Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 18:48
Static task
static1
General
-
Target
7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe
-
Size
936KB
-
MD5
8304c6d450367f9ad341aedbcf432287
-
SHA1
35a44a5d4505b46b7386890f8bec5b05537f3fb0
-
SHA256
7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7
-
SHA512
f85591c87c2f6d8bd17bf09b1671e7d150d3155ef6d0e9982db594e1f5f6ca6ea48049e5d2dcb01530c19430b8e5f1f6f6f8c72a5ea987baf2a149f32fb74ec2
-
SSDEEP
24576:Hy8fF3Y+nX1VVkU9zCzE/DU0zQhiQLafsqgzwcId8hr:SulVyU9zWad8Gk7Idk
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it817487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it817487.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it817487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it817487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it817487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it817487.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation lr040502.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 488 zivG1534.exe 1188 zioB7349.exe 4176 it817487.exe 4928 jr970549.exe 2232 kp433460.exe 5020 lr040502.exe 1604 oneetx.exe 4792 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4640 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it817487.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zioB7349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zioB7349.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zivG1534.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zivG1534.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
pid pid_target Process procid_target 2500 4928 WerFault.exe 89 2148 5020 WerFault.exe 96 4260 5020 WerFault.exe 96 5100 5020 WerFault.exe 96 3664 5020 WerFault.exe 96 3908 5020 WerFault.exe 96 480 5020 WerFault.exe 96 4736 5020 WerFault.exe 96 3620 5020 WerFault.exe 96 1148 5020 WerFault.exe 96 2288 5020 WerFault.exe 96 1072 1604 WerFault.exe 116 916 1604 WerFault.exe 116 3320 1604 WerFault.exe 116 2012 1604 WerFault.exe 116 3772 1604 WerFault.exe 116 4056 1604 WerFault.exe 116 4176 1604 WerFault.exe 116 2712 1604 WerFault.exe 116 4744 1604 WerFault.exe 116 3104 1604 WerFault.exe 116 4388 1604 WerFault.exe 116 5092 1604 WerFault.exe 116 4380 1604 WerFault.exe 116 4480 1604 WerFault.exe 116 1612 1604 WerFault.exe 116 4932 1604 WerFault.exe 116 832 4792 WerFault.exe 162 3596 1604 WerFault.exe 116 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4956 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4176 it817487.exe 4176 it817487.exe 4928 jr970549.exe 4928 jr970549.exe 2232 kp433460.exe 2232 kp433460.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4176 it817487.exe Token: SeDebugPrivilege 4928 jr970549.exe Token: SeDebugPrivilege 2232 kp433460.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5020 lr040502.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 856 wrote to memory of 488 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 82 PID 856 wrote to memory of 488 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 82 PID 856 wrote to memory of 488 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 82 PID 488 wrote to memory of 1188 488 zivG1534.exe 83 PID 488 wrote to memory of 1188 488 zivG1534.exe 83 PID 488 wrote to memory of 1188 488 zivG1534.exe 83 PID 1188 wrote to memory of 4176 1188 zioB7349.exe 84 PID 1188 wrote to memory of 4176 1188 zioB7349.exe 84 PID 1188 wrote to memory of 4928 1188 zioB7349.exe 89 PID 1188 wrote to memory of 4928 1188 zioB7349.exe 89 PID 1188 wrote to memory of 4928 1188 zioB7349.exe 89 PID 488 wrote to memory of 2232 488 zivG1534.exe 95 PID 488 wrote to memory of 2232 488 zivG1534.exe 95 PID 488 wrote to memory of 2232 488 zivG1534.exe 95 PID 856 wrote to memory of 5020 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 96 PID 856 wrote to memory of 5020 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 96 PID 856 wrote to memory of 5020 856 7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe 96 PID 5020 wrote to memory of 1604 5020 lr040502.exe 116 PID 5020 wrote to memory of 1604 5020 lr040502.exe 116 PID 5020 wrote to memory of 1604 5020 lr040502.exe 116 PID 1604 wrote to memory of 4956 1604 oneetx.exe 133 PID 1604 wrote to memory of 4956 1604 oneetx.exe 133 PID 1604 wrote to memory of 4956 1604 oneetx.exe 133 PID 1604 wrote to memory of 2472 1604 oneetx.exe 139 PID 1604 wrote to memory of 2472 1604 oneetx.exe 139 PID 1604 wrote to memory of 2472 1604 oneetx.exe 139 PID 2472 wrote to memory of 4584 2472 cmd.exe 143 PID 2472 wrote to memory