Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 08:57
Static task
static1
General
-
Target
008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe
-
Size
936KB
-
MD5
136f3fb9fc54ff50078f5445e3412901
-
SHA1
3cbb39153874e171518e228d56944ad8f6f4f28b
-
SHA256
008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b
-
SHA512
374abce1c160b9feeec8a07a26c2d0d70d5657c16e4e384970b7385fd0fd4622f1a0a495c292721e1cc5130b20dcdb0ef9db7f45e17813c146deb6ffb0bc2d95
-
SSDEEP
24576:6ymeJmcrbYDmd93hFRw3FTa567WgrqDVI:BbmCMDiRWFG0q
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it397233.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it397233.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it397233.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it397233.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it397233.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it397233.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr493764.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2792 ziRL9902.exe 4880 zinH0673.exe 452 it397233.exe 732 jr690574.exe 1800 kp828814.exe 4844 lr493764.exe 1888 oneetx.exe 1580 oneetx.exe 3924 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4984 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it397233.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziRL9902.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziRL9902.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinH0673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zinH0673.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 1176 732 WerFault.exe 94 4628 4844 WerFault.exe 99 2348 4844 WerFault.exe 99 2912 4844 WerFault.exe 99 1412 4844 WerFault.exe 99 2440 4844 WerFault.exe 99 1272 4844 WerFault.exe 99 2904 4844 WerFault.exe 99 1368 4844 WerFault.exe 99 3924 4844 WerFault.exe 99 4084 4844 WerFault.exe 99 1588 1888 WerFault.exe 119 2452 1888 WerFault.exe 119 448 1888 WerFault.exe 119 2824 1888 WerFault.exe 119 3828 1888 WerFault.exe 119 4696 1888 WerFault.exe 119 1604 1888 WerFault.exe 119 4744 1888 WerFault.exe 119 3432 1888 WerFault.exe 119 2040 1888 WerFault.exe 119 2684 1888 WerFault.exe 119 1104 1888 WerFault.exe 119 820 1888 WerFault.exe 119 1440 1580 WerFault.exe 158 1360 1888 WerFault.exe 119 4260 1888 WerFault.exe 119 3624 1888 WerFault.exe 119 3264 3924 WerFault.exe 168 3404 1888 WerFault.exe 119 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 432 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 452 it397233.exe 452 it397233.exe 732 jr690574.exe 732 jr690574.exe 1800 kp828814.exe 1800 kp828814.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 452 it397233.exe Token: SeDebugPrivilege 732 jr690574.exe Token: SeDebugPrivilege 1800 kp828814.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4844 lr493764.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4208 wrote to memory of 2792 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 85 PID 4208 wrote to memory of 2792 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 85 PID 4208 wrote to memory of 2792 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 85 PID 2792 wrote to memory of 4880 2792 ziRL9902.exe 86 PID 2792 wrote to memory of 4880 2792 ziRL9902.exe 86 PID 2792 wrote to memory of 4880 2792 ziRL9902.exe 86 PID 4880 wrote to memory of 452 4880 zinH0673.exe 87 PID 4880 wrote to memory of 452 4880 zinH0673.exe 87 PID 4880 wrote to memory of 732 4880 zinH0673.exe 94 PID 4880 wrote to memory of 732 4880 zinH0673.exe 94 PID 4880 wrote to memory of 732 4880 zinH0673.exe 94 PID 2792 wrote to memory of 1800 2792 ziRL9902.exe 98 PID 2792 wrote to memory of 1800 2792 ziRL9902.exe 98 PID 2792 wrote to memory of 1800 2792 ziRL9902.exe 98 PID 4208 wrote to memory of 4844 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 99 PID 4208 wrote to memory of 4844 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 99 PID 4208 wrote to memory of 4844 4208 008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe 99 PID 4844 wrote to memory of 1888 4844 lr493764.exe 119 PID 4844 wrote to memory of 1888 4844 lr493764.exe 119 PID 4844 wrote to memory of 1888 4844 lr493764.exe 119 PID 1888 wrote to memory of 432 1888 oneetx.exe 136 PID 1888 wrote to memory of 432 1888 oneetx.exe 136 PID 1888 wrote to memory of 432 1888 oneetx.exe 136 PID 1888 wrote to memory of 2496 1888 oneetx.exe 142 PID 1888 wrote to memory of 2496 1888 oneetx.exe 142 PID 1888 wrote to memory of 2496 1888 oneetx.exe 142 PID 2496 wrote to memory of 1932 2496 cmd.exe 146 PID 2496 wrote to memory of 1932 2496 cmd.exe 146 PID 2496 wrote to