Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 03:32
Static task
static1
General
-
Target
1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe
-
Size
964KB
-
MD5
3113d16dc5fe3b5a5b69082a114262a3
-
SHA1
a74d9de7b37dece5b17e0a8b59b8b10d133fc42c
-
SHA256
1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64
-
SHA512
16b21d2bdfe4046fe0b2b9b42d4166a95905e4d681a27d85ae19cb8b8f74e9d8bf5b72128389f051a4993cc339b7e7a0840dc6474dcd1a0c6d77fde0f6409892
-
SSDEEP
24576:4yYYt5LoUHyrmWbmAhbCwsWK6O/hvHFSHLKhYr:/Ys5LogAhZsfllm2h
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr978948.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr978948.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr978948.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr978948.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr978948.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr978948.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si687083.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2908 un637007.exe 4872 un416243.exe 4808 pr978948.exe 4496 qu602658.exe 1664 rk681609.exe 808 si687083.exe 3700 oneetx.exe 1784 oneetx.exe 1372 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 452 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr978948.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr978948.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un637007.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un637007.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un416243.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un416243.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 29 IoCs
pid pid_target Process procid_target 3012 808 WerFault.exe 91 844 808 WerFault.exe 91 4340 808 WerFault.exe 91 3744 808 WerFault.exe 91 4916 808 WerFault.exe 91 2712 808 WerFault.exe 91 3480 808 WerFault.exe 91 3436 808 WerFault.exe 91 3036 808 WerFault.exe 91 376 808 WerFault.exe 91 1972 3700 WerFault.exe 111 1400 3700 WerFault.exe 111 3724 3700 WerFault.exe 111 2628 3700 WerFault.exe 111 4876 3700 WerFault.exe 111 1616 3700 WerFault.exe 111 1548 3700 WerFault.exe 111 2524 3700 WerFault.exe 111 756 3700 WerFault.exe 111 3392 3700 WerFault.exe 111 4976 3700 WerFault.exe 111 5084 3700 WerFault.exe 111 3512 3700 WerFault.exe 111 4360 1784 WerFault.exe 154 1364 3700 WerFault.exe 111 424 3700 WerFault.exe 111 1344 3700 WerFault.exe 111 2708 1372 WerFault.exe 164 3324 3700 WerFault.exe 111 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3492 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4808 pr978948.exe 4808 pr978948.exe 4496 qu602658.exe 4496 qu602658.exe 1664 rk681609.exe 1664 rk681609.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4808 pr978948.exe Token: SeDebugPrivilege 4496 qu602658.exe Token: SeDebugPrivilege 1664 rk681609.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 808 si687083.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2908 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 83 PID 1584 wrote to memory of 2908 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 83 PID 1584 wrote to memory of 2908 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 83 PID 2908 wrote to memory of 4872 2908 un637007.exe 84 PID 2908 wrote to memory of 4872 2908 un637007.exe 84 PID 2908 wrote to memory of 4872 2908 un637007.exe 84 PID 4872 wrote to memory of 4808 4872 un416243.exe 85 PID 4872 wrote to memory of 4808 4872 un416243.exe 85 PID 4872 wrote to memory of 4808 4872 un416243.exe 85 PID 4872 wrote to memory of 4496 4872 un416243.exe 89 PID 4872 wrote to memory of 4496 4872 un416243.exe 89 PID 4872 wrote to memory of 4496 4872 un416243.exe 89 PID 2908 wrote to memory of 1664 2908 un637007.exe 90 PID 2908 wrote to memory of 1664 2908 un637007.exe 90 PID 2908 wrote to memory of 1664 2908 un637007.exe 90 PID 1584 wrote to memory of 808 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 91 PID 1584 wrote to memory of 808 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 91 PID 1584 wrote to memory of 808 1584 1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe 91 PID 808 wrote to memory of 3700 808 si687083.exe 111 PID 808 wrote to memory of 3700 808 si687083.exe 111 PID 808 wrote to memory of 3700 808 si687083.exe 111 PID 3700 wrote to memory of 3492 3700 oneetx.exe 129 PID 3700 wrote to memory of 3492 3700 oneetx.exe 129 PID 3700 wrote to memory of 3492 3700 oneetx.exe 129 PID 3700 wrote to memory of 2400 3700 oneetx.exe 135 PID 3700 wrote to memory of 2400 3700 oneetx.exe 135 PID 3700 wrote to memory of 2400 3700 oneetx.exe 135 PID 2400 wrote to memory of 1788 2400 cmd.exe 138 PID 2400 wrote to memory of 1788 2400 cmd.exe 138 PID 2400 wrote to memory