Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 10:35
Static task
static1
General
-
Target
13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe
-
Size
1.1MB
-
MD5
4a754c674f10b3023297d7d41ca68395
-
SHA1
e20c301a11c169f654c2c1317bcd8a5bf3c68697
-
SHA256
13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3
-
SHA512
3f8a42972e57002562908eabedeb6fda2c443a304e3241d9ca260fe6e22aeeb7908f2d87714485e895e71387a0948eb1d3c99694e755177c33dd219557762053
-
SSDEEP
24576:4yMVzIZT0xDaIydRRY7N88PtIP3Tt77cLUX68afQcJGWDI:/MVsl0xDc+28PtG3TJHX68WR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr521811.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation si003719.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2228 un319505.exe 2120 un088173.exe 2788 pr521811.exe 4264 qu378142.exe 4520 rk797733.exe 1780 si003719.exe 796 oneetx.exe 4848 oneetx.exe 3596 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4000 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr521811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr521811.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un319505.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un319505.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un088173.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un088173.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3284 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 32 IoCs
pid pid_target Process procid_target 4444 2788 WerFault.exe 85 4944 4264 WerFault.exe 91 1256 1780 WerFault.exe 95 1728 1780 WerFault.exe 95 1688 1780 WerFault.exe 95 2268 1780 WerFault.exe 95 2460 1780 WerFault.exe 95 1108 1780 WerFault.exe 95 2776 1780 WerFault.exe 95 3364 1780 WerFault.exe 95 2464 1780 WerFault.exe 95 2848 1780 WerFault.exe 95 2876 796 WerFault.exe 115 2200 796 WerFault.exe 115 4556 796 WerFault.exe 115 3328 796 WerFault.exe 115 3676 796 WerFault.exe 115 2408 796 WerFault.exe 115 4732 796 WerFault.exe 115 4796 796 WerFault.exe 115 1568 796 WerFault.exe 115 4344 796 WerFault.exe 115 4448 796 WerFault.exe 115 1152 796 WerFault.exe 115 2232 796 WerFault.exe 115 1688 796 WerFault.exe 115 3888 796 WerFault.exe 115 1348 4848 WerFault.exe 162 3608 796 WerFault.exe 115 1332 796 WerFault.exe 115 1936 796 WerFault.exe 115 4292 3596 WerFault.exe 172 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2788 pr521811.exe 2788 pr521811.exe 4264 qu378142.exe 4264 qu378142.exe 4520 rk797733.exe 4520 rk797733.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2788 pr521811.exe Token: SeDebugPrivilege 4264 qu378142.exe Token: SeDebugPrivilege 4520 rk797733.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1780 si003719.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3336 wrote to memory of 2228 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 83 PID 3336 wrote to memory of 2228 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 83 PID 3336 wrote to memory of 2228 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 83 PID 2228 wrote to memory of 2120 2228 un319505.exe 84 PID 2228 wrote to memory of 2120 2228 un319505.exe 84 PID 2228 wrote to memory of 2120 2228 un319505.exe 84 PID 2120 wrote to memory of 2788 2120 un088173.exe 85 PID 2120 wrote to memory of 2788 2120 un088173.exe 85 PID 2120 wrote to memory of 2788 2120 un088173.exe 85 PID 2120 wrote to memory of 4264 2120 un088173.exe 91 PID 2120 wrote to memory of 4264 2120 un088173.exe 91 PID 2120 wrote to memory of 4264 2120 un088173.exe 91 PID 2228 wrote to memory of 4520 2228 un319505.exe 94 PID 2228 wrote to memory of 4520 2228 un319505.exe 94 PID 2228 wrote to memory of 4520 2228 un319505.exe 94 PID 3336 wrote to memory of 1780 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 95 PID 3336 wrote to memory of 1780 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 95 PID 3336 wrote to memory of 1780 3336 13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe 95 PID 1780 wrote to memory of 796 1780 si003719.exe 115 PID 1780 wrote to memory of 796 1780 si003719.exe 115 PID 1780 wrote to memory of 796 1780 si003719.exe 115 PID 796 wrote to memory of 4444 796 oneetx.exe 133 PID 796 wrote to memory of 4444 796 oneetx.exe 133 PID 796 wrote to memory of 4444 796 oneetx.exe 133 PID 796 wrote to memory of 1140 796 oneetx.exe 139 PID 796 wrote to memory of 1140 796 oneetx.exe 139 PID 796 wrote to memory of 1140 796 oneetx.exe 139 PID 1140 wrote to memory of 1564 1140 cmd.exe 143 PID 1140 wrote to memory of 1564 1140 cmd.exe 143 PID 1140 wrote to memory of 1564 1140 cmd.exe 143 PID 1140 wrote to memory of 4596 1140 cmd.exe 144 PID 1140 wrote to memory of 4596 1140 cmd.exe 144 PID 1140 wrote to memory of 4596 1140 cmd.exe 144 PID 1140 wrote to memory of 1876 1140 cmd.exe 145 PID 1140 wrote to memory of 1876 1140 cmd.exe 145 PID 1140 wrote to memory of 1876 1140 cmd.exe 145 PID 1140 wrote to memory of 5092 1140 cmd.exe 146 PID 1140 wrote to memory of 5092 1140 cmd.exe 146 PID 1140 wrote to memory of 5092 1140 cmd.exe 146 PID 1140 wrote to memory of 3316 1140 cmd.exe 147 PID 1140 wrote to memory of 3316 1140 cmd.exe 147 PID 1140 wrote to memory of 3316 1140 cmd.exe 147 PID 1140 wrote to memory of 3512 1140 cmd.exe 148 PID 1140 wrote to memory of 3512 1140 cmd.exe 148 PID 1140 wrote to memory of 3512 1140 cmd.exe 148 PID 796 wrote to memory of 4000 796 oneetx.exe 167 PID 796 wrote to memory of 4000 796 oneetx.exe 167 PID 796 wrote to memory of 4000 796 oneetx.exe 167
