Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 00:48
Static task
static1
General
-
Target
67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe
-
Size
963KB
-
MD5
314d3a69e5273260f14f5806b22ac0ed
-
SHA1
4917e8889d9d389d99aa9746b4ca3298b816669b
-
SHA256
67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b
-
SHA512
ba9988c406ec8ac0d113c2b87b8d440d19a5a1c9398aef2a8feccf3524bfc0ba4e50aee14ad1f5277ff272ca8121e78d91930d754ba8e07462030e31fa10a3ce
-
SSDEEP
24576:VyTTtCKQuj+pJBJEkYcfCNZPyQWbXHGAFM8N0kW1g:wVCuCpJB6kYcf4rWDGsN0kW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr753110.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation si300921.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 2504 un496148.exe 4464 un837634.exe 1684 pr753110.exe 1880 qu910510.exe 1324 rk825402.exe 2312 si300921.exe 1168 oneetx.exe 4652 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2580 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr753110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr753110.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un496148.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un496148.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un837634.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un837634.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 4400 1880 WerFault.exe 90 1768 2312 WerFault.exe 95 3336 2312 WerFault.exe 95 2160 2312 WerFault.exe 95 1016 2312 WerFault.exe 95 8 2312 WerFault.exe 95 5060 2312 WerFault.exe 95 3884 2312 WerFault.exe 95 3648 2312 WerFault.exe 95 940 2312 WerFault.exe 95 3680 2312 WerFault.exe 95 3520 1168 WerFault.exe 115 4420 1168 WerFault.exe 115 3576 1168 WerFault.exe 115 1796 1168 WerFault.exe 115 4008 1168 WerFault.exe 115 2896 1168 WerFault.exe 115 3840 1168 WerFault.exe 115 1812 1168 WerFault.exe 115 884 1168 WerFault.exe 115 2096 1168 WerFault.exe 115 2060 1168 WerFault.exe 115 904 1168 WerFault.exe 115 2336 1168 WerFault.exe 115 4880 1168 WerFault.exe 115 2368 1168 WerFault.exe 115 1664 1168 WerFault.exe 115 1904 4652 WerFault.exe 164 2488 1168 WerFault.exe 115 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1684 pr753110.exe 1684 pr753110.exe 1880 qu910510.exe 1880 qu910510.exe 1324 rk825402.exe 1324 rk825402.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1684 pr753110.exe Token: SeDebugPrivilege 1880 qu910510.exe Token: SeDebugPrivilege 1324 rk825402.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 si300921.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2504 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 84 PID 1640 wrote to memory of 2504 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 84 PID 1640 wrote to memory of 2504 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 84 PID 2504 wrote to memory of 4464 2504 un496148.exe 85 PID 2504 wrote to memory of 4464 2504 un496148.exe 85 PID 2504 wrote to memory of 4464 2504 un496148.exe 85 PID 4464 wrote to memory of 1684 4464 un837634.exe 86 PID 4464 wrote to memory of 1684 4464 un837634.exe 86 PID 4464 wrote to memory of 1684 4464 un837634.exe 86 PID 4464 wrote to memory of 1880 4464 un837634.exe 90 PID 4464 wrote to memory of 1880 4464 un837634.exe 90 PID 4464 wrote to memory of 1880 4464 un837634.exe 90 PID 2504 wrote to memory of 1324 2504 un496148.exe 93 PID 2504 wrote to memory of 1324 2504 un496148.exe 93 PID 2504 wrote to memory of 1324 2504 un496148.exe 93 PID 1640 wrote to memory of 2312 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 95 PID 1640 wrote to memory of 2312 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 95 PID 1640 wrote to memory of 2312 1640 67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe 95 PID 2312 wrote to memory of 1168 2312 si300921.exe 115 PID 2312 wrote to memory of 1168 2312 si300921.exe 115 PID 2312 wrote to memory of 1168 2312 si300921.exe 115 PID 1168 wrote to memory of 1532 1168 oneetx.exe 134 PID 1168 wrote to memory of 1532 1168 oneetx.exe 134 PID 1168 wrote to memory of 1532 1168 oneetx.exe 134 PID 1168 wrote to memory of 3720 1168 oneetx.exe 141 PID 1168 wrote to memory of 3720 1168 oneetx.exe 141 PID 1168 wrote to memory of 3720 1168 oneetx.exe 141 PID 3720 wrote to memory of 4368 3720 cmd.exe 145 PID 3720 wrote to memory of 4368 3720 cmd.exe 145 PID 3720 wrote to memory of 4368 3720 cmd.exe 145 PID 3720 wrote to memory of 1992 3720 cmd.exe 146 PID 3720 wrote to memory of 1992 3720 cmd.exe 146 PID 3720 wrote to memory of 1992 3720 cmd.exe 146 PID 3720 wrote to memory of 1480 3720 cmd.exe 147 PID 3720 wrote to memory of 1480 3720 cmd.exe 147 PID 3720 wrote to memory of 1480 3720 cmd.exe 147 PID 3720 wrote to memory of 452 3720 cmd.exe 148 PID 3720 wrote to memory of 452 3720 cmd.exe 148 PID 3720 wrote to memory of 452 3720 cmd.exe 148 PID 3720 wrote to memory of 3780 3720 cmd.exe 149 PID 3720 wrote to memory of 3780 3720 cmd.exe 149 PID 3720 wrote to memory of 3780 3720 cmd.exe 149 PID 3720 wrote to memory of 2616 3720 cmd.exe 150 PID 3720 wrote to memory of 2616 3720 cmd.exe 150 PID 3720 wrote to memory of 2616 3720 cmd.exe 150 PID 1168 wrote to memory of 2580 1168 oneetx.exe 161 PID 1168 wrote to memory of 2580 1168 oneetx.exe 161 PID 1168 wrote to memory of 2580 1168 oneetx.exe 161