memory of 1932 2496 cmd.exe 146 PID 2496 wrote to memory of 1924 2496 cmd.exe 147 PID 2496 wrote to memory of 1924 2496 cmd.exe 147 PID 2496 wrote to memory of 1924 2496 cmd.exe 147 PID 2496 wrote to memory of 3836 2496 cmd.exe 148 PID 2496 wrote to memory of 3836 2496 cmd.exe 148 PID 2496 wrote to memory of 3836 2496 cmd.exe 148 PID 2496 wrote to memory of 1000 2496 cmd.exe 149 PID 2496 wrote to memory of 1000 2496 cmd.exe 149 PID 2496 wrote to memory of 1000 2496 cmd.exe 149 PID 2496 wrote to memory of 4912 2496 cmd.exe 150 PID 2496 wrote to memory of 4912 2496 cmd.exe 150 PID 2496 wrote to memory of 4912 2496 cmd.exe 150 PID 2496 wrote to memory of 4880 2496 cmd.exe 151 PID 2496 wrote to memory of 4880 2496 cmd.exe 151 PID 2496 wrote to memory of 4880 2496 cmd.exe 151 PID 1888 wrote to memory of 4984 1888 oneetx.exe 165 PID 1888 wrote to memory of 4984 1888 oneetx.exe 165 PID 1888 wrote to memory of 4984 1888 oneetx.exe 165
Processes
-
C:\Users\Admin\AppData\Local\Temp\008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe"C:\Users\Admin\AppData\Local\Temp\008e60929d75547cc1b3d1bb936b0c97785b3509480e29386ef1f654d7c8419b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRL9902.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziRL9902.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinH0673.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zinH0673.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it397233.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it397233.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr690574.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr690574.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 13205⤵
- Program crash
PID:1176
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp828814.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp828814.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr493764.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr493764.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 6963⤵
- Program crash
PID:4628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 7803⤵
- Program crash
PID:2348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 8003⤵
- Program crash
PID:2912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 9083⤵
- Program crash
PID:1412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 8123⤵
- Program crash
PID:2440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 8123⤵
- Program crash
PID:1272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 12203⤵
- Program crash
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 12123⤵
- Program crash
PID:1368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 13203⤵
- Program crash
PID:3924
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 6924⤵
- Program crash
PID:1588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 8164⤵
- Program crash
PID:2452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 8364⤵
- Program crash
PID:448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 10524⤵
- Program crash
PID:2824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 10524⤵
- Program crash
PID:3828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 10804⤵
- Program crash
PID:4696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 10644⤵
- Program crash
PID:1604
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 9924⤵
- Program crash
PID:4744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 7524⤵
- Program crash
PID:3432
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1924
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1000
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:4912
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4880
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 13484⤵
- Program crash
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 7444⤵
- Program crash
PID:2684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 13084⤵
- Program crash
PID:1104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 13684⤵
- Program crash
PID:820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 11084⤵
- Program crash
PID:1360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 10804⤵
- Program crash
PID:4260
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 12564⤵
- Program crash
PID:3624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 16164⤵
- Program crash
PID:3404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 13683⤵
- Program crash
PID:4084
