Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 08:59
Static task
static1
General
-
Target
be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe
-
Size
1.0MB
-
MD5
202c5799aeee7b2d9456edb21fbe2106
-
SHA1
0c7c113f7ba33245f0a3324a93427026054d1e2b
-
SHA256
be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d
-
SHA512
195dd3c36b1038ab5c39afac2f68aa0b998fff3d83e6e8dddc8cb09d08c8acf13f530e7d5b28a2ad27112ebce4f8c7ecdd6d7c842ba3c9603ebffa0529398d05
-
SSDEEP
12288:Hy90gupQGT1ZpMuhg8ivQSODMsXL2vy6Ayi4xgKg2cD/MFUMJLovO/Ah2Zum4:HyIHBzMUg8ivXtsXyybTKg28MNoBq14
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr904847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr904847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr904847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr904847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr904847.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr904847.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation si705515.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 5064 un070663.exe 5052 un178083.exe 4160 pr904847.exe 1820 qu105151.exe 2340 rk134944.exe 4684 si705515.exe 4620 oneetx.exe 4420 oneetx.exe 4856 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1312 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr904847.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr904847.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un070663.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un070663.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un178083.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un178083.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 31 IoCs
pid pid_target Process procid_target 4892 4160 WerFault.exe 85 2920 1820 WerFault.exe 92 876 4684 WerFault.exe 96 4524 4684 WerFault.exe 96 4748 4684 WerFault.exe 96 1032 4684 WerFault.exe 96 5020 4684 WerFault.exe 96 676 4684 WerFault.exe 96 3716 4684 WerFault.exe 96 2368 4684 WerFault.exe 96 3068 4684 WerFault.exe 96 3640 4684 WerFault.exe 96 3340 4620 WerFault.exe 116 1564 4620 WerFault.exe 116 4332 4620 WerFault.exe 116 4952 4620 WerFault.exe 116 3832 4620 WerFault.exe 116 624 4620 WerFault.exe 116 2336 4620 WerFault.exe 116 5088 4620 WerFault.exe 116 4328 4620 WerFault.exe 116 1008 4620 WerFault.exe 116 4992 4620 WerFault.exe 116 4024 4620 WerFault.exe 116 3200 4620 WerFault.exe 116 432 4420 WerFault.exe 159 3320 4620 WerFault.exe 116 2196 4620 WerFault.exe 116 4508 4620 WerFault.exe 116 2876 4620 WerFault.exe 116 3216 4856 WerFault.exe 171 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4352 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4160 pr904847.exe 4160 pr904847.exe 1820 qu105151.exe 1820 qu105151.exe 2340 rk134944.exe 2340 rk134944.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4160 pr904847.exe Token: SeDebugPrivilege 1820 qu105151.exe Token: SeDebugPrivilege 2340 rk134944.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4684 si705515.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3324 wrote to memory of 5064 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 83 PID 3324 wrote to memory of 5064 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 83 PID 3324 wrote to memory of 5064 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 83 PID 5064 wrote to memory of 5052 5064 un070663.exe 84 PID 5064 wrote to memory of 5052 5064 un070663.exe 84 PID 5064 wrote to memory of 5052 5064 un070663.exe 84 PID 5052 wrote to memory of 4160 5052 un178083.exe 85 PID 5052 wrote to memory of 4160 5052 un178083.exe 85 PID 5052 wrote to memory of 4160 5052 un178083.exe 85 PID 5052 wrote to memory of 1820 5052 un178083.exe 92 PID 5052 wrote to memory of 1820 5052 un178083.exe 92 PID 5052 wrote to memory of 1820 5052 un178083.exe 92 PID 5064 wrote to memory of 2340 5064 un070663.exe 95 PID 5064 wrote to memory of 2340 5064 un070663.exe 95 PID 5064 wrote to memory of 2340 5064 un070663.exe 95 PID 3324 wrote to memory of 4684 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 96 PID 3324 wrote to memory of 4684 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 96 PID 3324 wrote to memory of 4684 3324 be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe 96 PID 4684 wrote to memory of 4620 4684 si705515.exe 116 PID 4684 wrote to memory of 4620 4684 si705515.exe 116 PID 4684 wrote to memory of 4620 4684 si705515.exe 116 PID 4620 wrote to memory of 4352 4620 oneetx.exe 136 PID 4620 wrote to memory of 4352 4620 oneetx.exe 136 PID 4620 wrote to memory of 4352 4620 oneetx.exe 136 PID 4620 wrote to memory of 4616 4620 oneetx.exe 142 PID 4620 wrote to memory of 4616 4620 oneetx.exe 142 PID 4620 wrote to memory of 4616 4620 oneetx.exe 142 PID 4616 wrote to memory of 2412 4616 cmd.exe 146 PID 4616 wrote to memory of 2412 4616 cmd.exe 146 PID 4616 wrote to memory of 2412 4616 cmd.exe 146 PID 4616 