9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2023, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe
Size

1.0MB
MD5

2f59956ce2da220b6c3b23bf8797f8a0
SHA1

691f0aadb1cd04355d3c1db80e23fd903db6206f
SHA256

9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348
SHA512

5160c9fb61d367e5168e217b8ab98c45f5cbd05c752cf4a6d23bfd80bc5c47e0f6850c3182c4aa727689add1a11b71ba8fc471559e96ea9f49b672a1811e8987
SSDEEP

24576:GyUKXGC1Zhq6dkJGUFuko5A7lla29TU2nQp5ny8OJ7ztCLyuQkQ:VnX3EQ0GUWa3TlKnyn7zh/

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr799371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr799371.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr799371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr799371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr799371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr799371.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	si032226.exe

Executes dropped EXE 8 IoCs

pid	Process
4620	un663418.exe
2980	un445566.exe
2952	pr799371.exe
1232	qu054056.exe
2924	rk211949.exe
3888	si032226.exe
2008	oneetx.exe
1896	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
4848	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr799371.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr799371.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un663418.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un663418.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un445566.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un445566.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
4820	2952	WerFault.exe	86
4712	1232	WerFault.exe	92
2896	3888	WerFault.exe	96
8	3888	WerFault.exe	96
4160	3888	WerFault.exe	96
2284	3888	WerFault.exe	96
4232	3888	WerFault.exe	96
1520	3888	WerFault.exe	96
4136	3888	WerFault.exe	96
2536	3888	WerFault.exe	96
1304	3888	WerFault.exe	96
652	3888	WerFault.exe	96
2724	2008	WerFault.exe	116
3840	2008	WerFault.exe	116
724	2008	WerFault.exe	116
1888	2008	WerFault.exe	116
2464	2008	WerFault.exe	116
1464	2008	WerFault.exe	116
3976	2008	WerFault.exe	116
636	2008	WerFault.exe	116
1608	2008	WerFault.exe	116
4728	2008	WerFault.exe	116
4708	2008	WerFault.exe	116
3872	2008	WerFault.exe	116
1516	2008	WerFault.exe	116
4300	2008	WerFault.exe	116
3268	2008	WerFault.exe	116
4492	2008	WerFault.exe	116
4356	1896	WerFault.exe	163
3672	2008	WerFault.exe	116
684	2008	WerFault.exe	116