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe"C:\Users\Admin\AppData\Local\Temp\67d2e2970d531dbf72ef6a04aac3377da001f33e54daf2ff864b8d36f295a93b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un496148.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un496148.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un837634.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un837634.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr753110.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr753110.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu910510.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu910510.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 13245⤵
- Program crash
PID:4400
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk825402.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk825402.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300921.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si300921.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 6963⤵
- Program crash
PID:1768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 7803⤵
- Program crash
PID:3336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 8563⤵
- Program crash
PID:2160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 9603⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 9603⤵
- Program crash
PID:8
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 8563⤵
- Program crash
PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 12163⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 12083⤵
- Program crash
PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 13123⤵
- Program crash
PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 6924⤵
- Program crash
PID:3520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8204⤵
- Program crash
PID:4420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8924⤵
- Program crash
PID:3576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 10524⤵
- Program crash
PID:1796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 10604⤵
- Program crash
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 11124⤵
- Program crash
PID:2896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 10684⤵
- Program crash
PID:3840
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 9924⤵
- Program crash
PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 12644⤵
- Program crash
PID:884
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4368
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1992
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:452
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3780
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:2616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 13484⤵
- Program crash
PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 13244⤵
- Program crash
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 13044⤵
- Program crash
PID:904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1324⤵
- Program crash
PID:2336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 10844⤵
- Program crash
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 6764⤵
- Program crash
PID:2368
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 14764⤵
- Program crash
PID:1664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 11244⤵
- Program crash
PID:2488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 13883⤵
- Program crash
PID:3680