wrote to memory of 3536 4616 cmd.exe 147 PID 4616 wrote to memory of 3536 4616 cmd.exe 147 PID 4616 wrote to memory of 3536 4616 cmd.exe 147 PID 4616 wrote to memory of 3744 4616 cmd.exe 148 PID 4616 wrote to memory of 3744 4616 cmd.exe 148 PID 4616 wrote to memory of 3744 4616 cmd.exe 148 PID 4616 wrote to memory of 396 4616 cmd.exe 149 PID 4616 wrote to memory of 396 4616 cmd.exe 149 PID 4616 wrote to memory of 396 4616 cmd.exe 149 PID 4616 wrote to memory of 3612 4616 cmd.exe 150 PID 4616 wrote to memory of 3612 4616 cmd.exe 150 PID 4616 wrote to memory of 3612 4616 cmd.exe 150 PID 4616 wrote to memory of 3296 4616 cmd.exe 151 PID 4616 wrote to memory of 3296 4616 cmd.exe 151 PID 4616 wrote to memory of 3296 4616 cmd.exe 151 PID 4620 wrote to memory of 1312 4620 oneetx.exe 166 PID 4620 wrote to memory of 1312 4620 oneetx.exe 166 PID 4620 wrote to memory of 1312 4620 oneetx.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe"C:\Users\Admin\AppData\Local\Temp\be70678dda0e2b4e9a487edce5acda3bc54e43166c1409881182d95ae5a29a3d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un070663.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un070663.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un178083.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un178083.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr904847.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr904847.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 10845⤵
- Program crash
PID:4892
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu105151.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu105151.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 13205⤵
- Program crash
PID:2920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk134944.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk134944.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si705515.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si705515.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 6963⤵
- Program crash
PID:876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 7723⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 8083⤵
- Program crash
PID:4748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 9763⤵
- Program crash
PID:1032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 9803⤵
- Program crash
PID:5020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 10083⤵
- Program crash
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 12203⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 12323⤵
- Program crash
PID:2368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 13163⤵
- Program crash
PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 6924⤵
- Program crash
PID:3340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 8364⤵
- Program crash
PID:1564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 8444⤵
- Program crash
PID:4332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 10524⤵
- Program crash
PID:4952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 10644⤵
- Program crash
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 10764⤵
- Program crash
PID:624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 11084⤵
- Program crash
PID:2336
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 9924⤵
- Program crash
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 7764⤵
- Program crash
PID:4328
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2412
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:3536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:396
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3612
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:3296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 7764⤵
- Program crash
PID:1008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1324⤵
- Program crash
PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 9884⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 7284⤵
- Program crash
PID:3200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 11364⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 16004⤵
- Program crash
PID:2196
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 11284⤵
- Program crash
PID:4508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 15804⤵
- Program crash
PID:2876
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 13443⤵
- Program crash