of 1788 2400 cmd.exe 138 PID 2400 wrote to memory of 5076 2400 cmd.exe 139 PID 2400 wrote to memory of 5076 2400 cmd.exe 139 PID 2400 wrote to memory of 5076 2400 cmd.exe 139 PID 2400 wrote to memory of 948 2400 cmd.exe 141 PID 2400 wrote to memory of 948 2400 cmd.exe 141 PID 2400 wrote to memory of 948 2400 cmd.exe 141 PID 2400 wrote to memory of 3056 2400 cmd.exe 143 PID 2400 wrote to memory of 3056 2400 cmd.exe 143 PID 2400 wrote to memory of 3056 2400 cmd.exe 143 PID 2400 wrote to memory of 1408 2400 cmd.exe 142 PID 2400 wrote to memory of 1408 2400 cmd.exe 142 PID 2400 wrote to memory of 1408 2400 cmd.exe 142 PID 2400 wrote to memory of 2520 2400 cmd.exe 144 PID 2400 wrote to memory of 2520 2400 cmd.exe 144 PID 2400 wrote to memory of 2520 2400 cmd.exe 144 PID 3700 wrote to memory of 452 3700 oneetx.exe 161 PID 3700 wrote to memory of 452 3700 oneetx.exe 161 PID 3700 wrote to memory of 452 3700 oneetx.exe 161
Processes
-
C:\Users\Admin\AppData\Local\Temp\1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe"C:\Users\Admin\AppData\Local\Temp\1925516d2fa113601bb97bc9252a65bf4f36f903fc4adec47fd5b8b0d2a0ec64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un637007.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un637007.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un416243.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un416243.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr978948.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr978948.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu602658.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu602658.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk681609.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk681609.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si687083.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si687083.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 6963⤵
- Program crash
PID:3012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 7923⤵
- Program crash
PID:844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 8203⤵
- Program crash
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 7243⤵
- Program crash
PID:3744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 9643⤵
- Program crash
PID:4916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 9643⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 12043⤵
- Program crash
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 12283⤵
- Program crash
PID:3436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 13163⤵
- Program crash
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 6924⤵
- Program crash
PID:1972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 8284⤵
- Program crash
PID:1400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7924⤵
- Program crash
PID:3724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 10524⤵
- Program crash
PID:2628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 10884⤵
- Program crash
PID:4876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 11084⤵
- Program crash
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 11044⤵
- Program crash
PID:1548
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7764⤵
- Program crash
PID:2524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7284⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1788
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:5076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:948
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3056
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:2520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 10964⤵
- Program crash
PID:3392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7604⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1324⤵
- Program crash
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 7804⤵
- Program crash
PID:3512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 11364⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 16484⤵
- Program crash
PID:424
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 16044⤵
- Program crash
PID:1344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 16804⤵
- Program crash
PID:3324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 9603⤵
- Program crash
PID:376
