Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 12:08
Static task
static1
General
-
Target
6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe
-
Size
1.1MB
-
MD5
6465ab307b3e402d9803d8eebd3dd519
-
SHA1
22c378cd72986d5fa204704c6719f829a9a664bd
-
SHA256
6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500
-
SHA512
380aed0bf9b2af353da96c1ba78cbc8ce675c18aaedc09b46b52ff82cf6b6819fe892ef53872335ffac82a1649b81a56e3c82845e49708c50c791f35871f82af
-
SSDEEP
24576:UyThdZ9WBrlTnjk+tY7cZ8PtoDQ6b3o0GrW2BLEcAoRm51:j7qBrlTFm+8PtZ600pYc9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr589029.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr589029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr589029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr589029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr589029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr589029.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si108191.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 4940 un766225.exe 4904 un855986.exe 1000 pr589029.exe 2708 qu648773.exe 5036 rk389145.exe 1356 si108191.exe 3236 oneetx.exe 3996 oneetx.exe 1868 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2716 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr589029.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr589029.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un766225.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un766225.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un855986.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un855986.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 32 IoCs
pid pid_target Process procid_target 4828 1000 WerFault.exe 84 964 2708 WerFault.exe 93 1116 1356 WerFault.exe 98 3120 1356 WerFault.exe 98 4276 1356 WerFault.exe 98 4216 1356 WerFault.exe 98 4920 1356 WerFault.exe 98 1448 1356 WerFault.exe 98 3628 1356 WerFault.exe 98 4996 1356 WerFault.exe 98 4956 1356 WerFault.exe 98 1488 1356 WerFault.exe 98 668 3236 WerFault.exe 118 2704 3236 WerFault.exe 118 1628 3236 WerFault.exe 118 2772 3236 WerFault.exe 118 4008 3236 WerFault.exe 118 744 3236 WerFault.exe 118 4320 3236 WerFault.exe 118 4640 3236 WerFault.exe 118 2212 3236 WerFault.exe 118 2952 3236 WerFault.exe 118 2776 3236 WerFault.exe 118 4740 3236 WerFault.exe 118 4612 3236 WerFault.exe 118 2408 3236 WerFault.exe 118 2488 3236 WerFault.exe 118 1896 3996 WerFault.exe 161 3648 3236 WerFault.exe 118 4996 3236 WerFault.exe 118 2932 3236 WerFault.exe 118 2728 1868 WerFault.exe 171 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4208 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1000 pr589029.exe 1000 pr589029.exe 2708 qu648773.exe 2708 qu648773.exe 5036 rk389145.exe 5036 rk389145.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1000 pr589029.exe Token: SeDebugPrivilege 2708 qu648773.exe Token: SeDebugPrivilege 5036 rk389145.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1356 si108191.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2068 wrote to memory of 4940 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 82 PID 2068 wrote to memory of 4940 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 82 PID 2068 wrote to memory of 4940 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 82 PID 4940 wrote to memory of 4904 4940 un766225.exe 83 PID 4940 wrote to memory of 4904 4940 un766225.exe 83 PID 4940 wrote to memory of 4904 4940 un766225.exe 83 PID 4904 wrote to memory of 1000 4904 un855986.exe 84 PID 4904 wrote to memory of 1000 4904 un855986.exe 84 PID 4904 wrote to memory of 1000 4904 un855986.exe 84 PID 4904 wrote to memory of 2708 4904 un855986.exe 93 PID 4904 wrote to memory of 2708 4904 un855986.exe 93 PID 4904 wrote to memory of 2708 4904 un855986.exe 93 PID 4940 wrote to memory of 5036 4940 un766225.exe 97 PID 4940 wrote to memory of 5036 4940 un766225.exe 97 PID 4940 wrote to memory of 5036 4940 un766225.exe 97 PID 2068 wrote to memory of 1356 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 98 PID 2068 wrote to memory of 1356 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 98 PID 2068 wrote to memory of 1356 2068 6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe 98 PID 1356 wrote to memory of 3236 1356 si108191.exe 118 PID 1356 wrote to memory of 3236 1356 si108191.exe 118 PID 1356 wrote to memory of 3236 1356 si108191.exe 118 PID 3236 wrote to memory of 4208 3236 oneetx.exe 135 PID 3236 wrote to memory of 4208 3236 oneetx.exe 135 PID 3236 wrote to memory of 4208 3236 oneetx.exe 135 PID 3236 wrote to memory of 1816 3236 oneetx.exe 141 PID 3236 wrote to memory of 1816 3236 oneetx.exe 141 PID 3236 wrote to memory of 1816 3236 oneetx.exe 141 PID 1816 wrote to memory of 1632 1816 cmd.exe 145 PID 1816 wrote to memory of 1632 1816 cmd.exe 145 PID 1816 wrote to memory of 1632 1816 cmd.exe 145 PID 1816 wrote to memory of 3932 1816 cmd.exe 