Analysis
-
max time kernel
144s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 21:45
Static task
static1
General
-
Target
cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe
-
Size
1.0MB
-
MD5
0f95a874eefda00f4ca00c838470027c
-
SHA1
0dcf109f7676f6ee4d3f4134f5850eb71cb2c788
-
SHA256
cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751
-
SHA512
c85d61252f1351a184e6c97bf75a38267a52765f466df0436f39410634cec9a3f95484efcf743434f9a023e8b59096d79a423b1c8535290e9384b0ea7bd9de63
-
SSDEEP
24576:1yo6ZnyzC/kau0PY8HOQmsa+KXZnCE4qwF6uk3O:QPQIeY9HO8MnRZw/w
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr050216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr050216.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr050216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr050216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr050216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr050216.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si812846.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1052 un801076.exe 1344 un835817.exe 1488 pr050216.exe 2132 qu289548.exe 4208 rk020552.exe 2272 si812846.exe 4704 oneetx.exe 3516 oneetx.exe 2328 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5000 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr050216.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr050216.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un801076.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un801076.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un835817.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un835817.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
pid pid_target Process procid_target 4684 1488 WerFault.exe 88 1964 2132 WerFault.exe 97 2224 2272 WerFault.exe 102 964 2272 WerFault.exe 102 4752 2272 WerFault.exe 102 1324 2272 WerFault.exe 102 2368 2272 WerFault.exe 102 1820 2272 WerFault.exe 102 3352 2272 WerFault.exe 102 996 2272 WerFault.exe 102 2944 2272 WerFault.exe 102 3372 2272 WerFault.exe 102 376 4704 WerFault.exe 122 1968 4704 WerFault.exe 122 1524 4704 WerFault.exe 122 1308 4704 WerFault.exe 122 4476 4704 WerFault.exe 122 3688 4704 WerFault.exe 122 1496 4704 WerFault.exe 122 320 4704 WerFault.exe 122 1344 4704 WerFault.exe 122 4280 4704 WerFault.exe 122 3564 4704 WerFault.exe 122 2056 4704 WerFault.exe 122 5072 4704 WerFault.exe 122 3184 4704 WerFault.exe 122 5036 3516 WerFault.exe 163 2524 4704 WerFault.exe 122 3964 4704 WerFault.exe 122 4104 4704 WerFault.exe 122 4132 2328 WerFault.exe 173 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4092 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1488 pr050216.exe 1488 pr050216.exe 2132 qu289548.exe 2132 qu289548.exe 4208 rk020552.exe 4208 rk020552.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1488 pr050216.exe Token: SeDebugPrivilege 2132 qu289548.exe Token: SeDebugPrivilege 4208 rk020552.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 si812846.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4532 wrote to memory of 1052 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 86 PID 4532 wrote to memory of 1052 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 86 PID 4532 wrote to memory of 1052 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 86 PID 1052 wrote to memory of 1344 1052 un801076.exe 87 PID 1052 wrote to memory of 1344 1052 un801076.exe 87 PID 1052 wrote to memory of 1344 1052 un801076.exe 87 PID 1344 wrote to memory of 1488 1344 un835817.exe 88 PID 1344 wrote to memory of 1488 1344 un835817.exe 88 PID 1344 wrote to memory of 1488 1344 un835817.exe 88 PID 1344 wrote to memory of 2132 1344 un835817.exe 97 PID 1344 wrote to memory of 2132 1344 un835817.exe 97 PID 1344 wrote to memory of 2132 1344 un835817.exe 97 PID 1052 wrote to memory of 4208 1052 un801076.exe 101 PID 1052 wrote to memory of 4208 1052 un801076.exe 101 PID 1052 wrote to memory of 4208 1052 un801076.exe 101 PID 4532 wrote to memory of 2272 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 102 PID 4532 wrote to memory of 2272 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 102 PID 4532 wrote to memory of 2272 4532 cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe 102 PID 2272 wrote to memory of 4704 2272 si812846.exe 122 PID 2272 wrote to memory of 4704 2272 si812846.exe 122 PID 2272 wrote to memory of 4704 2272 si812846.exe 122 PID 4704 wrote to memory of 4092 4704 oneetx.exe 139 PID 4704 wrote to memory of 4092 4704 oneetx.exe 139 PID 4704 wrote to memory of 4092 4704 oneetx.exe 139 PID 4704 wrote to memory of 2420 4704 oneetx.exe 145 PID 4704 wrote to memory of 2420 4704 oneetx.exe 145 PID 4704 wrote to memory of 2420 4704 oneetx.exe 145 PID 2420 wrote to memory of 4208 2420 cmd.exe 149 PID 2420 wrote to memory of 4208 2420 cmd.exe 149 PID 2420 wrote to memory of 4208 