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2952	pr799371.exe
2952	pr799371.exe
1232	qu054056.exe
1232	qu054056.exe
2924	rk211949.exe
2924	rk211949.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	pr799371.exe
Token: SeDebugPrivilege	1232	qu054056.exe
Token: SeDebugPrivilege	2924	rk211949.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3888	si032226.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4620	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	84
PID 2604 wrote to memory of 4620	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	84
PID 2604 wrote to memory of 4620	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	84
PID 4620 wrote to memory of 2980	4620	un663418.exe	85
PID 4620 wrote to memory of 2980	4620	un663418.exe	85
PID 4620 wrote to memory of 2980	4620	un663418.exe	85
PID 2980 wrote to memory of 2952	2980	un445566.exe	86
PID 2980 wrote to memory of 2952	2980	un445566.exe	86
PID 2980 wrote to memory of 2952	2980	un445566.exe	86
PID 2980 wrote to memory of 1232	2980	un445566.exe	92
PID 2980 wrote to memory of 1232	2980	un445566.exe	92
PID 2980 wrote to memory of 1232	2980	un445566.exe	92
PID 4620 wrote to memory of 2924	4620	un663418.exe	95
PID 4620 wrote to memory of 2924	4620	un663418.exe	95
PID 4620 wrote to memory of 2924	4620	un663418.exe	95
PID 2604 wrote to memory of 3888	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	96
PID 2604 wrote to memory of 3888	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	96
PID 2604 wrote to memory of 3888	2604	9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe	96
PID 3888 wrote to memory of 2008	3888	si032226.exe	116
PID 3888 wrote to memory of 2008	3888	si032226.exe	116
PID 3888 wrote to memory of 2008	3888	si032226.exe	116
PID 2008 wrote to memory of 4828	2008	oneetx.exe	136
PID 2008 wrote to memory of 4828	2008	oneetx.exe	136
PID 2008 wrote to memory of 4828	2008	oneetx.exe	136
PID 2008 wrote to memory of 4720	2008	oneetx.exe	142
PID 2008 wrote to memory of 4720	2008	oneetx.exe	142
PID 2008 wrote to memory of 4720	2008	oneetx.exe	142
PID 4720 wrote to memory of 3216	4720	cmd.exe	146
PID 4720 wrote to memory of 3216	4720	cmd.exe	146
PID 4720 wrote to memory of 3216	4720	cmd.exe	146
PID 4720 wrote to memory of 3408	4720	cmd.exe	147
PID 4720 wrote to memory of 3408	4720	cmd.exe	147
PID 4720 wrote to memory of 3408	4720	cmd.exe	147
PID 4720 wrote to memory of 1212	4720	cmd.exe	148
PID 4720 wrote to memory of 1212	4720	cmd.exe	148
PID 4720 wrote to memory of 1212	4720	cmd.exe	148
PID 4720 wrote to memory of 2388	4720	cmd.exe	150
PID 4720 wrote to memory of 2388	4720	cmd.exe	150
PID 4720 wrote to memory of 2388	4720	cmd.exe	150
PID 4720 wrote to memory of 680	4720	cmd.exe	149
PID 4720 wrote to memory of 680	4720	cmd.exe	149
PID 4720 wrote to memory of 680	4720	cmd.exe	149
PID 4720 wrote to memory of 1604	4720	cmd.exe	151
PID 4720 wrote to memory of 1604	4720	cmd.exe	151
PID 4720 wrote to memory of 1604	4720	cmd.exe	151
PID 2008 wrote to memory of 4848	2008	oneetx.exe	168
PID 2008 wrote to memory of 4848	2008	oneetx.exe	168
PID 2008 wrote to memory of 4848	2008	oneetx.exe	168

C:\Users\Admin\AppData\Local\Temp\9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe
"C:\Users\Admin\AppData\Local\Temp\9575ad69f2b625c40efc67b7101918c0fb35994c42b0f366b43ccf0f154e1348.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un663418.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un663418.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un445566.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un445566.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr799371.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr799371.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 1016
        5⤵
        Program crash
        
        PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu054056.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu054056.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1596
        5⤵
        Program crash
        
        PID:4712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk211949.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk211949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si032226.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si032226.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 696
    3⤵
    - Program crash
    PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 764
    3⤵
    - Program crash
    PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 796
    3⤵
    - Program crash
    PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 960
    3⤵
    - Program crash
    PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 960
    3⤵
    - Program crash
    PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 952
    3⤵
    - Program crash
    PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1220
    3⤵
    - Program crash
    PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1236
    3⤵
    - Program crash
    PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1320
    3⤵
    - Program crash
    PID:1304
- - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 692
      4⤵
      Program crash
      PID:2724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 884
      4⤵
      Program crash
      PID:3840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 940
      4⤵
      Program crash
      PID:724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1100
      4⤵
      Program crash
      PID:1888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 896
      4⤵
      Program crash
      PID:2464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 896
      4⤵
      Program crash
      PID:1464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1128
      4⤵
      Program crash
      PID:3976
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 932
      4⤵
      Program crash
      PID:636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 776
      4⤵
      Program crash
      PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3216
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:3408
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:1212
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        5⤵
        
        PID:680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1272
      4⤵
      Program crash
      PID:4728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 760
      4⤵
      Program crash
      PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 756
      4⤵
      Program crash
      PID:3872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1324
      4⤵
      Program crash
      PID:1516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1512
      4⤵
      Program crash
      PID:4300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1076
      4⤵
      Program crash
      PID:3268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1528
      4⤵
      Program crash
      PID:4492
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1080
      4⤵
      Program crash
      PID:3672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1636
      4⤵
      Program crash
      PID:684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1436
    3⤵
    - Program crash
    PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2952 -ip 2952
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1232 -ip 1232
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3888 -ip 3888
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3888 -ip 3888
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3888 -ip 3888
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3888 -ip 3888
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3888 -ip 3888
1⤵
PID:496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3888 -ip 3888
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3888 -ip 3888
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3888 -ip 3888
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3888 -ip 3888
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3888 -ip 3888
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2008 -ip 2008
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2008 -ip 2008
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2008 -ip 2008
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2008 -ip 2008
1⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2008 -ip 2008
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2008 -ip 2008
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2008 -ip 2008
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2008 -ip 2008
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2008 -ip 2008
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2008 -ip 2008
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2008 -ip 2008
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2008 -ip 2008
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2008 -ip 2008
1⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2008 -ip 2008
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2008 -ip 2008
1⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 312
  2⤵
  - Program crash
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2008 -ip 2008
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1896 -ip 1896
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2008 -ip 2008
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2008 -ip 2008
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si032226.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si032226.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un663418.exe

