Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 11:29
Static task
static1
General
-
Target
f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe
-
Size
936KB
-
MD5
be4042f7a56517de8fe520bf026bf47d
-
SHA1
2552b74b577ef488af04f4b713595f8d58cd7cb5
-
SHA256
f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705
-
SHA512
d5f78c861dc8ad8c84f913a7f434b759b2d69b60242c86e1f2770dd6f45643a7d06e54d65ee0dc26e47fe698b95dac9e25bcca56198c8a6a8b2bdfecc2239978
-
SSDEEP
24576:SySZkh5SKCFKT7Y7bGiPJxyapmlAWuAbdhebi8j:5Cu5SbKfHiPJXp0uCLR8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it350393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it350393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it350393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it350393.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it350393.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it350393.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation lr183284.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 4164 ziMh8375.exe 1572 zizo2739.exe 2192 it350393.exe 2988 jr696110.exe 1244 kp440633.exe 4196 lr183284.exe 3940 oneetx.exe 8 oneetx.exe 4192 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 684 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it350393.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziMh8375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziMh8375.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizo2739.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zizo2739.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
pid pid_target Process procid_target 2852 2988 WerFault.exe 91 5068 4196 WerFault.exe 98 936 4196 WerFault.exe 98 4732 4196 WerFault.exe 98 3036 4196 WerFault.exe 98 2096 4196 WerFault.exe 98 724 4196 WerFault.exe 98 3020 4196 WerFault.exe 98 1088 4196 WerFault.exe 98 3784 4196 WerFault.exe 98 3900 4196 WerFault.exe 98 4808 3940 WerFault.exe 118 3696 3940 WerFault.exe 118 1360 3940 WerFault.exe 118 1376 3940 WerFault.exe 118 2172 3940 WerFault.exe 118 5108 3940 WerFault.exe 118 4500 3940 WerFault.exe 118 832 3940 WerFault.exe 118 4928 3940 WerFault.exe 118 4856 3940 WerFault.exe 118 1932 3940 WerFault.exe 118 3800 3940 WerFault.exe 118 4892 3940 WerFault.exe 118 3908 8 WerFault.exe 157 4952 3940 WerFault.exe 118 4896 3940 WerFault.exe 118 3852 3940 WerFault.exe 118 1840 4192 WerFault.exe 167 828 3940 WerFault.exe 118 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5000 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2192 it350393.exe 2192 it350393.exe 2988 jr696110.exe 2988 jr696110.exe 1244 kp440633.exe 1244 kp440633.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2192 it350393.exe Token: SeDebugPrivilege 2988 jr696110.exe Token: SeDebugPrivilege 1244 kp440633.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4196 lr183284.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 620 wrote to memory of 4164 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 84 PID 620 wrote to memory of 4164 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 84 PID 620 wrote to memory of 4164 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 84 PID 4164 wrote to memory of 1572 4164 ziMh8375.exe 85 PID 4164 wrote to memory of 1572 4164 ziMh8375.exe 85 PID 4164 wrote to memory of 1572 4164 ziMh8375.exe 85 PID 1572 wrote to memory of 2192 1572 zizo2739.exe 86 PID 1572 wrote to memory of 2192 1572 zizo2739.exe 86 PID 1572 wrote to memory of 2988 1572 zizo2739.exe 91 PID 1572 wrote to memory of 2988 1572 zizo2739.exe 91 PID 1572 wrote to memory of 2988 1572 zizo2739.exe 91 PID 4164 wrote to memory of 1244 4164 ziMh8375.exe 97 PID 4164 wrote to memory of 1244 4164 ziMh8375.exe 97 PID 4164 wrote to memory of 1244 4164 ziMh8375.exe 97 PID 620 wrote to memory of 4196 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 98 PID 620 wrote to memory of 4196 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 98 PID 620 wrote to memory of 4196 620 f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe 98 PID 4196 wrote to memory of 3940 4196 lr183284.exe 118 PID 4196 wrote to memory of 3940 4196 lr183284.exe 118 PID 4196 wrote to memory of 3940 4196 lr183284.exe 118 PID 3940 wrote to memory of 5000 3940 oneetx.exe 135 PID 3940 wrote to memory of 5000 3940 oneetx.exe 135 PID 3940 wrote to memory of 5000 3940 oneetx.exe 135 PID 3940 wrote to memory of 4588 3940 oneetx.exe 141 PID 3940 wrote to memory of 4588 3940 oneetx.exe 141 PID 3940 wrote to memory of 4588 3940 oneetx.exe 141 PID 4588 wrote to memory