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1880 -ip 18801⤵PID:4204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2312 -ip 23121⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2312 -ip 23121⤵PID:1820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2312 -ip 23121⤵PID:4888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2312 -ip 23121⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2312 -ip 23121⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2312 -ip 23121⤵PID:1316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2312 -ip 23121⤵PID:3856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2312 -ip 23121⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2312 -ip 23121⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2312 -ip 23121⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1168 -ip 11681⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1168 -ip 11681⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1168 -ip 11681⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1168 -ip 11681⤵PID:2792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1168 -ip 11681⤵PID:4064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1168 -ip 11681⤵PID:2404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1168 -ip 11681⤵PID:560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1168 -ip 11681⤵PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1168 -ip 11681⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1168 -ip 11681⤵PID:4204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1168 -ip 11681⤵PID:1468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 11681⤵PID:3056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1168 -ip 11681⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1168 -ip 11681⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1168 -ip 11681⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1168 -ip 11681⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 2162⤵
- Program crash
PID:1904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4652 -ip 46521⤵PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1168 -ip 11681⤵PID:3388
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
705KB
MD5e3264f57b76289b3770a3aeae45c3ea2
SHA133f548b03a5a51e8a37cea8f0bf4a41308227501
SHA2561af258b0e94812ac0f3793542ee0ab294d1701e05fe6d362d31c142501ec0d10
SHA512aef7706d2b3a8b9e8fe05be7e1ea73e36c0b16f1866c94b71f8e36846d3f9cb832a2bbdf288432963068a9e84fe956312cd646b4b58b0e5a6037b5ebb0b248f7
-
Filesize
705KB
MD5e3264f57b76289b3770a3aeae45c3ea2
SHA133f548b03a5a51e8a37cea8f0bf4a41308227501
SHA2561af258b0e94812ac0f3793542ee0ab294d1701e05fe6d362d31c142501ec0d10
SHA512aef7706d2b3a8b9e8fe05be7e1ea73e36c0b16f1866c94b71f8e36846d3f9cb832a2bbdf288432963068a9e84fe956312cd646b4b58b0e5a6037b5ebb0b248f7
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
551KB
MD577a109f2a8ee27a33fd3f1d15b366683
SHA137b1957571725e109397eac5727fe5bc16e60c7b
SHA256000bc6bc5d94f5d9016e912dc7f54132deb5c4d78e931e382ad492551d09d4db
SHA512be7d99097f66819841c956fe585028c8918d5be70850a2cf30c2aaf09aae14a3e76d351d2426594da43d693fe6db64d4d1e4893fa0e5800a0437298696dcd678
-
Filesize
551KB
MD577a109f2a8ee27a33fd3f1d15b366683
SHA137b1957571725e109397eac5727fe5bc16e60c7b
SHA256000bc6bc5d94f5d9016e912dc7f54132deb5c4d78e931e382ad492551d09d4db
SHA512be7d99097f66819841c956fe585028c8918d5be70850a2cf30c2aaf09aae14a3e76d351d2426594da43d693fe6db64d4d1e4893fa0e5800a0437298696dcd678
-
Filesize
278KB
MD5370fef66482be99c71a27178cbfebe20
SHA169e5279b5a51829af3cdecc53a0d772163963bc7
SHA25683ace79cf59eb1c114190e425ceab52bf2e3d53dd3aa4f70c1fc57f8e3e430b2
SHA5120a125f4a65fb0d5168b25bbc98f0f9deb3470a3fa94d7d5bdba37be70e535b9bdb7a4b3694465dc979a6805593c4d6ca441136a35f63f764e7bdb27ab54542c3
-
Filesize
278KB
MD5370fef66482be99c71a27178cbfebe20
SHA169e5279b5a51829af3cdecc53a0d772163963bc7
SHA25683ace79cf59eb1c114190e425ceab52bf2e3d53dd3aa4f70c1fc57f8e3e430b2
SHA5120a125f4a65fb0d5168b25bbc98f0f9deb3470a3fa94d7d5bdba37be70e535b9bdb7a4b3694465dc979a6805593c4d6ca441136a35f63f764e7bdb27ab54542c3
-
Filesize
359KB
MD569289dd0b674e84079f451e7a2004a93
SHA11edf540d337ea6316fab16a58b166daa3bfc6073
SHA2566e273b0ad05765f6cf2ff03a9e210b3c15d543557eb5a00422c4b41f824bfd98
SHA512cef9135230d794dc20ddb04762658d1a9b7b870f619b38c1b8eb863b4a09d37a76380835806ac2eeab81ee5081ccc74419fc2a802b20753138fbf95227ce087a
-
Filesize
359KB
MD569289dd0b674e84079f451e7a2004a93
SHA11edf540d337ea6316fab16a58b166daa3bfc6073
SHA2566e273b0ad05765f6cf2ff03a9e210b3c15d543557eb5a00422c4b41f824bfd98
SHA512cef9135230d794dc20ddb04762658d1a9b7b870f619b38c1b8eb863b4a09d37a76380835806ac2eeab81ee5081ccc74419fc2a802b20753138fbf95227ce087a
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
256KB
MD5d3cb624b4da0ad9e02a8d39f4606c08e
SHA13d4fbb9cab64df3d8da9b9a1ba082d3bb5f6038e
SHA256b3947cddbc9cd8d6757030b46c1efa326f3e5d91df91858f872340a4906366fd
SHA512bd6f7803b4e0326adc28aba4aed30ec0b923f28716ab29b97a7dad56aad57a36f731180235a8a997623dc8db8a0d2ffd0a84301a48aca3404a688a08d3cf568b
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5