of 4584 2472 cmd.exe 143 PID 2472 wrote to memory of 4584 2472 cmd.exe 143 PID 2472 wrote to memory of 1116 2472 cmd.exe 144 PID 2472 wrote to memory of 1116 2472 cmd.exe 144 PID 2472 wrote to memory of 1116 2472 cmd.exe 144 PID 2472 wrote to memory of 1304 2472 cmd.exe 145 PID 2472 wrote to memory of 1304 2472 cmd.exe 145 PID 2472 wrote to memory of 1304 2472 cmd.exe 145 PID 2472 wrote to memory of 3728 2472 cmd.exe 146 PID 2472 wrote to memory of 3728 2472 cmd.exe 146 PID 2472 wrote to memory of 3728 2472 cmd.exe 146 PID 2472 wrote to memory of 4976 2472 cmd.exe 147 PID 2472 wrote to memory of 4976 2472 cmd.exe 147 PID 2472 wrote to memory of 4976 2472 cmd.exe 147 PID 2472 wrote to memory of 4844 2472 cmd.exe 148 PID 2472 wrote to memory of 4844 2472 cmd.exe 148 PID 2472 wrote to memory of 4844 2472 cmd.exe 148 PID 1604 wrote to memory of 4640 1604 oneetx.exe 159 PID 1604 wrote to memory of 4640 1604 oneetx.exe 159 PID 1604 wrote to memory of 4640 1604 oneetx.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe"C:\Users\Admin\AppData\Local\Temp\7740f561cd1e74d7a1307649a17e348bfe9d15b5792a8a61fe7d3f9baa7d66c7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivG1534.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zivG1534.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioB7349.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioB7349.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it817487.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it817487.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr970549.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr970549.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 13205⤵
- Program crash
PID:2500
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433460.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp433460.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr040502.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr040502.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 6963⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 7803⤵
- Program crash
PID:4260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 8123⤵
- Program crash
PID:5100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 9723⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 9483⤵
- Program crash
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 9483⤵
- Program crash
PID:480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 12043⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 12283⤵
- Program crash
PID:3620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 13163⤵
- Program crash
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 6924⤵
- Program crash
PID:1072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 8484⤵
- Program crash
PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 8884⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 10524⤵
- Program crash
PID:2012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 10724⤵
- Program crash
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 10724⤵
- Program crash
PID:4056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 11004⤵
- Program crash
PID:4176
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 7804⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 7524⤵
- Program crash
PID:4744
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4584
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1116
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3728
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:4976
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4844
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 7764⤵
- Program crash
PID:3104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 8444⤵
- Program crash
PID:4388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 12644⤵
- Program crash
PID:5092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 12604⤵
- Program crash
PID:4380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 10964⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 16044⤵
- Program crash
PID:1612
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 10964⤵
- Program crash
PID:4932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 16204⤵
- Program crash
PID:3596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 7083⤵
- Program crash
