Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2023, 18:26
Static task
static1
General
-
Target
4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe
-
Size
963KB
-
MD5
b950e5ca3915232df4d3a79ddb8c0a7e
-
SHA1
b0369ac409d832ae487f1e4a9841f844111ef367
-
SHA256
4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9
-
SHA512
7ea9283f5e045f7bc0321962068ff7a76f0afde6b9d77349eb017f8326b0c4fd65e452c42b7052ddeebea98d1dde45f3c63a7f40b3c1b8687170fa56527d6b10
-
SSDEEP
12288:/y90wxSjpJZUG8VMjKM6pQXbQXfiFrocEzGK+JefLZpAdmpTCpOrcOc0h92N0UMB:/ynQ3uMtGor8zGvefLUdCqOgBoUMRfz
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr525576.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr525576.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr525576.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr525576.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr525576.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr525576.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation si542721.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 3688 un605494.exe 3780 un702761.exe 4468 pr525576.exe 3564 qu980852.exe 3644 rk186797.exe 2052 si542721.exe 3412 oneetx.exe 64 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4040 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr525576.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr525576.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un605494.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un605494.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un702761.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un702761.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 368 4468 WerFault.exe 86 1160 3564 WerFault.exe 92 2432 2052 WerFault.exe 97 2224 2052 WerFault.exe 97 1916 2052 WerFault.exe 97 3860 2052 WerFault.exe 97 3768 2052 WerFault.exe 97 1164 2052 WerFault.exe 97 4572 2052 WerFault.exe 97 4644 2052 WerFault.exe 97 1504 2052 WerFault.exe 97 2200 2052 WerFault.exe 97 1912 3412 WerFault.exe 117 3580 3412 WerFault.exe 117 1256 3412 WerFault.exe 117 2732 3412 WerFault.exe 117 4628 3412 WerFault.exe 117 1740 3412 WerFault.exe 117 4112 3412 WerFault.exe 117 1736 3412 WerFault.exe 117 2140 3412 WerFault.exe 117 2820 3412 WerFault.exe 117 3740 3412 WerFault.exe 117 4728 3412 WerFault.exe 117 5024 3412 WerFault.exe 117 3824 3412 WerFault.exe 117 3832 64 WerFault.exe 161 784 3412 WerFault.exe 117 3264 3412 WerFault.exe 117 4956 3412 WerFault.exe 117 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4124 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4468 pr525576.exe 4468 pr525576.exe 3564 qu980852.exe 3564 qu980852.exe 3644 rk186797.exe 3644 rk186797.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4468 pr525576.exe Token: SeDebugPrivilege 3564 qu980852.exe Token: SeDebugPrivilege 3644 rk186797.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 si542721.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2428 wrote to memory of 3688 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 84 PID 2428 wrote to memory of 3688 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 84 PID 2428 wrote to memory of 3688 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 84 PID 3688 wrote to memory of 3780 3688 un605494.exe 85 PID 3688 wrote to memory of 3780 3688 un605494.exe 85 PID 3688 wrote to memory of 3780 3688 un605494.exe 85 PID 3780 wrote to memory of 4468 3780 un702761.exe 86 PID 3780 wrote to memory of 4468 3780 un702761.exe 86 PID 3780 wrote to memory of 4468 3780 un702761.exe 86 PID 3780 wrote to memory of 3564 3780 un702761.exe 92 PID 3780 wrote to memory of 3564 3780 un702761.exe 92 PID 3780 wrote to memory of 3564 3780 un702761.exe 92 PID 3688 wrote to memory of 3644 3688 un605494.exe 95 PID 3688 wrote to memory of 3644 3688 un605494.exe 95 PID 3688 wrote to memory of 3644 3688 un605494.exe 95 PID 2428 wrote to memory of 2052 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 97 PID 2428 wrote to memory of 2052 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 97 PID 2428 wrote to memory of 2052 2428 4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe 97 PID 2052 wrote to memory of 3412 2052 si542721.exe 117 PID 2052 wrote to memory of 3412 2052 si542721.exe 117 PID 2052 wrote to memory of 3412 2052 si542721.exe 117 PID 3412 wrote to memory of 4124 3412 oneetx.exe 137 PID 3412 wrote to memory of 4124 3412 oneetx.exe 137 PID 3412 wrote to memory of 4124 3412 oneetx.exe 137 PID 3412 wrote to memory of 4860 3412 oneetx.exe 143 PID 3412 wrote to memory of 4860 3412 oneetx.exe 143 PID 3412 wrote to memory of 4860 3412 oneetx.exe 143 PID 4860 wrote to memory of 4136 4860 cmd.exe 147 PID 4860 wrote to memory of 4136 4860 cmd.exe 147 PID 4860 wrote to memory of 4136 