Filesize
762KB

MD5
06a9e42fe184cbaedd95e7fe9896758d

SHA1
8f16ca9762656cd4cdc9137bce875c6ae6742a18

SHA256
3035d9c215f0a3f26dd8d94ef39f264708c1521d70eaf03734620c6df151b03e

SHA512
641d21ef492aa5e08f53d92daa4c14415a08b3d6e45c05ccd2fbd9f0a11dfc56cede4b0087af419c4fea2b837fd28a42175f22906ebd0c28b0c8711703dce290

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un663418.exe

Filesize
762KB

MD5
06a9e42fe184cbaedd95e7fe9896758d

SHA1
8f16ca9762656cd4cdc9137bce875c6ae6742a18

SHA256
3035d9c215f0a3f26dd8d94ef39f264708c1521d70eaf03734620c6df151b03e

SHA512
641d21ef492aa5e08f53d92daa4c14415a08b3d6e45c05ccd2fbd9f0a11dfc56cede4b0087af419c4fea2b837fd28a42175f22906ebd0c28b0c8711703dce290

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk211949.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk211949.exe

Filesize
136KB

MD5
86810f340795831f3c2bd147981be929

SHA1
573345e2c322720fa43f74d761ff1d48028f36c9

SHA256
d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

SHA512
c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un445566.exe

Filesize
608KB

MD5
fa47052fa8846d2947e20ba4e63198ff

SHA1
3f1405703e5184a7ee8e5a85c70826a6ebe50817

SHA256
60fa4627069bb41b9e62877f01a8ef61dbf5ae24de9d11bd3a2107857a7e1560

SHA512
ee1cf2e79d685f557c63a542b6ad2894df9a3d3b08aa09ed036c0ddbdac1bb4173f6f8b5753027e1f8ba073d04092c73924b72ae395241d732668806641f12a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un445566.exe

Filesize
608KB

MD5
fa47052fa8846d2947e20ba4e63198ff

SHA1
3f1405703e5184a7ee8e5a85c70826a6ebe50817

SHA256
60fa4627069bb41b9e62877f01a8ef61dbf5ae24de9d11bd3a2107857a7e1560

SHA512
ee1cf2e79d685f557c63a542b6ad2894df9a3d3b08aa09ed036c0ddbdac1bb4173f6f8b5753027e1f8ba073d04092c73924b72ae395241d732668806641f12a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr799371.exe

Filesize
403KB

MD5
6c1e66eccd6d77dad1f87bee3749c3df

SHA1
923c9db69e19841af6c6335003a8cc745b017441

SHA256
16239ef81d4d70e5a4d0f001f8c42f533428d69142b9b822a4542022c2601ba9

SHA512
8dab69781bf8b6b32bdd15f9959ad7171994a8a0f09e476f2b44bbc11fbb409860fee7ea93b26c0d65e4507d7d705c093d5800f7ac02063ee346c18d0a7d019e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr799371.exe

Filesize
403KB

MD5
6c1e66eccd6d77dad1f87bee3749c3df

SHA1
923c9db69e19841af6c6335003a8cc745b017441

SHA256
16239ef81d4d70e5a4d0f001f8c42f533428d69142b9b822a4542022c2601ba9

SHA512
8dab69781bf8b6b32bdd15f9959ad7171994a8a0f09e476f2b44bbc11fbb409860fee7ea93b26c0d65e4507d7d705c093d5800f7ac02063ee346c18d0a7d019e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu054056.exe