of 1476 4588 cmd.exe 145 PID 4588 wrote to memory of 1476 4588 cmd.exe 145 PID 4588 wrote to memory of 1476 4588 cmd.exe 145 PID 4588 wrote to memory of 2616 4588 cmd.exe 146 PID 4588 wrote to memory of 2616 4588 cmd.exe 146 PID 4588 wrote to memory of 2616 4588 cmd.exe 146 PID 4588 wrote to memory of 2056 4588 cmd.exe 147 PID 4588 wrote to memory of 2056 4588 cmd.exe 147 PID 4588 wrote to memory of 2056 4588 cmd.exe 147 PID 4588 wrote to memory of 1572 4588 cmd.exe 148 PID 4588 wrote to memory of 1572 4588 cmd.exe 148 PID 4588 wrote to memory of 1572 4588 cmd.exe 148 PID 4588 wrote to memory of 4340 4588 cmd.exe 149 PID 4588 wrote to memory of 4340 4588 cmd.exe 149 PID 4588 wrote to memory of 4340 4588 cmd.exe 149 PID 4588 wrote to memory of 5024 4588 cmd.exe 150 PID 4588 wrote to memory of 5024 4588 cmd.exe 150 PID 4588 wrote to memory of 5024 4588 cmd.exe 150 PID 3940 wrote to memory of 684 3940 oneetx.exe 164 PID 3940 wrote to memory of 684 3940 oneetx.exe 164 PID 3940 wrote to memory of 684 3940 oneetx.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe"C:\Users\Admin\AppData\Local\Temp\f93fc7ef7773ecbcde168d9bc924802df3527e0940e403ebaafd6e6048763705.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMh8375.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMh8375.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizo2739.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zizo2739.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it350393.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it350393.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr696110.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr696110.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 14685⤵
- Program crash
PID:2852
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440633.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp440633.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr183284.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr183284.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 6963⤵
- Program crash
PID:5068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 7643⤵
- Program crash
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 8563⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9523⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9603⤵
- Program crash
PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 9723⤵
- Program crash
PID:724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 12163⤵
- Program crash
PID:3020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 12563⤵
- Program crash
PID:1088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 12443⤵
- Program crash
PID:3784
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 6924⤵
- Program crash
PID:4808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 8844⤵
- Program crash
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 9404⤵
- Program crash
PID:1360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11044⤵
- Program crash
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11364⤵
- Program crash
PID:2172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11364⤵
- Program crash
PID:5108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11844⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 9324⤵
- Program crash
PID:832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7684⤵
- Program crash
PID:4928
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1476
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2616
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1572
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:4340
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:5024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 10764⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7604⤵
- Program crash
PID:1932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 7284⤵
- Program crash
PID:3800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 9084⤵
- Program crash
PID:4892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 12044⤵
- Program crash
PID:4952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 16084⤵
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 11644⤵
- Program crash
PID:3852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 16204⤵
- Program crash
PID:828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 13563⤵
- Program crash