PID:3640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4160 -ip 41601⤵PID:3612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1820 -ip 18201⤵PID:364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4684 -ip 46841⤵PID:3308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4684 -ip 46841⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4684 -ip 46841⤵PID:376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4684 -ip 46841⤵PID:432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4684 -ip 46841⤵PID:3320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4684 -ip 46841⤵PID:4320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4684 -ip 46841⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4684 -ip 46841⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4684 -ip 46841⤵PID:2248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4684 -ip 46841⤵PID:1380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4620 -ip 46201⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4620 -ip 46201⤵PID:484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4620 -ip 46201⤵PID:2912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4620 -ip 46201⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4620 -ip 46201⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4620 -ip 46201⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4620 -ip 46201⤵PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4620 -ip 46201⤵PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4620 -ip 46201⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4620 -ip 46201⤵PID:3436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4620 -ip 46201⤵PID:4480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4620 -ip 46201⤵PID:1244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4620 -ip 46201⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 3162⤵
- Program crash
PID:432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4420 -ip 44201⤵PID:4036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4620 -ip 46201⤵PID:1980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4620 -ip 46201⤵PID:3752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4620 -ip 46201⤵PID:1976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4620 -ip 46201⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 3122⤵
- Program crash
PID:3216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4856 -ip 48561⤵PID:3908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
761KB
MD5d9b98159b6e3c3b0bf972a6a577b09d5
SHA16666296e499381ddbf167d8e6d7e5ccf0b8fe284
SHA256ac6ea37dcd94945e88e66f755b03c26bf106340b02c62b3d0165678543d31184
SHA5123f48131bee4a08e5c250622d683863e826e12ce743293f33c3ff17ca7fde2cc37c24eb1629d5a2bcee68252da302ace1adf7e587cfe83f71b5ea64f04180d3e8
-
Filesize
761KB
MD5d9b98159b6e3c3b0bf972a6a577b09d5
SHA16666296e499381ddbf167d8e6d7e5ccf0b8fe284
SHA256ac6ea37dcd94945e88e66f755b03c26bf106340b02c62b3d0165678543d31184
SHA5123f48131bee4a08e5c250622d683863e826e12ce743293f33c3ff17ca7fde2cc37c24eb1629d5a2bcee68252da302ace1adf7e587cfe83f71b5ea64f04180d3e8
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
608KB
MD517202a230e2fc62132dcc4468a40bad0
SHA184bae693e9ded294e5c76e424fc31c473f1e7605
SHA256ec955b35495a0ecdd60b3307cf530bd98128e75ade3131db94a4f36b01a7904e
SHA5122226de1e73abfec2cab44712dd29dcfc35f82b011b3e85c3ae0a4500eb6d57faff3ec44e74cefa24ae232d859ee93b9c06ca9c769662393c95541a57f7b1fe3d
-
Filesize
608KB
MD517202a230e2fc62132dcc4468a40bad0
SHA184bae693e9ded294e5c76e424fc31c473f1e7605
SHA256ec955b35495a0ecdd60b3307cf530bd98128e75ade3131db94a4f36b01a7904e
SHA5122226de1e73abfec2cab44712dd29dcfc35f82b011b3e85c3ae0a4500eb6d57faff3ec44e74cefa24ae232d859ee93b9c06ca9c769662393c95541a57f7b1fe3d
-
Filesize
403KB
MD5a6177115aa93e870c02eeba8aafefaa3
SHA11d718c450703cb18f37201d5076250fa5d24f211
SHA256bd6a8f0a766c0cfbac6510d3b33a36af9c68e225bae170783741f7a00b2c4b96
SHA5123b03468e28abbe8b9f6aa687e2b98d9072fcd5b2aa7f7d752724449fcbd88f23ebda19a26c181dafb871b784107a3f6fa30c4630ec79fbd5168525abb9c94341
-
Filesize
403KB
MD5a6177115aa93e870c02eeba8aafefaa3
SHA11d718c450703cb18f37201d5076250fa5d24f211
SHA256bd6a8f0a766c0cfbac6510d3b33a36af9c68e225bae170783741f7a00b2c4b96
SHA5123b03468e28abbe8b9f6aa687e2b98d9072fcd5b2aa7f7d752724449fcbd88f23ebda19a26c181dafb871b784107a3f6fa30c4630ec79fbd5168525abb9c94341
-
Filesize
485KB
MD596363d9d62c02254548e160ee9894387
SHA1030cf74b05bdc8a0752c528be112ce23e5de1971
SHA2566d86acfb0f90b4ff53b9177acd7fb9ba0ff2605a1f1b5fe12f5ab79d59bccc4a
SHA512b513aee809ec2d184bdb62f6c67c56036bd6fecaa94d988f29c327f8689a8a5a69799307f5f67987f84373cf9dd5b66cb21901f07a0e85ac312ca378c1f3fc69
-
Filesize
485KB
MD596363d9d62c02254548e160ee9894387
SHA1030cf74b05bdc8a0752c528be112ce23e5de1971
SHA2566d86acfb0f90b4ff53b9177acd7fb9ba0ff2605a1f1b5fe12f5ab79d59bccc4a
SHA512b513aee809ec2d184bdb62f6c67c56036bd6fecaa94d988f29c327f8689a8a5a69799307f5f67987f84373cf9dd5b66cb21901f07a0e85ac312ca378c1f3fc69
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
381KB
MD52743a16cd0e55cef3914242177b70a69
SHA17ad0e85b48712bdf2a2068061fb92260f3b4cc27
SHA256e16b0e47687297d67c4abb45f10c9881f2515edf9f68c0bdeb2b8f46d240e072
SHA512970109bd647f41537a2ac6bf18b12aedd3f803ab0887ef20375d6f5d54639c9bb6b3e13389b111593b4d8c0b5c24ccd7d6aec885aca75f4b949b99e4463e22f0
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5