Processes
-
C:\Users\Admin\AppData\Local\Temp\13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe"C:\Users\Admin\AppData\Local\Temp\13023866de2a095ca077c68868bdcc60900e482999fcd0961de3cb349bf389a3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un319505.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un319505.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un088173.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un088173.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr521811.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr521811.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 10845⤵
- Program crash
PID:4444
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu378142.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu378142.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 16445⤵
- Program crash
PID:4944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk797733.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk797733.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003719.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si003719.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 6963⤵
- Program crash
PID:1256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 7803⤵
- Program crash
PID:1728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 8683⤵
- Program crash
PID:1688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 9523⤵
- Program crash
PID:2268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 9803⤵
- Program crash
PID:2460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 9803⤵
- Program crash
PID:1108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 12003⤵
- Program crash
PID:2776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 12483⤵
- Program crash
PID:3364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 13163⤵
- Program crash
PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 6924⤵
- Program crash
PID:2876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 8404⤵
- Program crash
PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 8564⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 10484⤵
- Program crash
PID:3328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 10484⤵
- Program crash
PID:3676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 10844⤵
- Program crash
PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 11284⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 9924⤵
- Program crash
PID:4796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 13004⤵
- Program crash
PID:1568
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1564
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4596
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5092
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3316
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:3512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 12724⤵
- Program crash
PID:4344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 12924⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 7524⤵
- Program crash
PID:1152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 7764⤵
- Program crash
PID:2232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 14324⤵
- Program crash
PID:1688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 10644⤵
- Program crash
PID:3888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16444⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 13724⤵
- Program crash
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 16524⤵
- Program crash
PID:1936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 14323⤵
- Program crash