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 808 -ip 8081⤵PID:916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 808 -ip 8081⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 808 -ip 8081⤵PID:652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 808 -ip 8081⤵PID:3600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 808 -ip 8081⤵PID:1140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 808 -ip 8081⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 808 -ip 8081⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 808 -ip 8081⤵PID:452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 808 -ip 8081⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 808 -ip 8081⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3700 -ip 37001⤵PID:4952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 37001⤵PID:2088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 37001⤵PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3700 -ip 37001⤵PID:3968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 37001⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 37001⤵PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3700 -ip 37001⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3700 -ip 37001⤵PID:4144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3700 -ip 37001⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3700 -ip 37001⤵PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 37001⤵PID:3320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 37001⤵PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3700 -ip 37001⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 2162⤵
- Program crash
PID:4360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1784 -ip 17841⤵PID:2616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3700 -ip 37001⤵PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 37001⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 37001⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 3202⤵
- Program crash
PID:2708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1372 -ip 13721⤵PID:3228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3700 -ip 37001⤵PID:444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
705KB
MD5176a180777a8ca6132f6ac0f896feed5
SHA117df1a1535d144546c9f99f8c2ee956c0733769d
SHA256164a98a51e6c1afce2928466455e64c22dc8e211a22b63289f3ab0dbe7bb49ec
SHA512c6d3d5d5b5b8fe7f2ecdd05ce31222651a6967c8be42a1a9b9af0b4b60abf4923b0e09cabd363c3b0c89ef2914e29f72cb4e727e46a90db23a2cf22a2d2eb78c
-
Filesize
705KB
MD5176a180777a8ca6132f6ac0f896feed5
SHA117df1a1535d144546c9f99f8c2ee956c0733769d
SHA256164a98a51e6c1afce2928466455e64c22dc8e211a22b63289f3ab0dbe7bb49ec
SHA512c6d3d5d5b5b8fe7f2ecdd05ce31222651a6967c8be42a1a9b9af0b4b60abf4923b0e09cabd363c3b0c89ef2914e29f72cb4e727e46a90db23a2cf22a2d2eb78c
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
551KB
MD566e64d42d873c45fd38f06c1deb5da6e
SHA13850b459ddf6b53be5936b534f01d744b338c07f
SHA256784c06c28ba3de6acd61eb0f074af02fba0ec7947e35711d020cf89fcadcd748
SHA5122fd80448544a7a4c6c91a7f5abd104f8ff3dc72d047b76452388ce06801a9c7a9306fb28f30b5537c99b6e60cf8f84c54928f961a0c4c80fd945121741252364
-
Filesize
551KB
MD566e64d42d873c45fd38f06c1deb5da6e
SHA13850b459ddf6b53be5936b534f01d744b338c07f
SHA256784c06c28ba3de6acd61eb0f074af02fba0ec7947e35711d020cf89fcadcd748
SHA5122fd80448544a7a4c6c91a7f5abd104f8ff3dc72d047b76452388ce06801a9c7a9306fb28f30b5537c99b6e60cf8f84c54928f961a0c4c80fd945121741252364
-
Filesize
278KB
MD5760517c16852265c9987718beb83f3a0
SHA170e611d205ef684a906583afb7de0261e2afd7f6
SHA2565ba544e8db70780e8172a657299b1a61f73ea9ee9a6ff2c565c179b02cc7e5c1
SHA51212e32a1388d93ac3413cbdb2518a5f36ca3d54b96e3997f59972fb0d680889eac0dc0c1e48a5a7e4addecc64f79012b970acdd489a338ddf5965c48f769bc3e6
-
Filesize
278KB
MD5760517c16852265c9987718beb83f3a0
SHA170e611d205ef684a906583afb7de0261e2afd7f6
SHA2565ba544e8db70780e8172a657299b1a61f73ea9ee9a6ff2c565c179b02cc7e5c1
SHA51212e32a1388d93ac3413cbdb2518a5f36ca3d54b96e3997f59972fb0d680889eac0dc0c1e48a5a7e4addecc64f79012b970acdd489a338ddf5965c48f769bc3e6
-
Filesize
360KB
MD5f5fe13f57ab539ee7c7810c2ca4c7f5e
SHA182e9b0a49dc8f0815c30a117d9beb6282756efbe
SHA256d42b35bc56d08924123a91fc113182e9a7cf5c5f2010fca68176294482f04edd
SHA512bfadd4e997c5c0daf48a7f9ab7aa64e99e6cf531cf03966eac74a8a744e587281c2a0233fc0cb981a11d36d790b70e964b5dd6384e85fc475cb74ba75da4a87f
-
Filesize
360KB
MD5f5fe13f57ab539ee7c7810c2ca4c7f5e
SHA182e9b0a49dc8f0815c30a117d9beb6282756efbe
SHA256d42b35bc56d08924123a91fc113182e9a7cf5c5f2010fca68176294482f04edd
SHA512bfadd4e997c5c0daf48a7f9ab7aa64e99e6cf531cf03966eac74a8a744e587281c2a0233fc0cb981a11d36d790b70e964b5dd6384e85fc475cb74ba75da4a87f
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
256KB
MD548715422962f973ec3cadcc5f4bdc1a3
SHA1cea3fedc6e74a70ec74f625a7d24b27e29b90b76
SHA2563a84ffc3566210c6e3dbe984983433ad5f9590512659cb037ecc0cac1e6d18b5
SHA51291192c87a29b3a67cd78d7fd684388a525638c262ef267c04ae96b7cd77013e2f81fc0e2b6105bfa8e9df8f67b22d29157bd416f9fc9eac357a9ecc7737e2e46
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5