Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 05:13
Static task
static1
General
-
Target
6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe
-
Size
1.1MB
-
MD5
8f7d580688eae68422f5fb6471790410
-
SHA1
802731e77443bf250d526bcf7e441f1045633b81
-
SHA256
6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14
-
SHA512
dbb575d441e084c4a523f5aeef02e0dd28b0bbff5d8b1d123ba810bd8ce3a57be8537a974e3d459b8f979b9f4260c7e13bc24a21e1a44b0efe26c3d4c280ab4f
-
SSDEEP
24576:vyALd0PmIDnwUuqYIyQhMRDw8cgvmmckRXcA7OiV/QZR:65PmIDnTbYIb8/cdL
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr477187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr477187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr477187.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr477187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr477187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr477187.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si135679.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 3848 un362735.exe 4528 un443051.exe 4980 pr477187.exe 1512 qu764246.exe 4244 rk300948.exe 4092 si135679.exe 3940 oneetx.exe 4512 oneetx.exe 1760 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3832 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr477187.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr477187.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un362735.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un362735.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un443051.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un443051.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 31 IoCs
pid pid_target Process procid_target 2020 4980 WerFault.exe 82 3468 1512 WerFault.exe 90 2152 4092 WerFault.exe 94 4556 4092 WerFault.exe 94 4372 4092 WerFault.exe 94 4324 4092 WerFault.exe 94 3656 4092 WerFault.exe 94 4756 4092 WerFault.exe 94 4080 4092 WerFault.exe 94 4860 4092 WerFault.exe 94 3860 4092 WerFault.exe 94 1620 4092 WerFault.exe 94 3644 3940 WerFault.exe 114 3632 3940 WerFault.exe 114 2712 3940 WerFault.exe 114 4724 3940 WerFault.exe 114 932 3940 WerFault.exe 114 4076 3940 WerFault.exe 114 3152 3940 WerFault.exe 114 4848 3940 WerFault.exe 114 2260 3940 WerFault.exe 114 5040 3940 WerFault.exe 114 1008 3940 WerFault.exe 114 1668 3940 WerFault.exe 114 1512 3940 WerFault.exe 114 512 4512 WerFault.exe 152 3696 3940 WerFault.exe 114 3656 3940 WerFault.exe 114 116 3940 WerFault.exe 114 1492 1760 WerFault.exe 167 2116 3940 WerFault.exe 114 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3276 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4980 pr477187.exe 4980 pr477187.exe 1512 qu764246.exe 1512 qu764246.exe 4244 rk300948.exe 4244 rk300948.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4980 pr477187.exe Token: SeDebugPrivilege 1512 qu764246.exe Token: SeDebugPrivilege 4244 rk300948.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4092 si135679.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3140 wrote to memory of 3848 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 80 PID 3140 wrote to memory of 3848 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 80 PID 3140 wrote to memory of 3848 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 80 PID 3848 wrote to memory of 4528 3848 un362735.exe 81 PID 3848 wrote to memory of 4528 3848 un362735.exe 81 PID 3848 wrote to memory of 4528 3848 un362735.exe 81 PID 4528 wrote to memory of 4980 4528 un443051.exe 82 PID 4528 wrote to memory of 4980 4528 un443051.exe 82 PID 4528 wrote to memory of 4980 4528 un443051.exe 82 PID 4528 wrote to memory of 1512 4528 un443051.exe 90 PID 4528 wrote to memory of 1512 4528 un443051.exe 90 PID 4528 wrote to memory of 1512 4528 un443051.exe 90 PID 3848 wrote to memory of 4244 3848 un362735.exe 93 PID 3848 wrote to memory of 4244 3848 un362735.exe 93 PID 3848 wrote to memory of 4244 3848 un362735.exe 93 PID 3140 wrote to memory of 4092 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 94 PID 3140 wrote to memory of 4092 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 94 PID 3140 wrote to memory of 4092 3140 6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe 94 PID 4092 wrote to memory of 3940 4092 si135679.exe 114 PID 4092 wrote to memory of 3940 4092 si135679.exe 114 PID 4092 wrote to memory of 3940 4092 si135679.exe 114 PID 3940 wrote to memory of 3276 3940 oneetx.exe 132 PID 3940 wrote to memory of 3276 3940 oneetx.exe 132 PID 3940 wrote to memory of 3276 3940 oneetx.exe 132 PID 3940 wrote to memory of 4404 3940 oneetx.exe 140 PID 3940 wrote to memory of 4404 3940 oneetx.exe 140 PID 3940 wrote to memory of 4404 3940 oneetx.exe 140 PID 4404 wrote to memory of 2156 4404 cmd.exe 143 PID 4404 wrote to memory of 2156 4404 cmd.exe 143 PID 4404 wrote to memory of 2156 4404 cmd.exe 