4860 cmd.exe 147 PID 4860 wrote to memory of 1300 4860 cmd.exe 148 PID 4860 wrote to memory of 1300 4860 cmd.exe 148 PID 4860 wrote to memory of 1300 4860 cmd.exe 148 PID 4860 wrote to memory of 3968 4860 cmd.exe 149 PID 4860 wrote to memory of 3968 4860 cmd.exe 149 PID 4860 wrote to memory of 3968 4860 cmd.exe 149 PID 4860 wrote to memory of 3716 4860 cmd.exe 151 PID 4860 wrote to memory of 3716 4860 cmd.exe 151 PID 4860 wrote to memory of 3716 4860 cmd.exe 151 PID 4860 wrote to memory of 3780 4860 cmd.exe 150 PID 4860 wrote to memory of 3780 4860 cmd.exe 150 PID 4860 wrote to memory of 3780 4860 cmd.exe 150 PID 4860 wrote to memory of 4272 4860 cmd.exe 152 PID 4860 wrote to memory of 4272 4860 cmd.exe 152 PID 4860 wrote to memory of 4272 4860 cmd.exe 152 PID 3412 wrote to memory of 4040 3412 oneetx.exe 166 PID 3412 wrote to memory of 4040 3412 oneetx.exe 166 PID 3412 wrote to memory of 4040 3412 oneetx.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe"C:\Users\Admin\AppData\Local\Temp\4103ddb2f84c6cc5aa850a84f9096542e8a3557b1ee8a9cf12143e973f67c2e9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un605494.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un605494.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un702761.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un702761.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr525576.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr525576.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 10765⤵
- Program crash
PID:368
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu980852.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu980852.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 13405⤵
- Program crash
PID:1160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk186797.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk186797.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542721.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si542721.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 6963⤵
- Program crash
PID:2432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 7803⤵
- Program crash
PID:2224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 8083⤵
- Program crash
PID:1916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9683⤵
- Program crash
PID:3860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9563⤵
- Program crash
PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 9683⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 12123⤵
- Program crash
PID:4572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 12443⤵
- Program crash
PID:4644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 13203⤵
- Program crash
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 6924⤵
- Program crash
PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 9004⤵
- Program crash
PID:3580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 9364⤵
- Program crash
PID:1256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 8964⤵
- Program crash
PID:2732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10884⤵
- Program crash
PID:4628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10884⤵
- Program crash
PID:1740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10804⤵
- Program crash
PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 9284⤵
- Program crash
PID:1736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 7764⤵
- Program crash
PID:2140
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4136
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1300
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3968
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3716
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 13124⤵
- Program crash
PID:2820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 12884⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 7684⤵
- Program crash
PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 7484⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 10844⤵
- Program crash
PID:3824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 16364⤵
- Program crash
PID:784
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 15724⤵
- Program crash
PID:3264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 16444⤵
- Program crash
PID:4956
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 13483⤵
- Program crash
PID:2200