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 732 -ip 7321⤵PID:1148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4844 -ip 48441⤵PID:1856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4844 -ip 48441⤵PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4844 -ip 48441⤵PID:1928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4844 -ip 48441⤵PID:2432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4844 -ip 48441⤵PID:1204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4844 -ip 48441⤵PID:3228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4844 -ip 48441⤵PID:812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4844 -ip 48441⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4844 -ip 48441⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4844 -ip 48441⤵PID:3180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1888 -ip 18881⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1888 -ip 18881⤵PID:4620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1888 -ip 18881⤵PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1888 -ip 18881⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1888 -ip 18881⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1888 -ip 18881⤵PID:1848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1888 -ip 18881⤵PID:2288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1888 -ip 18881⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1888 -ip 18881⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1888 -ip 18881⤵PID:2004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1888 -ip 18881⤵PID:436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1888 -ip 18881⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1888 -ip 18881⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 3122⤵
- Program crash
PID:1440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1580 -ip 15801⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1888 -ip 18881⤵PID:3920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1888 -ip 18881⤵PID:1164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1888 -ip 18881⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 3122⤵
- Program crash
PID:3264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3924 -ip 39241⤵PID:2184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1888 -ip 18881⤵PID:2416
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
623KB
MD58e5d55e506164cbf8bdf3b1200aefb6c
SHA127b3713e67c2dad96b440dd54e36e48f954e2724
SHA256e099007c14aa99eb92f9ee07a4e0f8dfe070e1e12e53778c66bfd9b6614dfd72
SHA512e176ddc6276abbb625eb9ae8e024a82c89fbeafd25d14f1eb11b42b359d2ba0ba43dcff8396b3adbda39cd87038f13e315e3fa4d644d0a255121045c5898f718
-
Filesize
623KB
MD58e5d55e506164cbf8bdf3b1200aefb6c
SHA127b3713e67c2dad96b440dd54e36e48f954e2724
SHA256e099007c14aa99eb92f9ee07a4e0f8dfe070e1e12e53778c66bfd9b6614dfd72
SHA512e176ddc6276abbb625eb9ae8e024a82c89fbeafd25d14f1eb11b42b359d2ba0ba43dcff8396b3adbda39cd87038f13e315e3fa4d644d0a255121045c5898f718
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
469KB
MD579a4f3b39dc16e679c6bbe07958b95f3
SHA1cfa2089aacb6eec41e954e9b03dcfd5968e8ffaa
SHA25629946695c63b30ed5ab68f159a0e264ec1177d0778ac272ed76a7011834d9fb8
SHA51255e995ab3de654a67fe3b4a8372c3706c71f5006b26b86ce5cac0324adc35329744246b484305dd5f6ecc216c1e58f730878169744c31fdedf338242e315b1ef
-
Filesize
469KB
MD579a4f3b39dc16e679c6bbe07958b95f3
SHA1cfa2089aacb6eec41e954e9b03dcfd5968e8ffaa
SHA25629946695c63b30ed5ab68f159a0e264ec1177d0778ac272ed76a7011834d9fb8
SHA51255e995ab3de654a67fe3b4a8372c3706c71f5006b26b86ce5cac0324adc35329744246b484305dd5f6ecc216c1e58f730878169744c31fdedf338242e315b1ef
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
485KB
MD5b5d5a209a7b0f8ac5ce175d4ed2282cf
SHA13b5e03f29895d5492123d83fe04e9eb71224861b
SHA25672e0c830d7d2efb67534451ca142a54c3412b01913d0d64bb5bf23e585a14fa6
SHA512ea93c99dff83de7a4e385c74124650938a332f8f6e64e610b2c4bf8da138aa9a63819354921dc9fd296a05f7a0d5f325e5d66e81c265808adf77c2b913fc39fb
-
Filesize
485KB
MD5b5d5a209a7b0f8ac5ce175d4ed2282cf
SHA13b5e03f29895d5492123d83fe04e9eb71224861b
SHA25672e0c830d7d2efb67534451ca142a54c3412b01913d0d64bb5bf23e585a14fa6
SHA512ea93c99dff83de7a4e385c74124650938a332f8f6e64e610b2c4bf8da138aa9a63819354921dc9fd296a05f7a0d5f325e5d66e81c265808adf77c2b913fc39fb
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
381KB
MD5df807afff1f72ef37763f73b9c25eaa1
SHA161300ab98f4ab45ed073da61471765abeb0cda42
SHA25607be10935843931fe10a8a3a2199a8498ee3ba9955ceb2eb382a6572923f77bb
SHA5122ae4bc42af8a3f7de79f81075d0ce2c529f35e76b4ddc71577fb71a8fcb0b113cd8b54a1fd70478da9f8662181b604d1254784b0a803dd9fc169a682d8974e16
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5