Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 10:21
Static task
static1
General
-
Target
602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe
-
Size
1.1MB
-
MD5
0db7b764ead6447da3ac2c7f6b1518fe
-
SHA1
953bf9dd4040e093ffbc80aa218ee58282a308f8
-
SHA256
602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8
-
SHA512
969e8f247a875bf99afbebc6591e324cafe72f3d40635f54f77ec743fd6a6c5d4044185c88fea7a8c48793c7fd63d8b1ef5f16d60c248b8597b31f675473c212
-
SSDEEP
24576:byZDmN3ARMiKtS5PqVgqgdERp0Y7Up8PfR49I1TSe/pDBAM:OZqaRMttcygPWp/A8PfC61TS
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr403658.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr403658.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr403658.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr403658.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr403658.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr403658.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si968406.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 832 un837110.exe 3556 un134009.exe 3660 pr403658.exe 1016 qu201216.exe 3660 rk904920.exe 1440 si968406.exe 4300 oneetx.exe 4772 oneetx.exe 4996 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4412 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr403658.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr403658.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un837110.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un837110.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un134009.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un134009.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 31 IoCs
pid pid_target Process procid_target 3336 3660 WerFault.exe 85 2092 1016 WerFault.exe 88 3124 1440 WerFault.exe 93 4376 1440 WerFault.exe 93 4384 1440 WerFault.exe 93 4020 1440 WerFault.exe 93 4132 1440 WerFault.exe 93 2100 1440 WerFault.exe 93 2240 1440 WerFault.exe 93 916 1440 WerFault.exe 93 2560 1440 WerFault.exe 93 4440 1440 WerFault.exe 93 4944 4300 WerFault.exe 112 4776 4300 WerFault.exe 112 2636 4300 WerFault.exe 112 804 4300 WerFault.exe 112 3324 4300 WerFault.exe 112 1072 4300 WerFault.exe 112 4488 4300 WerFault.exe 112 2116 4300 WerFault.exe 112 3276 4300 WerFault.exe 112 2460 4300 WerFault.exe 112 1804 4300 WerFault.exe 112 3336 4300 WerFault.exe 112 4660 4300 WerFault.exe 112 1016 4300 WerFault.exe 112 4740 4772 WerFault.exe 153 3392 4300 WerFault.exe 112 4664 4300 WerFault.exe 112 3524 4300 WerFault.exe 112 4732 4996 WerFault.exe 163 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3660 pr403658.exe 3660 pr403658.exe 1016 qu201216.exe 1016 qu201216.exe 3660 rk904920.exe 3660 rk904920.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3660 pr403658.exe Token: SeDebugPrivilege 1016 qu201216.exe Token: SeDebugPrivilege 3660 rk904920.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 si968406.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2072 wrote to memory of 832 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 83 PID 2072 wrote to memory of 832 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 83 PID 2072 wrote to memory of 832 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 83 PID 832 wrote to memory of 3556 832 un837110.exe 84 PID 832 wrote to memory of 3556 832 un837110.exe 84 PID 832 wrote to memory of 3556 832 un837110.exe 84 PID 3556 wrote to memory of 3660 3556 un134009.exe 85 PID 3556 wrote to memory of 3660 3556 un134009.exe 85 PID 3556 wrote to memory of 3660 3556 un134009.exe 85 PID 3556 wrote to memory of 1016 3556 un134009.exe 88 PID 3556 wrote to memory of 1016 3556 un134009.exe 88 PID 3556 wrote to memory of 1016 3556 un134009.exe 88 PID 832 wrote to memory of 3660 832 un837110.exe 91 PID 832 wrote to memory of 3660 832 un837110.exe 91 PID 832 wrote to memory of 3660 832 un837110.exe 91 PID 2072 wrote to memory of 1440 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 93 PID 2072 wrote to memory of 1440 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 93 PID 2072 wrote to memory of 1440 2072 602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe 93 PID 1440 wrote to memory of 4300 1440 si968406.exe 112 PID 1440 wrote to memory of 4300 1440 si968406.exe 112 PID 1440 wrote to memory of 4300 1440 si968406.exe 112 PID 4300 wrote to memory of 3252 4300 oneetx.exe 129 PID 4300 wrote to memory of 3252 4300 oneetx.exe 129 PID 4300 wrote to memory of 3252 4300 oneetx.exe 129 PID 4300 wrote to memory of 3884 4300 oneetx.exe 135 PID 4300 wrote to memory of 3884 4300 oneetx.exe 135 PID 4300 wrote to memory of 3884 4300 oneetx.exe 135 PID 3884 wrote to memory of 3228 3884 cmd.exe 139 PID 3884 wrote to memory of 3228 3884 cmd.exe 139 PID 3884 wrote to memory of 3228 3884 cmd.exe 139 PID 3884 