160
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3160 -ip 3160
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3160 -ip 3160
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3160 -ip 3160
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3160 -ip 3160
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3160 -ip 3160
1⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 420
  2⤵
  - Program crash
  PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3868 -ip 3868
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3160 -ip 3160
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr017589.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr017589.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMq4882.exe

Filesize
569KB

MD5
44a557dfc4f898a4b121d7cd0b8f7b5a

SHA1
dcd1b4649276b7c47bebabb0a723535993746337

SHA256
cbb27340d908b00d6a5c291a2d3ec1a6630579fa84d005dfa6871992620b8080

SHA512
994f38431a63c88c69decf8309a926fa7c0b1e4ad834395559a7cbe8fc5dd1cc773bcc5e366c3823319c12036fa3d996e6cb48c327f4356c2f5c6c309d36c8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMq4882.exe

Filesize
569KB

MD5
44a557dfc4f898a4b121d7cd0b8f7b5a

SHA1
dcd1b4649276b7c47bebabb0a723535993746337

SHA256
cbb27340d908b00d6a5c291a2d3ec1a6630579fa84d005dfa6871992620b8080

SHA512
994f38431a63c88c69decf8309a926fa7c0b1e4ad834395559a7cbe8fc5dd1cc773bcc5e366c3823319c12036fa3d996e6cb48c327f4356c2f5c6c309d36c8d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp058889.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp058889.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMA3715.exe

Filesize
415KB

MD5
847d83e4800657d1a89fa84ef3c757c4

SHA1
837938a79c5809934944e4b4ed0860d5b3a228a7

SHA256
259449dddb0ace5050207f280b1302ebe9d1b69758b74672ec5ab26695f0ec7f

SHA512
b31a1c6b1a3aa3d3b069d9cd71c296269af1154ef7a6676b6ee03e5c57c8cde088d1c57b7d7c22219e77982fdc558db22c260c669a25741d82d17898ebed9f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziMA3715.exe

Filesize
415KB

MD5
847d83e4800657d1a89fa84ef3c757c4

SHA1
837938a79c5809934944e4b4ed0860d5b3a228a7

SHA256
259449dddb0ace5050207f280b1302ebe9d1b69758b74672ec5ab26695f0ec7f

SHA512
b31a1c6b1a3aa3d3b069d9cd71c296269af1154ef7a6676b6ee03e5c57c8cde088d1c57b7d7c22219e77982fdc558db22c260c669a25741d82d17898ebed9f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it266539.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it266539.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230632.exe

Filesize
360KB

MD5
fb628ad2c39afca350364a02803362bd

SHA1
b39122d39c19d930fc6d4c913ee751606c7a777a

SHA256
4b9905c1b41a0e31bcd59f3d1cfd268fcf0704e9f9400a369773c092b8678b5d

SHA512
44b0911dd2323c75e6fc513203ec047a84a85d83d03ed52e4f4972e6a8fe9b751636400bbcd6947237babcd1822b4f08c0d1afa7005e2fbf70eb3e90f5f3a4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr230632.exe

Filesize
360KB

MD5
fb628ad2c39afca350364a02803362bd

SHA1
b39122d39c19d930fc6d4c913ee751606c7a777a

SHA256
4b9905c1b41a0e31bcd59f3d1cfd268fcf0704e9f9400a369773c092b8678b5d

SHA512
44b0911dd2323c75e6fc513203ec047a84a85d83d03ed52e4f4972e6a8fe9b751636400bbcd6947237babcd1822b4f08c0d1afa7005e2fbf70eb3e90f5f3a4e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
256KB

MD5
d993fde03baeb0a8efed273cc7b0d873

SHA1
17ace6e5a0c07b78b624d90de0fc80df521a4554

SHA256
9e3f8824ffb3815df7fddf6be2e8764fcdf88f583441556be86a927544299091

SHA512
da5b438be9106b741c5c44db3918f5c8ec77a28659fcb00fa3d5247cba04b91aae31cd460e08830f188014c7cb70da9f7a358f1d94d6547fc2c89105b20f5abc

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/488-982-0x00000000047D0000-0x0000000004805000-memory.dmp

Filesize
212KB

Download
memory/1792-976-0x0000000007880000-0x0000000007890000-memory.dmp

Filesize
64KB

Download
memory/1792-975-0x0000000000760000-0x0000000000788000-memory.dmp

Filesize
160KB

Download
memory/2036-154-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/5092-200-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-226-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-180-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-182-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-184-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-186-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-188-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-190-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-192-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-194-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-196-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-198-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-176-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-202-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-204-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-206-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-208-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-210-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-216-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-214-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-212-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-218-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-220-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-222-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-224-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-178-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-228-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-957-0x0000000009C70000-0x000000000A288000-memory.dmp

Filesize
6.1MB

Download
memory/5092-958-0x000000000A310000-0x000000000A322000-memory.dmp

Filesize
72KB

Download
memory/5092-959-0x000000000A330000-0x000000000A43A000-memory.dmp

Filesize
1.0MB

Download
memory/5092-960-0x000000000A450000-0x000000000A48C000-memory.dmp

Filesize
240KB

Download
memory/5092-961-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/5092-962-0x000000000A750000-0x000000000A7B6000-memory.dmp

Filesize
408KB

Download
memory/5092-963-0x000000000AE20000-0x000000000AEB2000-memory.dmp

Filesize
584KB

Download
memory/5092-964-0x000000000AFE0000-0x000000000B056000-memory.dmp

Filesize
472KB

Download
memory/5092-174-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-172-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-170-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-168-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-166-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-165-0x0000000004D70000-0x0000000004DA5000-memory.dmp

Filesize
212KB

Download
memory/5092-164-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/5092-162-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/5092-163-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/5092-161-0x0000000004800000-0x0000000004846000-memory.dmp

Filesize
280KB

Download
memory/5092-160-0x0000000007240000-0x00000000077E4000-memory.dmp

Filesize
5.6MB

Download
memory/5092-965-0x000000000B0B0000-0x000000000B272000-memory.dmp

Filesize
1.8MB

Download
memory/5092-966-0x000000000B2D0000-0x000000000B7FC000-memory.dmp

Filesize
5.2MB

Download
memory/5092-967-0x000000000B8D0000-0x000000000B8EE000-memory.dmp

Filesize
120KB

Download
memory/5092-968-0x0000000004AA0000-0x0000000004AF0000-memory.dmp

Filesize
320KB

Download