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4468 -ip 44681⤵PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3564 -ip 35641⤵PID:924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2052 -ip 20521⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2052 -ip 20521⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2052 -ip 20521⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2052 -ip 20521⤵PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2052 -ip 20521⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2052 -ip 20521⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2052 -ip 20521⤵PID:1356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2052 -ip 20521⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2052 -ip 20521⤵PID:1748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2052 -ip 20521⤵PID:3044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3412 -ip 34121⤵PID:392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3412 -ip 34121⤵PID:4236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3412 -ip 34121⤵PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3412 -ip 34121⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3412 -ip 34121⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3412 -ip 34121⤵PID:4764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3412 -ip 34121⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3412 -ip 34121⤵PID:4892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3412 -ip 34121⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3412 -ip 34121⤵PID:4532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3412 -ip 34121⤵PID:1592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3412 -ip 34121⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3412 -ip 34121⤵PID:3460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3412 -ip 34121⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 2162⤵
- Program crash
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 64 -ip 641⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3412 -ip 34121⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3412 -ip 34121⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3412 -ip 34121⤵PID:3116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
704KB
MD5f0b29b5f17816c422c124a1dc2c85968
SHA18719f9b6103452d375126405f087a96168a4e249
SHA256016b7d770dde44e4d1b95545ccaa221e313acfeee29f4b6470a3b2ca92bf7a6f
SHA512d9ed4051c6cc3812933a3ea6083b370cc80e82c9efaeb380ec3bc6a026504d0ed75497f9d5091bac4028788418c13bcb783e6acba8525e5416fa9aeda05bb62c
-
Filesize
704KB
MD5f0b29b5f17816c422c124a1dc2c85968
SHA18719f9b6103452d375126405f087a96168a4e249
SHA256016b7d770dde44e4d1b95545ccaa221e313acfeee29f4b6470a3b2ca92bf7a6f
SHA512d9ed4051c6cc3812933a3ea6083b370cc80e82c9efaeb380ec3bc6a026504d0ed75497f9d5091bac4028788418c13bcb783e6acba8525e5416fa9aeda05bb62c
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
550KB
MD58309a455c5b87fa8b2149dea3aae529d
SHA1ad61f92411ef6163cc59a5eb48403dbe5007834d
SHA256770a19ce1fb600c8ea175c262e9b497ebb093a246e54de0959666efe155b09b2
SHA512e0e8a5135f336b2010b5907cc7fd4279a42d59a1e28e795f3b39dc17aac79cf3cc3542553ebec7e8e03e876e7cc44f1780c6fa2fd054a58e8726fa4aaf46a8d5
-
Filesize
550KB
MD58309a455c5b87fa8b2149dea3aae529d
SHA1ad61f92411ef6163cc59a5eb48403dbe5007834d
SHA256770a19ce1fb600c8ea175c262e9b497ebb093a246e54de0959666efe155b09b2
SHA512e0e8a5135f336b2010b5907cc7fd4279a42d59a1e28e795f3b39dc17aac79cf3cc3542553ebec7e8e03e876e7cc44f1780c6fa2fd054a58e8726fa4aaf46a8d5
-
Filesize
277KB
MD5083ecbfa024787c405c4ecf7fb61bbc8
SHA1cf1d719960c359c1cf6dbd408456c7ce7dd93759
SHA2561730f70634837f186aaa50bae0c95f1b8a3538e6f974cfa0eb4a69ecf0ab5a48
SHA5128cfc8d08bbcd515209314becb5b271d017b9c201690dae4df99a49f1856b12eeb1571038e76cd7930f249d43375e469c22f835c11e0f44816c9ef68be257fe90
-
Filesize
277KB
MD5083ecbfa024787c405c4ecf7fb61bbc8
SHA1cf1d719960c359c1cf6dbd408456c7ce7dd93759
SHA2561730f70634837f186aaa50bae0c95f1b8a3538e6f974cfa0eb4a69ecf0ab5a48
SHA5128cfc8d08bbcd515209314becb5b271d017b9c201690dae4df99a49f1856b12eeb1571038e76cd7930f249d43375e469c22f835c11e0f44816c9ef68be257fe90
-
Filesize
359KB
MD53775ea5d504bcf84b014723a869bf7c4
SHA193ad409d45a7e2c96423645acfbf85cdbfcf05bc
SHA2564fe0554578a73e86b9da457bfc07c0e5ca29db2289fe30fa72281d2ade07ba77
SHA512b94437f6e376fd688fefa0d5642f1e74e2e1cba57d1b9dffb520d95b07dea758c2cf14aa0d187ba1cc3a638f3a050b266b4b79e85493fe3f935f8e692674bde3
-
Filesize
359KB
MD53775ea5d504bcf84b014723a869bf7c4
SHA193ad409d45a7e2c96423645acfbf85cdbfcf05bc
SHA2564fe0554578a73e86b9da457bfc07c0e5ca29db2289fe30fa72281d2ade07ba77
SHA512b94437f6e376fd688fefa0d5642f1e74e2e1cba57d1b9dffb520d95b07dea758c2cf14aa0d187ba1cc3a638f3a050b266b4b79e85493fe3f935f8e692674bde3
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
255KB
MD59e18f8277e7f37abe3934fd030c3116d
SHA1e195d560452ed9998f2f45403389f5d07b4f15c4
SHA256cb172c9e4d4f04f05e85a3c622ca8baf2732c69e40c7e19694459f1dbf3eb346
SHA51221d9ecad3ebbaf4a65caa83599faf33459d245f647be563cef27973dce95c1a8c2c6db3cab97079d9752eb145bdba3fc030ea3fa3a7b3c9e57e54f5a448b095b
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5