wrote to memory of 4932 3884 cmd.exe 140 PID 3884 wrote to memory of 4932 3884 cmd.exe 140 PID 3884 wrote to memory of 4932 3884 cmd.exe 140 PID 3884 wrote to memory of 4076 3884 cmd.exe 141 PID 3884 wrote to memory of 4076 3884 cmd.exe 141 PID 3884 wrote to memory of 4076 3884 cmd.exe 141 PID 3884 wrote to memory of 4164 3884 cmd.exe 142 PID 3884 wrote to memory of 4164 3884 cmd.exe 142 PID 3884 wrote to memory of 4164 3884 cmd.exe 142 PID 3884 wrote to memory of 964 3884 cmd.exe 143 PID 3884 wrote to memory of 964 3884 cmd.exe 143 PID 3884 wrote to memory of 964 3884 cmd.exe 143 PID 3884 wrote to memory of 4884 3884 cmd.exe 144 PID 3884 wrote to memory of 4884 3884 cmd.exe 144 PID 3884 wrote to memory of 4884 3884 cmd.exe 144 PID 4300 wrote to memory of 4412 4300 oneetx.exe 158 PID 4300 wrote to memory of 4412 4300 oneetx.exe 158 PID 4300 wrote to memory of 4412 4300 oneetx.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe"C:\Users\Admin\AppData\Local\Temp\602d036f4467bae9d90c2fbe0baaf7d9822bdd57eee4c4fdd2cbbecffd2ae9a8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un837110.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un837110.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un134009.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un134009.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr403658.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr403658.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 10845⤵
- Program crash
PID:3336
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu201216.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu201216.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 16405⤵
- Program crash
PID:2092
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk904920.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk904920.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968406.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si968406.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 6963⤵
- Program crash
PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 7763⤵
- Program crash
PID:4376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 8803⤵
- Program crash
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 9763⤵
- Program crash
PID:4020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 9723⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 9723⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 12163⤵
- Program crash
PID:2240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 12323⤵
- Program crash
PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 12883⤵
- Program crash
PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 6924⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8204⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 8324⤵
- Program crash
PID:2636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 10524⤵
- Program crash
PID:804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 10884⤵
- Program crash
PID:3324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11084⤵
- Program crash
PID:1072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 11164⤵
- Program crash
PID:4488
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 10084⤵
- Program crash
PID:2116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 7284⤵
- Program crash
PID:3276
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3228
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4164
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:964
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 12644⤵
- Program crash
PID:2460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 7524⤵
- Program crash
PID:1804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 7444⤵
- Program crash
PID:3336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 6924⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 13884⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 16484⤵
- Program crash
PID:3392
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 15844⤵
- Program crash
PID:4664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 16644⤵
- Program crash
PID:3524
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 13563⤵
- Program crash