143 PID 4404 wrote to memory of 2208 4404 cmd.exe 144 PID 4404 wrote to memory of 2208 4404 cmd.exe 144 PID 4404 wrote to memory of 2208 4404 cmd.exe 144 PID 4404 wrote to memory of 3588 4404 cmd.exe 146 PID 4404 wrote to memory of 3588 4404 cmd.exe 146 PID 4404 wrote to memory of 3588 4404 cmd.exe 146 PID 4404 wrote to memory of 3556 4404 cmd.exe 147 PID 4404 wrote to memory of 3556 4404 cmd.exe 147 PID 4404 wrote to memory of 3556 4404 cmd.exe 147 PID 4404 wrote to memory of 1496 4404 cmd.exe 148 PID 4404 wrote to memory of 1496 4404 cmd.exe 148 PID 4404 wrote to memory of 1496 4404 cmd.exe 148 PID 4404 wrote to memory of 2028 4404 cmd.exe 149 PID 4404 wrote to memory of 2028 4404 cmd.exe 149 PID 4404 wrote to memory of 2028 4404 cmd.exe 149 PID 3940 wrote to memory of 3832 3940 oneetx.exe 164 PID 3940 wrote to memory of 3832 3940 oneetx.exe 164 PID 3940 wrote to memory of 3832 3940 oneetx.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe"C:\Users\Admin\AppData\Local\Temp\6be144bf89c7b04564b8a0f29b57533ee5a8fd24a32054b375c6c8298c658d14.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un362735.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un362735.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un443051.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un443051.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr477187.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr477187.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 10805⤵
- Program crash
PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu764246.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu764246.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 14605⤵
- Program crash
PID:3468
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk300948.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk300948.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si135679.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si135679.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 7043⤵
- Program crash
PID:2152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 7803⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 8563⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 9443⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 9763⤵
- Program crash
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 8683⤵
- Program crash
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 12083⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 12243⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 13163⤵
- Program crash
PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 6924⤵
- Program crash
PID:3644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 8444⤵
- Program crash
PID:3632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 8964⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 10524⤵
- Program crash
PID:4724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 10724⤵
- Program crash
PID:932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 10724⤵
- Program crash
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11204⤵
- Program crash
PID:3152
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 9924⤵
- Program crash
PID:4848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7764⤵
- Program crash
PID:2260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2156
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2208
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3556
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:1496
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:2028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 13004⤵
- Program crash
PID:5040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 8524⤵
- Program crash
PID:1008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7564⤵
- Program crash
PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 8964⤵
- Program crash
PID:1512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 15484⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 16044⤵
- Program crash
PID:3656
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 15484⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 16204⤵
- Program crash
PID:2116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 8643⤵
- Program crash