PID:3900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2988 -ip 29881⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4196 -ip 41961⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4196 -ip 41961⤵PID:3496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4196 -ip 41961⤵PID:4488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4196 -ip 41961⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4196 -ip 41961⤵PID:1280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4196 -ip 41961⤵PID:3932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4196 -ip 41961⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4196 -ip 41961⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4196 -ip 41961⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4196 -ip 41961⤵PID:4264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3940 -ip 39401⤵PID:2476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3940 -ip 39401⤵PID:5012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3940 -ip 39401⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3940 -ip 39401⤵PID:4444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3940 -ip 39401⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3940 -ip 39401⤵PID:3556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3940 -ip 39401⤵PID:4100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3940 -ip 39401⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3940 -ip 39401⤵PID:4868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3940 -ip 39401⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3940 -ip 39401⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3940 -ip 39401⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3940 -ip 39401⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 3122⤵
- Program crash
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8 -ip 81⤵PID:936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3940 -ip 39401⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3940 -ip 39401⤵PID:1220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3940 -ip 39401⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 3162⤵
- Program crash
PID:1840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4192 -ip 41921⤵PID:1260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3940 -ip 39401⤵PID:4480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
623KB
MD50c468107c439b0f5c9b981ab190e8358
SHA17012a35839f2fedf3c8fda1e783e31bdc1eb8767
SHA2561e5c1cc00f54afcc7e06a5ab743c7c8e1d525ea810808d2f379e9e5f06ce1cb4
SHA512e9b87e7d30cac85f77787fa70728f0962f6faadfba4c936af7bace366044be6c5d4c659a7612499a273c07e1401c59a5bf3454fe08548fbe39238b5adf17464e
-
Filesize
623KB
MD50c468107c439b0f5c9b981ab190e8358
SHA17012a35839f2fedf3c8fda1e783e31bdc1eb8767
SHA2561e5c1cc00f54afcc7e06a5ab743c7c8e1d525ea810808d2f379e9e5f06ce1cb4
SHA512e9b87e7d30cac85f77787fa70728f0962f6faadfba4c936af7bace366044be6c5d4c659a7612499a273c07e1401c59a5bf3454fe08548fbe39238b5adf17464e
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
469KB
MD521371cf2d0339ab9e4a2f051a101e977
SHA1fabafd7ba622cff7138cf6c1de58d9c7d60e0afe
SHA256e3aa8fd30d716f4d96578648de99bbbda4e5a4a1d9466aadee383a0d9ec6b5e6
SHA5120d3fbe4d38de3528778e9676c55c443c98ea5b0ca0c34a776efa66f9b2fb1f0e87807a8d97387f688b2ada21af28c1f9b481c189b979698c2aa71f63c0989d5e
-
Filesize
469KB
MD521371cf2d0339ab9e4a2f051a101e977
SHA1fabafd7ba622cff7138cf6c1de58d9c7d60e0afe
SHA256e3aa8fd30d716f4d96578648de99bbbda4e5a4a1d9466aadee383a0d9ec6b5e6
SHA5120d3fbe4d38de3528778e9676c55c443c98ea5b0ca0c34a776efa66f9b2fb1f0e87807a8d97387f688b2ada21af28c1f9b481c189b979698c2aa71f63c0989d5e
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
488KB
MD53710e9691dafa8b26142c8d39e98c127
SHA100917d2c73d1fe4a7a3fce556246a6710c9eed77
SHA2562c59d0f9462d695dde2763a44b930dc0b4e7ed99e6f00238667b0797b8a75329
SHA51224c5b618ac01ea1a3149751368a4e144dbe285d81ec6416e9cfb21d66d87d2f79c3663c2af5618e362f287153d6759370dd28a824592a4c588fc8109c3ab0bb4
-
Filesize
488KB
MD53710e9691dafa8b26142c8d39e98c127
SHA100917d2c73d1fe4a7a3fce556246a6710c9eed77
SHA2562c59d0f9462d695dde2763a44b930dc0b4e7ed99e6f00238667b0797b8a75329
SHA51224c5b618ac01ea1a3149751368a4e144dbe285d81ec6416e9cfb21d66d87d2f79c3663c2af5618e362f287153d6759370dd28a824592a4c588fc8109c3ab0bb4
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
383KB
MD50c0072886a6ff70f21f9daa9a1583f48
SHA1826f0f936b36329003f6f94ab333162418bb9660
SHA256a0b54cede28a953b42f551fcdb66b32d5359f9e013bcf16fdbd16f497a99a501
SHA512ac60877874f18471532859109eaadd5f6bd510bf0df6d320a385d4b9ee585cadb9800a210e7d4c63ccc6fbf9fdfb45b399a60fe8b32deacc61a777f34cd3580d
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5