PID:4440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3660 -ip 36601⤵PID:2128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1016 -ip 10161⤵PID:3336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1440 -ip 14401⤵PID:1292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1440 -ip 14401⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1440 -ip 14401⤵PID:4292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1440 -ip 14401⤵PID:2452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1440 -ip 14401⤵PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1440 -ip 14401⤵PID:2900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1440 -ip 14401⤵PID:2720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1440 -ip 14401⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1440 -ip 14401⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1440 -ip 14401⤵PID:1688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4300 -ip 43001⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4300 -ip 43001⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4300 -ip 43001⤵PID:432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4300 -ip 43001⤵PID:388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4300 -ip 43001⤵PID:1808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4300 -ip 43001⤵PID:3284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4300 -ip 43001⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4300 -ip 43001⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4300 -ip 43001⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4300 -ip 43001⤵PID:4124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4300 -ip 43001⤵PID:2588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4300 -ip 43001⤵PID:1896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4300 -ip 43001⤵PID:444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4300 -ip 43001⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 3122⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4772 -ip 47721⤵PID:4368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4300 -ip 43001⤵PID:2536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4300 -ip 43001⤵PID:1420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4300 -ip 43001⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 3162⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4996 -ip 49961⤵PID:2900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
763KB
MD55b9986e6268929054fb33080651068a8
SHA1e3489e532bc17495094c6e7ab5df0eb457067865
SHA256e75d4eead031077dbef659cda917fe4cf454a669e22d409dc15d19f44a8e2987
SHA51232a1b4a562d3d875460053b19f370ea9735a36fa2d0a3356059d807559516bfe043fc56821e0c15ce0666621c2f13bfe11eba462a8c34202ac9ad7373a2d869e
-
Filesize
763KB
MD55b9986e6268929054fb33080651068a8
SHA1e3489e532bc17495094c6e7ab5df0eb457067865
SHA256e75d4eead031077dbef659cda917fe4cf454a669e22d409dc15d19f44a8e2987
SHA51232a1b4a562d3d875460053b19f370ea9735a36fa2d0a3356059d807559516bfe043fc56821e0c15ce0666621c2f13bfe11eba462a8c34202ac9ad7373a2d869e
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
609KB
MD5f46273c12769f178e54253f8b5361fa9
SHA1ddf1e59e215378acc7b5a5c52b4474489da7e756
SHA2569e965f4f3b228f0c4e7b1deb0fd51b91da9c1ff93f5d3f513ebda21b448db790
SHA5125b18e809977d4b02cde017f03e7773db10af7979acec9cc1874cb6efcf03bbcc437c7686b4dc33e63ea10a18e1ea9a3a6bb49a8998ba36ccf731688ba5559070
-
Filesize
609KB
MD5f46273c12769f178e54253f8b5361fa9
SHA1ddf1e59e215378acc7b5a5c52b4474489da7e756
SHA2569e965f4f3b228f0c4e7b1deb0fd51b91da9c1ff93f5d3f513ebda21b448db790
SHA5125b18e809977d4b02cde017f03e7773db10af7979acec9cc1874cb6efcf03bbcc437c7686b4dc33e63ea10a18e1ea9a3a6bb49a8998ba36ccf731688ba5559070
-
Filesize
405KB
MD516cd951acfb09f63a8a205773bd40f1b
SHA107b14565be316b57873cb2d8efd8eb55d670dcc1
SHA256e364b12f6e3f0238b768cf308d58bc1f61c16b6b638f26b171578c205fbaa059
SHA51296a87ed68424bb34181049eb540051959debf36356e6235733076540b3a14b947898dca948390bfa76d46441381c676610a110fc86e0434d5691acb0cd3cd45f
-
Filesize
405KB
MD516cd951acfb09f63a8a205773bd40f1b
SHA107b14565be316b57873cb2d8efd8eb55d670dcc1
SHA256e364b12f6e3f0238b768cf308d58bc1f61c16b6b638f26b171578c205fbaa059
SHA51296a87ed68424bb34181049eb540051959debf36356e6235733076540b3a14b947898dca948390bfa76d46441381c676610a110fc86e0434d5691acb0cd3cd45f
-
Filesize
488KB
MD5da3c432c71f736afc6a58132124a0014
SHA19f249f8a0ef1b5ba5fc16d95cf0609c84642c486
SHA256f2136f69b23fbec9ea21128e027cecffe04a027d4a653b6d70ef3b66de4d429a
SHA5121510b51d0b4acddef4f3a5b2a0bf30017ee4c87f419f94342d88d3e36e516da74befa6e575de4273bdfd153151ca2f8854213d5a24abd62dd5a67ab0f74dc2e0
-
Filesize
488KB
MD5da3c432c71f736afc6a58132124a0014
SHA19f249f8a0ef1b5ba5fc16d95cf0609c84642c486
SHA256f2136f69b23fbec9ea21128e027cecffe04a027d4a653b6d70ef3b66de4d429a
SHA5121510b51d0b4acddef4f3a5b2a0bf30017ee4c87f419f94342d88d3e36e516da74befa6e575de4273bdfd153151ca2f8854213d5a24abd62dd5a67ab0f74dc2e0
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
383KB
MD5f1da5b799b810e14846187171256fff8
SHA173e72ed8b681b3c83f7e3e46fe17e40f3cf917b6
SHA2567c25e4fd3488da729ff487cf0b60a990d6a5a1a0ab2e14a314bb6fcef37832e8
SHA51219105387c18fb7358a457440eef1208577add4c65f628e5b1e3a6820dfca0fdd2653bd81252dac1eb24b7e57f6cba9a26c78599b0cf6a1c83f382977668b71e8
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5