PID:1620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4980 -ip 49801⤵PID:3420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1512 -ip 15121⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4092 -ip 40921⤵PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4092 -ip 40921⤵PID:4260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4092 -ip 40921⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4092 -ip 40921⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4092 -ip 40921⤵PID:3528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4092 -ip 40921⤵PID:3824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4092 -ip 40921⤵PID:100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4092 -ip 40921⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4092 -ip 40921⤵PID:1840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4092 -ip 40921⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3940 -ip 39401⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3940 -ip 39401⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3940 -ip 39401⤵PID:2164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3940 -ip 39401⤵PID:1384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3940 -ip 39401⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3940 -ip 39401⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3940 -ip 39401⤵PID:3324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3940 -ip 39401⤵PID:4144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3940 -ip 39401⤵PID:4924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3940 -ip 39401⤵PID:4396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3940 -ip 39401⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 3122⤵
- Program crash
PID:512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3940 -ip 39401⤵PID:1416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3940 -ip 39401⤵PID:1800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4512 -ip 45121⤵PID:560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3940 -ip 39401⤵PID:1820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3940 -ip 39401⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3940 -ip 39401⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 3122⤵
- Program crash
PID:1492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1760 -ip 17601⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3940 -ip 39401⤵PID:4644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
762KB
MD5deeeded16d8ed410bd6b230c16bb450a
SHA1a2de9e392f6f6da38c6797693ee00a64d93a1c74
SHA2561e8c7506a9fe39fd4ced796e99cecdc1e93639b3072742246e69b0c7132032cd
SHA512144480f854064af56e5992c2eccd034f0c2de6b3bbef7c6ae29b6be775271e106305c6c63f7d66477460713b8a878be8bb4f4df9fdbd49d88d6fff24b8a5fcc0
-
Filesize
762KB
MD5deeeded16d8ed410bd6b230c16bb450a
SHA1a2de9e392f6f6da38c6797693ee00a64d93a1c74
SHA2561e8c7506a9fe39fd4ced796e99cecdc1e93639b3072742246e69b0c7132032cd
SHA512144480f854064af56e5992c2eccd034f0c2de6b3bbef7c6ae29b6be775271e106305c6c63f7d66477460713b8a878be8bb4f4df9fdbd49d88d6fff24b8a5fcc0
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
608KB
MD54f4e7910e23e3a963916b61e4b9494f5
SHA131f690ec93927c8ef58c4aa6741523f0ac11ab73
SHA256b2851e0e3554c00a08ec34b59ce984c93dae97f5a76d70b5e4650c5a94d59b13
SHA51200dec172b7be462eee37534e3a55871151918aeb4cbb628a5e9a071b843627175439d4462e5553afe6450d7f92b2b914de5084a12d68ed13a1cac4a916ed1801
-
Filesize
608KB
MD54f4e7910e23e3a963916b61e4b9494f5
SHA131f690ec93927c8ef58c4aa6741523f0ac11ab73
SHA256b2851e0e3554c00a08ec34b59ce984c93dae97f5a76d70b5e4650c5a94d59b13
SHA51200dec172b7be462eee37534e3a55871151918aeb4cbb628a5e9a071b843627175439d4462e5553afe6450d7f92b2b914de5084a12d68ed13a1cac4a916ed1801
-
Filesize
403KB
MD510b4dc4b8d83c2f96078583eb8880ea7
SHA188ac38e11f478dd90221624cfe268bc75a28a6de
SHA256a9177f6cd7f336b20de1df0f6880275f1d100c8bcc125112b497f7981fe58191
SHA512e10f1a6dd98ab460e857dcc54d4639b5b5ae0c4b5d66b2f4400bbf4614b2e70df237ee602a93556567a74a3dc70b95a0dc54a6444dcd3b60270719ed4481af10
-
Filesize
403KB
MD510b4dc4b8d83c2f96078583eb8880ea7
SHA188ac38e11f478dd90221624cfe268bc75a28a6de
SHA256a9177f6cd7f336b20de1df0f6880275f1d100c8bcc125112b497f7981fe58191
SHA512e10f1a6dd98ab460e857dcc54d4639b5b5ae0c4b5d66b2f4400bbf4614b2e70df237ee602a93556567a74a3dc70b95a0dc54a6444dcd3b60270719ed4481af10
-
Filesize
485KB
MD5f943dda3985c403ad627b933ceb374a8
SHA1a929e2062f077e7584f05d1486e12a0a2e1f6f2e
SHA25654c78e840b43bdce878807d89bd28fa2c8a93bb5b9bc09c8c2b614e390b5f7a4
SHA512198e0b6f0290068713cd129e3d40332efb5f2c14890987ccc1dc3e84214129112e198b806d58e3274e8761848e9027efdf6ab4cb9d02c5de8a711d91533d9744
-
Filesize
485KB
MD5f943dda3985c403ad627b933ceb374a8
SHA1a929e2062f077e7584f05d1486e12a0a2e1f6f2e
SHA25654c78e840b43bdce878807d89bd28fa2c8a93bb5b9bc09c8c2b614e390b5f7a4
SHA512198e0b6f0290068713cd129e3d40332efb5f2c14890987ccc1dc3e84214129112e198b806d58e3274e8761848e9027efdf6ab4cb9d02c5de8a711d91533d9744
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
381KB
MD552195c36974e91c1d6ca48f49988e017
SHA1b335b3a7e465f906e5ec6296e8dcbc71eea18a97
SHA256d85d89805754d0fbaec2c2fe30b47dfc8c597c33cc29ed54768242361628afc3
SHA51275d531b0873bca4ebe560f8cf5c1ec76fb685a2647b3c160810aba90be10a8e9c02f4dcd1a3dcccf67a044fe37d70e360b7b9b24e17d8460ca53c0c92785b3bb
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5