146 PID 1816 wrote to memory of 3932 1816 cmd.exe 146 PID 1816 wrote to memory of 3932 1816 cmd.exe 146 PID 1816 wrote to memory of 3368 1816 cmd.exe 147 PID 1816 wrote to memory of 3368 1816 cmd.exe 147 PID 1816 wrote to memory of 3368 1816 cmd.exe 147 PID 1816 wrote to memory of 1176 1816 cmd.exe 148 PID 1816 wrote to memory of 1176 1816 cmd.exe 148 PID 1816 wrote to memory of 1176 1816 cmd.exe 148 PID 1816 wrote to memory of 5000 1816 cmd.exe 149 PID 1816 wrote to memory of 5000 1816 cmd.exe 149 PID 1816 wrote to memory of 5000 1816 cmd.exe 149 PID 1816 wrote to memory of 4528 1816 cmd.exe 150 PID 1816 wrote to memory of 4528 1816 cmd.exe 150 PID 1816 wrote to memory of 4528 1816 cmd.exe 150 PID 3236 wrote to memory of 2716 3236 oneetx.exe 166 PID 3236 wrote to memory of 2716 3236 oneetx.exe 166 PID 3236 wrote to memory of 2716 3236 oneetx.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe"C:\Users\Admin\AppData\Local\Temp\6d6bf2716f0fe2c30c204f16b8468807960eacead8193d96703488d0d4bcb500.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un766225.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un766225.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un855986.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un855986.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr589029.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr589029.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 10845⤵
- Program crash
PID:4828
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648773.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu648773.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 14445⤵
- Program crash
PID:964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk389145.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk389145.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108191.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si108191.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 6963⤵
- Program crash
PID:1116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 7803⤵
- Program crash
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 8603⤵
- Program crash
PID:4276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 9763⤵
- Program crash
PID:4216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 10043⤵
- Program crash
PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 10043⤵
- Program crash
PID:1448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 12203⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 12483⤵
- Program crash
PID:4996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 13163⤵
- Program crash
PID:4956
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 6924⤵
- Program crash
PID:668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 9404⤵
- Program crash
PID:2704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 10724⤵
- Program crash
PID:1628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 10804⤵
- Program crash
PID:2772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 9404⤵
- Program crash
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 9404⤵
- Program crash
PID:744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 9484⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 10124⤵
- Program crash
PID:4640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 7764⤵
- Program crash
PID:2212
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1632
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:3932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1176
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:5000
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 7644⤵
- Program crash
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 7284⤵
- Program crash
PID:2776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 12804⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 8844⤵
- Program crash
PID:4612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 14444⤵
- Program crash
PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 9404⤵
- Program crash
PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 16284⤵
- Program crash
PID:3648
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 14524⤵
- Program crash
PID:4996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 16484⤵
- Program crash
PID:2932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 13963⤵
- Program crash