2420 cmd.exe 149 PID 2420 wrote to memory of 1492 2420 cmd.exe 150 PID 2420 wrote to memory of 1492 2420 cmd.exe 150 PID 2420 wrote to memory of 1492 2420 cmd.exe 150 PID 2420 wrote to memory of 5056 2420 cmd.exe 151 PID 2420 wrote to memory of 5056 2420 cmd.exe 151 PID 2420 wrote to memory of 5056 2420 cmd.exe 151 PID 2420 wrote to memory of 516 2420 cmd.exe 153 PID 2420 wrote to memory of 516 2420 cmd.exe 153 PID 2420 wrote to memory of 516 2420 cmd.exe 153 PID 2420 wrote to memory of 2292 2420 cmd.exe 152 PID 2420 wrote to memory of 2292 2420 cmd.exe 152 PID 2420 wrote to memory of 2292 2420 cmd.exe 152 PID 2420 wrote to memory of 4260 2420 cmd.exe 154 PID 2420 wrote to memory of 4260 2420 cmd.exe 154 PID 2420 wrote to memory of 4260 2420 cmd.exe 154 PID 4704 wrote to memory of 5000 4704 oneetx.exe 168 PID 4704 wrote to memory of 5000 4704 oneetx.exe 168 PID 4704 wrote to memory of 5000 4704 oneetx.exe 168
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe"C:\Users\Admin\AppData\Local\Temp\cb7ab8c1f12196d4cdd0801604f711b06d99cb007ebbf9e27d9aa4b623921751.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un801076.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un801076.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un835817.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un835817.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr050216.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr050216.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 10885⤵
- Program crash
PID:4684
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu289548.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu289548.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 13325⤵
- Program crash
PID:1964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk020552.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk020552.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si812846.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si812846.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 6963⤵
- Program crash
PID:2224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 7803⤵
- Program crash
PID:964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 7963⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 9523⤵
- Program crash
PID:1324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 9763⤵
- Program crash
PID:2368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 9763⤵
- Program crash
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 12163⤵
- Program crash
PID:3352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 12283⤵
- Program crash
PID:996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 13123⤵
- Program crash
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 6924⤵
- Program crash
PID:376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 8564⤵
- Program crash
PID:1968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 8884⤵
- Program crash
PID:1524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10524⤵
- Program crash
PID:1308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10924⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10924⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 11404⤵
- Program crash
PID:1496
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10084⤵
- Program crash
PID:320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 7724⤵
- Program crash
PID:1344
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4208
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1492
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:5056
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2292
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:516
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 9404⤵
- Program crash
PID:4280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 7404⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 7644⤵
- Program crash
PID:2056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 12724⤵
- Program crash
PID:5072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10684⤵
- Program crash
PID:3184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 16204⤵
- Program crash
PID:2524
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 10684⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 16284⤵
- Program crash
PID:4104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 15563⤵
- Program crash