PID:2288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 49281⤵PID:3948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5020 -ip 50201⤵PID:1132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5020 -ip 50201⤵PID:2888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5020 -ip 50201⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5020 -ip 50201⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5020 -ip 50201⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5020 -ip 50201⤵PID:484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5020 -ip 50201⤵PID:428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5020 -ip 50201⤵PID:4456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5020 -ip 50201⤵PID:3596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5020 -ip 50201⤵PID:4124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1604 -ip 16041⤵PID:676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1604 -ip 16041⤵PID:4280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1604 -ip 16041⤵PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1604 -ip 16041⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1604 -ip 16041⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1604 -ip 16041⤵PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1604 -ip 16041⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1604 -ip 16041⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1604 -ip 16041⤵PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1604 -ip 16041⤵PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1604 -ip 16041⤵PID:716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1604 -ip 16041⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1604 -ip 16041⤵PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1604 -ip 16041⤵PID:424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1604 -ip 16041⤵PID:2084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1604 -ip 16041⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 3122⤵
- Program crash
PID:832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4792 -ip 47921⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1604 -ip 16041⤵PID:3932
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
623KB
MD5e955ae474b186fecee1f8adebf38396a
SHA11d33d8ac70f0c4aec07a2e348e9c213865321084
SHA256a1a7c84d129cd0d172fa8089beba0e085bf665f3be5720674cd70a92634c2052
SHA512d0aff570a29d05c7a7ae87a3ce214e5603da2ededdcfd9b1b94e56c629ee92e7301117a5e2dfb29352c4f00dc2dfee7b9d357bb3c5f7fe2e77d460fae994184e
-
Filesize
623KB
MD5e955ae474b186fecee1f8adebf38396a
SHA11d33d8ac70f0c4aec07a2e348e9c213865321084
SHA256a1a7c84d129cd0d172fa8089beba0e085bf665f3be5720674cd70a92634c2052
SHA512d0aff570a29d05c7a7ae87a3ce214e5603da2ededdcfd9b1b94e56c629ee92e7301117a5e2dfb29352c4f00dc2dfee7b9d357bb3c5f7fe2e77d460fae994184e
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
136KB
MD586810f340795831f3c2bd147981be929
SHA1573345e2c322720fa43f74d761ff1d48028f36c9
SHA256d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139
SHA512c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f
-
Filesize
468KB
MD5b92bdefd31b0f81c2c4e54603b44a044
SHA1f9efe7610b31ae945766963576a29186c47d6b54
SHA2563ab81418abf434dc8a8baa1d436953f9f00afda4d36d469b153efbac229ab913
SHA51239c28d1a6cac212337a204bbcd39c4daeca719a4867791b51b3f95ef0a5ed1f4f4013e2dde22cf136af4d3440a79338ab6c058e15d0859f75b1125857c84aca5
-
Filesize
468KB
MD5b92bdefd31b0f81c2c4e54603b44a044
SHA1f9efe7610b31ae945766963576a29186c47d6b54
SHA2563ab81418abf434dc8a8baa1d436953f9f00afda4d36d469b153efbac229ab913
SHA51239c28d1a6cac212337a204bbcd39c4daeca719a4867791b51b3f95ef0a5ed1f4f4013e2dde22cf136af4d3440a79338ab6c058e15d0859f75b1125857c84aca5
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
488KB
MD58b109417261dd6ac0c4ee20b93b4f8fb
SHA1451062a376a89b5fc15cf5f951119546b31b459e
SHA256ebd7f7ef5dd44257984eb6833dc4951e82af2835d1d3ab1b42202b556bdbfc5d
SHA51209017b657e99d604014787808cdaa0e25542ef367792a7b8719d0e3a48c2ce7108b1c1607ca1edff938c3be4a9730cb5572df30d440cc202c05cf55d4a4fe337
-
Filesize
488KB
MD58b109417261dd6ac0c4ee20b93b4f8fb
SHA1451062a376a89b5fc15cf5f951119546b31b459e
SHA256ebd7f7ef5dd44257984eb6833dc4951e82af2835d1d3ab1b42202b556bdbfc5d
SHA51209017b657e99d604014787808cdaa0e25542ef367792a7b8719d0e3a48c2ce7108b1c1607ca1edff938c3be4a9730cb5572df30d440cc202c05cf55d4a4fe337
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
384KB
MD583f599eaa3f58add6872e66c5af72fb3
SHA1d3cd3f6d48ae02a5a98e41a0e66203854e761102
SHA2562a2d8786c05c958984ddb48b1c82a02199d0614843609a896b8625c73efac544
SHA51258557bbfcc5cab8ab3d61aabc87782d0ceb22f16d87907ded2b707d2b89ef064139896f99519f9bfb755b6ef21de1b59013503acaf0bfa67b2315d9374d7d9bb
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5