Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 08:14
Static task
static1
General
-
Target
c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe
-
Size
1.1MB
-
MD5
e16290cfa891764dc9a0da06ce990f55
-
SHA1
67e9e45e6615909b800069824d33c56a2e4a9993
-
SHA256
c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f
-
SHA512
e281da5169e0224f461c818b9dd4c64d80969fecbffbbad70b5420c6bd86b30455693b13d863d4dcfcea1ea844295e298cbc92746e1c59de17b22d8f790d38cf
-
SSDEEP
12288:6y90zrkGQH76joEcsglX6vaLKsqC3N1IY9xdeoGDDOMFW1iwIa5/L18S0X2SI9Su:6y8y76jonlqvI1RdeoGC1iQZeQcgy4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr735305.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr735305.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr735305.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr735305.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr735305.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr735305.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation si753148.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1456 un301920.exe 1216 un649729.exe 3408 pr735305.exe 4684 qu033044.exe 996 rk047646.exe 4256 si753148.exe 2392 oneetx.exe 1164 oneetx.exe 1676 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1792 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr735305.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr735305.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un301920.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un301920.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un649729.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un649729.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 31 IoCs
pid pid_target Process procid_target 1812 3408 WerFault.exe 87 4136 4684 WerFault.exe 93 3564 4256 WerFault.exe 97 4988 4256 WerFault.exe 97 3820 4256 WerFault.exe 97 4752 4256 WerFault.exe 97 1396 4256 WerFault.exe 97 1592 4256 WerFault.exe 97 4436 4256 WerFault.exe 97 2040 4256 WerFault.exe 97 5096 4256 WerFault.exe 97 3484 4256 WerFault.exe 97 4148 2392 WerFault.exe 117 3624 2392 WerFault.exe 117 2324 2392 WerFault.exe 117 1300 2392 WerFault.exe 117 1892 2392 WerFault.exe 117 4476 2392 WerFault.exe 117 4092 2392 WerFault.exe 117 3412 2392 WerFault.exe 117 1896 2392 WerFault.exe 117 3652 2392 WerFault.exe 117 4452 2392 WerFault.exe 117 396 2392 WerFault.exe 117 5040 2392 WerFault.exe 117 2140 2392 WerFault.exe 117 1316 1164 WerFault.exe 162 2696 2392 WerFault.exe 117 1768 2392 WerFault.exe 117 4384 2392 WerFault.exe 117 4456 1676 WerFault.exe 172 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3408 pr735305.exe 3408 pr735305.exe 4684 qu033044.exe 4684 qu033044.exe 996 rk047646.exe 996 rk047646.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3408 pr735305.exe Token: SeDebugPrivilege 4684 qu033044.exe Token: SeDebugPrivilege 996 rk047646.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4256 si753148.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1456 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 85 PID 4456 wrote to memory of 1456 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 85 PID 4456 wrote to memory of 1456 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 85 PID 1456 wrote to memory of 1216 1456 un301920.exe 86 PID 1456 wrote to memory of 1216 1456 un301920.exe 86 PID 1456 wrote to memory of 1216 1456 un301920.exe 86 PID 1216 wrote to memory of 3408 1216 un649729.exe 87 PID 1216 wrote to memory of 3408 1216 un649729.exe 87 PID 1216 wrote to memory of 3408 1216 un649729.exe 87 PID 1216 wrote to memory of 4684 1216 un649729.exe 93 PID 1216 wrote to memory of 4684 1216 un649729.exe 93 PID 1216 wrote to memory of 4684 1216 un649729.exe 93 PID 1456 wrote to memory of 996 1456 un301920.exe 96 PID 1456 wrote to memory of 996 1456 un301920.exe 96 PID 1456 wrote to memory of 996 1456 un301920.exe 96 PID 4456 wrote to memory of 4256 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 97 PID 4456 wrote to memory of 4256 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 97 PID 4456 wrote to memory of 4256 4456 c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe 97 PID 4256 wrote to memory of 2392 4256 si753148.exe 117 PID 4256 wrote to memory of 2392 4256 si753148.exe 117 PID 4256 wrote to memory of 2392 4256 si753148.exe 117 PID 2392 wrote to memory of 4900 2392 oneetx.exe 137 PID 2392 wrote to memory of 4900 2392 oneetx.exe 137 PID 2392 wrote to memory of 4900 2392 oneetx.exe 137 PID 2392 wrote to memory of 3796 2392 oneetx.exe 143 PID 2392 wrote to memory of 3796 2392 oneetx.exe 143 PID 2392 wrote to memory of 3796 2392 oneetx.exe 143 PID 3796 wrote to memory of 2820 3796 cmd.exe 147 PID 3796 wrote to memory of 2820 3796 cmd.exe 147 PID 3796 wrote to memory of 2820 3796 cmd.exe 147 PID 3796 wrote to memory of 2952 3796 cmd.exe 148 