PID:3372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1488 -ip 14881⤵PID:4140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2132 -ip 21321⤵PID:220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2272 -ip 22721⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2272 -ip 22721⤵PID:1092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2272 -ip 22721⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2272 -ip 22721⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2272 -ip 22721⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2272 -ip 22721⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2272 -ip 22721⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2272 -ip 22721⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2272 -ip 22721⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2272 -ip 22721⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4704 -ip 47041⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4704 -ip 47041⤵PID:1120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4704 -ip 47041⤵PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4704 -ip 47041⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4704 -ip 47041⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4704 -ip 47041⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4704 -ip 47041⤵PID:4952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4704 -ip 47041⤵PID:2784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4704 -ip 47041⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4704 -ip 47041⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4704 -ip 47041⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4704 -ip 47041⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4704 -ip 47041⤵PID:3760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4704 -ip 47041⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 3162⤵
- Program crash
PID:5036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3516 -ip 35161⤵PID:2376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4704 -ip 47041⤵PID:2652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4704 -ip 47041⤵PID:568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4704 -ip 47041⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 3162⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2328 -ip 23281⤵PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
749KB
MD56112e850db11bf92c85e9c15b51071bd
SHA15662a1cb0248e3b4f878e7df41000cad48027f37
SHA256bed739dea0d60f9cc60842c77c4b93f7074b2258799705d93ff005f4830cd0f6
SHA512e9013590ff16dce1bc95d684854e0e28dccefa96a4afdd3169587798e5847736f197256d1758a811f06041ffbb9ce5685b49752f38b5b18ac96c626c6cfaf70f
-
Filesize
749KB
MD56112e850db11bf92c85e9c15b51071bd
SHA15662a1cb0248e3b4f878e7df41000cad48027f37
SHA256bed739dea0d60f9cc60842c77c4b93f7074b2258799705d93ff005f4830cd0f6
SHA512e9013590ff16dce1bc95d684854e0e28dccefa96a4afdd3169587798e5847736f197256d1758a811f06041ffbb9ce5685b49752f38b5b18ac96c626c6cfaf70f
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
595KB
MD56b6f927fbc131af8b0074276876c7df4
SHA1527101c2b1ada654295e0c252a0d22aaf97de18a
SHA2564fa04d7364261aead2941f8c1526febcd84c512b514adb0b2aa67e8e09644104
SHA512cd8b8d5ebcac45e98208e95776b2eee17a5cd9109e15fe95ddf0e6fb879c3a0c92a5165184425dc3328234cb1acb815d12c4cb6badf29f955ce748067bd4dc05
-
Filesize
595KB
MD56b6f927fbc131af8b0074276876c7df4
SHA1527101c2b1ada654295e0c252a0d22aaf97de18a
SHA2564fa04d7364261aead2941f8c1526febcd84c512b514adb0b2aa67e8e09644104
SHA512cd8b8d5ebcac45e98208e95776b2eee17a5cd9109e15fe95ddf0e6fb879c3a0c92a5165184425dc3328234cb1acb815d12c4cb6badf29f955ce748067bd4dc05
-
Filesize
389KB
MD5088c03d702609c5c89c5b8ba4efd4a52
SHA1d5f40dcea1de1c957f9f09b32ca6fa5409f59bbf
SHA25646296637c0c727156fa7e13510d5845a0df3a5accc884fb3013f705bb198fd11
SHA51270fc78beb7971007f91ffc9a1f1134d2f0f789c69f5ceef832b43eaace1d8141c63438ac1ac88bca6687707ad4531e9d1105bfd4461101d10e29eae5300cefd2
-
Filesize
389KB
MD5088c03d702609c5c89c5b8ba4efd4a52
SHA1d5f40dcea1de1c957f9f09b32ca6fa5409f59bbf
SHA25646296637c0c727156fa7e13510d5845a0df3a5accc884fb3013f705bb198fd11
SHA51270fc78beb7971007f91ffc9a1f1134d2f0f789c69f5ceef832b43eaace1d8141c63438ac1ac88bca6687707ad4531e9d1105bfd4461101d10e29eae5300cefd2
-
Filesize
472KB
MD53d3c1821ae1a1bf22904367408a37ddd
SHA10d0e08492de3b6d2ff08c4a381c2718f0c56b396
SHA256904d231c35e443e286fa9c860699e6aa025931e275be7a1b384fdf07e791c557
SHA512d17260861512ea5bf11ab45b261130367e5ee6188b41029bc783a8857deacbfd4f7d52cacd31fd20b8f9d6140a8b1e4492a96c021c442482a58534788df3d1f6
-
Filesize
472KB
MD53d3c1821ae1a1bf22904367408a37ddd
SHA10d0e08492de3b6d2ff08c4a381c2718f0c56b396
SHA256904d231c35e443e286fa9c860699e6aa025931e275be7a1b384fdf07e791c557
SHA512d17260861512ea5bf11ab45b261130367e5ee6188b41029bc783a8857deacbfd4f7d52cacd31fd20b8f9d6140a8b1e4492a96c021c442482a58534788df3d1f6
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
367KB
MD5053afaab67ee889c102e2760ca0343ff
SHA1eb91aa310a7f1b1ede757159768b9cd461be2053
SHA256e692946bed6d68c393011863b07a7089b61c57528192d07f2932d204a34f4691
SHA51225b112917fccd770737a961019f6a60875bce88af2b73c365c65d9d24fa4be09daf73474580c7758c9e8da8d32cfaa175a682237348272a70b061b8a6f45f278
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5