Filesize
485KB

MD5
a18ab7befc936d055f21d822fe35e330

SHA1
e7a8284125cb8ea056fc48feff54ccf7379c27d9

SHA256
4955f97eeb62bf7617a36bd6d01b8241ecb16aaf495a72f18dcf8dbe2bbde428

SHA512
ca739e9569948af45d1a17f7588881ab99ba8f0d3a3317d0d6dbec88c6c2d688e242075009ce5e53b06fe6577e2176986dd7edda469456ee825c12b95e77fcf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu054056.exe

Filesize
485KB

MD5
a18ab7befc936d055f21d822fe35e330

SHA1
e7a8284125cb8ea056fc48feff54ccf7379c27d9

SHA256
4955f97eeb62bf7617a36bd6d01b8241ecb16aaf495a72f18dcf8dbe2bbde428

SHA512
ca739e9569948af45d1a17f7588881ab99ba8f0d3a3317d0d6dbec88c6c2d688e242075009ce5e53b06fe6577e2176986dd7edda469456ee825c12b95e77fcf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
377KB

MD5
5e4ab20363e3aac2d53c25da0719b66e

SHA1
3926626358208b9102e97e93ed11db5423b8bbcb

SHA256
ec058f7a568984b1e975d762936c2144064fd4ff2e0f8e10b905735e1410de31

SHA512
8b85fd7d0c5ed83244feccd9226b79ac939fd2b34670d3e1bdb61a3dcb12cc63f3fa4c5b2db584bea265af9c03bd19b1a8ae7a7243a37a85b34ff38f0f5ae470

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1232-996-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/1232-228-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-1003-0x00000000025C0000-0x0000000002610000-memory.dmp

Filesize
320KB

Download
memory/1232-1002-0x00000000090D0000-0x00000000095FC000-memory.dmp

Filesize
5.2MB

Download
memory/1232-1001-0x0000000008F00000-0x00000000090C2000-memory.dmp

Filesize
1.8MB

Download
memory/1232-1000-0x0000000008CE0000-0x0000000008CFE000-memory.dmp

Filesize
120KB

Download
memory/1232-999-0x0000000008C30000-0x0000000008CA6000-memory.dmp

Filesize
472KB

Download
memory/1232-998-0x0000000008A80000-0x0000000008B12000-memory.dmp

Filesize
584KB

Download
memory/1232-997-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/1232-995-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/1232-994-0x0000000007F90000-0x000000000809A000-memory.dmp

Filesize
1.0MB

Download
memory/1232-993-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/1232-992-0x00000000078B0000-0x0000000007EC8000-memory.dmp

Filesize
6.1MB

Download
memory/1232-197-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-198-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-200-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-202-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-204-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-206-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-208-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-210-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-212-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-214-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-216-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-218-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-220-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-222-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-224-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-226-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-315-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/1232-230-0x0000000002980000-0x00000000029B5000-memory.dmp

Filesize
212KB

Download
memory/1232-312-0x0000000000990000-0x00000000009D6000-memory.dmp

Filesize
280KB

Download
memory/1232-313-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/2924-1009-0x0000000000C40000-0x0000000000C68000-memory.dmp

Filesize
160KB

Download
memory/2924-1010-0x00000000079A0000-0x00000000079B0000-memory.dmp

Filesize
64KB

Download
memory/2952-180-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-158-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-190-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2952-172-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-189-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2952-188-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2952-187-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/2952-186-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-184-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-182-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-178-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-170-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-192-0x0000000000400000-0x000000000080A000-memory.dmp

Filesize
4.0MB

Download
memory/2952-174-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-168-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-164-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-165-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2952-155-0x0000000000AA0000-0x0000000000ACD000-memory.dmp

Filesize
180KB

Download
memory/2952-167-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/2952-162-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-160-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-176-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-157-0x0000000002A20000-0x0000000002A32000-memory.dmp

Filesize
72KB

Download
memory/2952-156-0x0000000004DD0000-0x0000000005374000-memory.dmp

Filesize
5.6MB

Download
memory/3888-1016-0x0000000002470000-0x00000000024A5000-memory.dmp

Filesize
212KB

Download