PID 3796 wrote to memory of 2952 3796 cmd.exe 148 PID 3796 wrote to memory of 2952 3796 cmd.exe 148 PID 3796 wrote to memory of 4080 3796 cmd.exe 149 PID 3796 wrote to memory of 4080 3796 cmd.exe 149 PID 3796 wrote to memory of 4080 3796 cmd.exe 149 PID 3796 wrote to memory of 1536 3796 cmd.exe 150 PID 3796 wrote to memory of 1536 3796 cmd.exe 150 PID 3796 wrote to memory of 1536 3796 cmd.exe 150 PID 3796 wrote to memory of 5048 3796 cmd.exe 151 PID 3796 wrote to memory of 5048 3796 cmd.exe 151 PID 3796 wrote to memory of 5048 3796 cmd.exe 151 PID 3796 wrote to memory of 3872 3796 cmd.exe 152 PID 3796 wrote to memory of 3872 3796 cmd.exe 152 PID 3796 wrote to memory of 3872 3796 cmd.exe 152 PID 2392 wrote to memory of 1792 2392 oneetx.exe 167 PID 2392 wrote to memory of 1792 2392 oneetx.exe 167 PID 2392 wrote to memory of 1792 2392 oneetx.exe 167
Processes
-
C:\Users\Admin\AppData\Local\Temp\c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe"C:\Users\Admin\AppData\Local\Temp\c783f47ea822fde6338f55ddc5a6afdbcdbe1284faf1bd52388f09a4de433e8f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un301920.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un301920.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un649729.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un649729.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr735305.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr735305.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 11085⤵
- Program crash
PID:1812
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu033044.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu033044.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 17085⤵
- Program crash
PID:4136
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk047646.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk047646.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si753148.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si753148.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 6963⤵
- Program crash
PID:3564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 7803⤵
- Program crash
PID:4988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 8563⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 8643⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 9883⤵
- Program crash
PID:1396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 9883⤵
- Program crash
PID:1592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 12163⤵
- Program crash
PID:4436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 12363⤵
- Program crash
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 13123⤵
- Program crash
PID:5096
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 6924⤵
- Program crash
PID:4148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 8364⤵
- Program crash
PID:3624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 8324⤵
- Program crash
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 10524⤵
- Program crash
PID:1300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 10724⤵
- Program crash
PID:1892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 10724⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 11084⤵
- Program crash
PID:4092
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 9924⤵
- Program crash
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13004⤵
- Program crash
PID:1896
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2820
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4080
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:5048
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:3872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13284⤵
- Program crash
PID:3652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13364⤵
- Program crash
PID:4452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13564⤵
- Program crash
PID:396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 13644⤵
- Program crash
PID:5040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 10964⤵
- Program crash
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 16164⤵
- Program crash
PID:2696
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 11364⤵
- Program crash
PID:1768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 16284⤵
- Program crash
PID:4384
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 17283⤵
- Program crash