PID:1488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1000 -ip 10001⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2708 -ip 27081⤵PID:2664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1356 -ip 13561⤵PID:4752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1356 -ip 13561⤵PID:3936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1356 -ip 13561⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1356 -ip 13561⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1356 -ip 13561⤵PID:4984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1356 -ip 13561⤵PID:2732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1356 -ip 13561⤵PID:3648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1356 -ip 13561⤵PID:5072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1356 -ip 13561⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1356 -ip 13561⤵PID:2152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3236 -ip 32361⤵PID:3432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3236 -ip 32361⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3236 -ip 32361⤵PID:5044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3236 -ip 32361⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3236 -ip 32361⤵PID:728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3236 -ip 32361⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3236 -ip 32361⤵PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3236 -ip 32361⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3236 -ip 32361⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3236 -ip 32361⤵PID:3924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3236 -ip 32361⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3236 -ip 32361⤵PID:2708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3236 -ip 32361⤵PID:4904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3236 -ip 32361⤵PID:5036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3236 -ip 32361⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 3162⤵
- Program crash
PID:1896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3996 -ip 39961⤵PID:4220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3236 -ip 32361⤵PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3236 -ip 32361⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3236 -ip 32361⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 3202⤵
- Program crash
PID:2728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1868 -ip 18681⤵PID:1800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
763KB
MD5cd9a36264745f13fa3f3c72fb355a505
SHA1f2e3ff84eca467543567c0268a4496d3dbfe49b8
SHA25682ee893e99a405edc3129afa8056932e679187807e73e8a4e2e0375df3afd349
SHA512d5499c71407600904250c4a9d6d14888168d9b8365054272261ebbbc819d9e45644c64bfef03bd6bbbc42fb44f05a4dea9283e94363a8bededdcfda1ad562c37
-
Filesize
763KB
MD5cd9a36264745f13fa3f3c72fb355a505
SHA1f2e3ff84eca467543567c0268a4496d3dbfe49b8
SHA25682ee893e99a405edc3129afa8056932e679187807e73e8a4e2e0375df3afd349
SHA512d5499c71407600904250c4a9d6d14888168d9b8365054272261ebbbc819d9e45644c64bfef03bd6bbbc42fb44f05a4dea9283e94363a8bededdcfda1ad562c37
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
609KB
MD5743260dea691ec86807163395c2f8b32
SHA1ae2c53b35f24489827b6aea7eacba2dbd8764e87
SHA256c8bcd3205ba51589ebbff8b97628b73817b73191ebd3822d4983bd56104e8888
SHA51280f8d13096491471b03640a29149a0cd09503b6daab44134b5d557ba396f542a82f4bf5f40e9a39045ff505e6ee4eb4130e87f354f93aa877b00ff097263c80d
-
Filesize
609KB
MD5743260dea691ec86807163395c2f8b32
SHA1ae2c53b35f24489827b6aea7eacba2dbd8764e87
SHA256c8bcd3205ba51589ebbff8b97628b73817b73191ebd3822d4983bd56104e8888
SHA51280f8d13096491471b03640a29149a0cd09503b6daab44134b5d557ba396f542a82f4bf5f40e9a39045ff505e6ee4eb4130e87f354f93aa877b00ff097263c80d
-
Filesize
405KB
MD5aa4473e514b1d7f5523655f72f268d67
SHA1e6de50b7c10a4d03fe7f83d23c08efe191554edc
SHA256417334e6984da5eebc8239181c8bb3b5a2ead242f4ffe74b6ce8782a9b07e31e
SHA51267aaa7c53d3553d0485262d98ea2520fd32e9c5b6f58d0eb539d8536554b9f9411374364400b0af10ac61a5db841a927f59d384c37aa54edb79fd736b28b60a4
-
Filesize
405KB
MD5aa4473e514b1d7f5523655f72f268d67
SHA1e6de50b7c10a4d03fe7f83d23c08efe191554edc
SHA256417334e6984da5eebc8239181c8bb3b5a2ead242f4ffe74b6ce8782a9b07e31e
SHA51267aaa7c53d3553d0485262d98ea2520fd32e9c5b6f58d0eb539d8536554b9f9411374364400b0af10ac61a5db841a927f59d384c37aa54edb79fd736b28b60a4
-
Filesize
488KB
MD5a0af3c679607ad0a116e737aed83b750
SHA19fa75d1654cbd7d464826ae52d869c82382548f8
SHA25690142fd07d2f411bc897a29c606b3014943e53146a89ec38e98d35ecaea19f2f
SHA512a46298abcb01bc44da1ee38cab9541b4c13457b48a65181540a1baec4012a41527c724c28be5e5ebdad9643c85e675eba028f935923efec5315d0517254ae44e
-
Filesize
488KB
MD5a0af3c679607ad0a116e737aed83b750
SHA19fa75d1654cbd7d464826ae52d869c82382548f8
SHA25690142fd07d2f411bc897a29c606b3014943e53146a89ec38e98d35ecaea19f2f
SHA512a46298abcb01bc44da1ee38cab9541b4c13457b48a65181540a1baec4012a41527c724c28be5e5ebdad9643c85e675eba028f935923efec5315d0517254ae44e
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
383KB
MD5956745dc1ec89225fab2ee8c23ef2ce3
SHA14649073c00572831633b30de41a3f26b0ffa5a32
SHA2563741297f9f5c44495abf01bf8b9d9d44172e1078edc0e21da94b480ce1f66742
SHA51244cf1190286149d7cda32e739a1b612a68c6a806a370d821232a240660a6f6053c1868110b7bb2d892352a2ee6c65ca0cb4c37239107de90cb65e358fbda4843
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5