PID:2848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2788 -ip 27881⤵PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4264 -ip 42641⤵PID:4656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1780 -ip 17801⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1780 -ip 17801⤵PID:972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1780 -ip 17801⤵PID:748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1780 -ip 17801⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1780 -ip 17801⤵PID:3792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1780 -ip 17801⤵PID:1960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1780 -ip 17801⤵PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1780 -ip 17801⤵PID:4844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1780 -ip 17801⤵PID:3220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1780 -ip 17801⤵PID:3244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 796 -ip 7961⤵PID:3152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 796 -ip 7961⤵PID:3092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 796 -ip 7961⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 796 -ip 7961⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 796 -ip 7961⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 796 -ip 7961⤵PID:3652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 796 -ip 7961⤵PID:664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 796 -ip 7961⤵PID:1596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 796 -ip 7961⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 796 -ip 7961⤵PID:4800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 796 -ip 7961⤵PID:4868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 796 -ip 7961⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 796 -ip 7961⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 796 -ip 7961⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 796 -ip 7961⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 3162⤵
- Program crash
PID:1348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4848 -ip 48481⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 796 -ip 7961⤵PID:4280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 796 -ip 7961⤵PID:3400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 796 -ip 7961⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 3202⤵
- Program crash
PID:4292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3596 -ip 35961⤵PID:4584
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3284
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
763KB
MD54f2c4c5fdcf88e909a56071a8dd8421e
SHA150821f6cc1b60d19e8b58fd6bd97eb6da738a3ef
SHA256aee35586fa53c99bb3fc71f25f36c62a69322aba3f4924320d04947ed375b142
SHA51219a1ecb527b758e3235b23ee4ecb2f5d9066d31901071bcf9cc2e115c0f95e9568cba01ba83d4a9fc46d45f5a4d2fa8120d4f5c4ffce04946c882dc51ea10018
-
Filesize
763KB
MD54f2c4c5fdcf88e909a56071a8dd8421e
SHA150821f6cc1b60d19e8b58fd6bd97eb6da738a3ef
SHA256aee35586fa53c99bb3fc71f25f36c62a69322aba3f4924320d04947ed375b142
SHA51219a1ecb527b758e3235b23ee4ecb2f5d9066d31901071bcf9cc2e115c0f95e9568cba01ba83d4a9fc46d45f5a4d2fa8120d4f5c4ffce04946c882dc51ea10018
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
609KB
MD5cc170965c32cff899fab603d61b10251
SHA1aee3deb203d6a9238bd2637cbf9b12026a695902
SHA256981d9f0b9d2d444fb08b6122d21044d4f91afbb1c46ad1a87f6576f6eb4734a1
SHA512229adacbcbe0e1ec3aafbcd7b7d2ee83dd0c50060809b266071986c5524037adf30466717a0262c95cf32a4e6b678e8684e1d0382665f46a1e444fb2029af97f
-
Filesize
609KB
MD5cc170965c32cff899fab603d61b10251
SHA1aee3deb203d6a9238bd2637cbf9b12026a695902
SHA256981d9f0b9d2d444fb08b6122d21044d4f91afbb1c46ad1a87f6576f6eb4734a1
SHA512229adacbcbe0e1ec3aafbcd7b7d2ee83dd0c50060809b266071986c5524037adf30466717a0262c95cf32a4e6b678e8684e1d0382665f46a1e444fb2029af97f
-
Filesize
405KB
MD5b7099992e96c93af316f91d2c6549388
SHA18d5ddd41b96cd8af4b896929e2e35ca3a5e53a3f
SHA25699c5ec9ad24ea91d1d4dfe3274de371a2516df41985027eeb60761c3ff6dda09
SHA51227d5c27bd5a1f516d43b4590f516b89dc69ea7878deb1bae68f2f03a307c0646bfefca522fa095c34a08cd824cd43e929e69673bff8ac27682c3d311bc519909
-
Filesize
405KB
MD5b7099992e96c93af316f91d2c6549388
SHA18d5ddd41b96cd8af4b896929e2e35ca3a5e53a3f
SHA25699c5ec9ad24ea91d1d4dfe3274de371a2516df41985027eeb60761c3ff6dda09
SHA51227d5c27bd5a1f516d43b4590f516b89dc69ea7878deb1bae68f2f03a307c0646bfefca522fa095c34a08cd824cd43e929e69673bff8ac27682c3d311bc519909
-
Filesize
488KB
MD50425f11f3a490c0fc80d2fd020017b6f
SHA125242d678fc8dc2d5ef4965cb6b00e9948d65290
SHA25631ae630fe8146a42df6d5d6e72efcfae518f85090a04e2d24cfedb6319f254fb
SHA512d5bef32f6ba79a29846ea2cda6e104994692f6f3b0646260a3416dfe17ea7ab29f51c4442927fc2e2f752ce3eb0ecdaf3cc9e24e5fa69aaff5f39bf8f8f1a79a
-
Filesize
488KB
MD50425f11f3a490c0fc80d2fd020017b6f
SHA125242d678fc8dc2d5ef4965cb6b00e9948d65290
SHA25631ae630fe8146a42df6d5d6e72efcfae518f85090a04e2d24cfedb6319f254fb
SHA512d5bef32f6ba79a29846ea2cda6e104994692f6f3b0646260a3416dfe17ea7ab29f51c4442927fc2e2f752ce3eb0ecdaf3cc9e24e5fa69aaff5f39bf8f8f1a79a
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
383KB
MD573103505b786d5d7b9c085bc34423658
SHA12fd0c02cdd734d9dcccbbcfaac3876d1727b28a6
SHA256263b2b84732398c0d5b7205395b19aeeed4d128e3684831982d51ec8d0ad26c6
SHA51283897536e59bf678e70a54484a66a86217ec87eee34f44a683b6f5f8592170311abc218242c2e38a0342b065ba77144d743d5976216783315612eeeb2c33cd20
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5