PID:3484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3408 -ip 34081⤵PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4684 -ip 46841⤵PID:4764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4256 -ip 42561⤵PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4256 -ip 42561⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4256 -ip 42561⤵PID:2020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4256 -ip 42561⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4256 -ip 42561⤵PID:3504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4256 -ip 42561⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4256 -ip 42561⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4256 -ip 42561⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4256 -ip 42561⤵PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4256 -ip 42561⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2392 -ip 23921⤵PID:2460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2392 -ip 23921⤵PID:1640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2392 -ip 23921⤵PID:3512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2392 -ip 23921⤵PID:2420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2392 -ip 23921⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2392 -ip 23921⤵PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2392 -ip 23921⤵PID:4760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2392 -ip 23921⤵PID:1904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2392 -ip 23921⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2392 -ip 23921⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2392 -ip 23921⤵PID:996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2392 -ip 23921⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2392 -ip 23921⤵PID:1688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2392 -ip 23921⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 3162⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1164 -ip 11641⤵PID:1932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2392 -ip 23921⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2392 -ip 23921⤵PID:2124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2392 -ip 23921⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 3162⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1676 -ip 16761⤵PID:4256
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
762KB
MD5b0412ee1546e054eab52dc79f72bc783
SHA18c54f21c550a0726fd469da995b7525b932c0f10
SHA256133bd0dce4a90d052942ac0c45bf4a19e10f85036f2e3e90e7176118318cb2c5
SHA5125769bc6a87e409e4ac6c70a99f30f8d8bfa47dea949d09f036d6fce5f091d72f79fad585024a14815895bb0802285a07d291fffaedd8695b8efa7a8adc1c4b6b
-
Filesize
762KB
MD5b0412ee1546e054eab52dc79f72bc783
SHA18c54f21c550a0726fd469da995b7525b932c0f10
SHA256133bd0dce4a90d052942ac0c45bf4a19e10f85036f2e3e90e7176118318cb2c5
SHA5125769bc6a87e409e4ac6c70a99f30f8d8bfa47dea949d09f036d6fce5f091d72f79fad585024a14815895bb0802285a07d291fffaedd8695b8efa7a8adc1c4b6b
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
608KB
MD5cab23dbd50d423d1a0ffffbad3a99e63
SHA1c53041ff4dca8d9dc51d2e273847643771d88399
SHA25632ff93d67f99b805920065d88aabcaff5b06afcb5c0328fab11691b8307f83e8
SHA512a5dcd67071a8f99fb6f86512e8b7e8278a5ed69280552889a5bf5b860fd27bd97840e892c7111fa8bcb35c103665774509a5faa3441d2f285b705e94f8d26689
-
Filesize
608KB
MD5cab23dbd50d423d1a0ffffbad3a99e63
SHA1c53041ff4dca8d9dc51d2e273847643771d88399
SHA25632ff93d67f99b805920065d88aabcaff5b06afcb5c0328fab11691b8307f83e8
SHA512a5dcd67071a8f99fb6f86512e8b7e8278a5ed69280552889a5bf5b860fd27bd97840e892c7111fa8bcb35c103665774509a5faa3441d2f285b705e94f8d26689
-
Filesize
403KB
MD552b669c82290cee8f2d8c741bf39fe22
SHA15ed4775a944f87ab03480a4ed96ca291ec682aa7
SHA25641f7a2710c0caf0f05173e240b080d072fef757bef450f3211bb407386c25ad7
SHA512f22403925631708034d1b9f8fbdd4af84b2f89f19f7167b9e51f9cb9874e2478ca98ead72ad137b892bb9fe1555ce3ae0998ff27ad2509c6871bf6e2fd735d83
-
Filesize
403KB
MD552b669c82290cee8f2d8c741bf39fe22
SHA15ed4775a944f87ab03480a4ed96ca291ec682aa7
SHA25641f7a2710c0caf0f05173e240b080d072fef757bef450f3211bb407386c25ad7
SHA512f22403925631708034d1b9f8fbdd4af84b2f89f19f7167b9e51f9cb9874e2478ca98ead72ad137b892bb9fe1555ce3ae0998ff27ad2509c6871bf6e2fd735d83
-
Filesize
485KB
MD5d49c5df948078459076cac89e34586e9
SHA14e206a6f8579f024a8100cdc2f16c4d516015be0
SHA256def96c324638b86d68a5474d350c3f76fd8112b4dfc4d6e46076abe0435ae491
SHA51281749ebee73723a6d16f2d56259b28f987f45fe6839144148709ae289b88b8e18fec05db0a2c9ceb3dd92a974b254b7d7e913056e63ed89144634751cd11e785
-
Filesize
485KB
MD5d49c5df948078459076cac89e34586e9
SHA14e206a6f8579f024a8100cdc2f16c4d516015be0
SHA256def96c324638b86d68a5474d350c3f76fd8112b4dfc4d6e46076abe0435ae491
SHA51281749ebee73723a6d16f2d56259b28f987f45fe6839144148709ae289b88b8e18fec05db0a2c9ceb3dd92a974b254b7d7e913056e63ed89144634751cd11e785
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
381KB
MD500e03aba5a299554d393187e2cdd3fc9
SHA117895f7203c743c6efa42cd8a2b6ad84611d2e65
SHA256f32188b407b3105073115471bfa791fb932bfb2664c0ff02293d4371529f0cec
SHA512f50ea1161679dfb0efe516ec491f12faf2857d4a4549c77225b66294c709fab6c2adb6ade8d6be78b3832acf7e79512ca7e2788ac1f7fa746e3016db2752f0dc
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5