Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 23:08
Static task
static1
General
-
Target
c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe
-
Size
943KB
-
MD5
2538da3562bb12ad613efbd45bcebb91
-
SHA1
acf1d3060ad7ec5413e0d46987d776acbc8f8dff
-
SHA256
c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6
-
SHA512
c47d86153577da03c92c64501b18313e86d7388ef33a74a1c66954397bc6cddada53b7162426eb0b6bae7ff8b7cf627ca79890e07d7d627c1e4f1bcf1a567f11
-
SSDEEP
24576:oyGppvupYnB78bbOLQo1sKchXppcQptq/04HAZXm:vGp0pYnB78GLlOhXppJpRZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr675895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr675895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr675895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr675895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr675895.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr675895.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation si004671.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1028 un562001.exe 3044 un472440.exe 1672 pr675895.exe 3088 qu176148.exe 4560 rk653290.exe 4524 si004671.exe 4488 oneetx.exe 4652 oneetx.exe 4232 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3296 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr675895.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr675895.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un562001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un562001.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un472440.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un472440.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
pid pid_target Process procid_target 4724 1672 WerFault.exe 86 4260 3088 WerFault.exe 92 3160 4524 WerFault.exe 97 436 4524 WerFault.exe 97 4956 4524 WerFault.exe 97 4748 4524 WerFault.exe 97 4652 4524 WerFault.exe 97 3128 4524 WerFault.exe 97 236 4524 WerFault.exe 97 1504 4524 WerFault.exe 97 2224 4524 WerFault.exe 97 1264 4524 WerFault.exe 97 3740 4488 WerFault.exe 117 1500 4488 WerFault.exe 117 3744 4488 WerFault.exe 117 544 4488 WerFault.exe 117 4600 4488 WerFault.exe 117 4896 4488 WerFault.exe 117 4884 4488 WerFault.exe 117 2092 4488 WerFault.exe 117 2228 4488 WerFault.exe 117 2696 4488 WerFault.exe 117 1688 4488 WerFault.exe 117 3648 4488 WerFault.exe 117 4016 4488 WerFault.exe 117 2636 4652 WerFault.exe 159 236 4488 WerFault.exe 117 4976 4488 WerFault.exe 117 4060 4488 WerFault.exe 117 968 4488 WerFault.exe 117 3700 4232 WerFault.exe 171 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4876 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1672 pr675895.exe 1672 pr675895.exe 3088 qu176148.exe 3088 qu176148.exe 4560 rk653290.exe 4560 rk653290.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1672 pr675895.exe Token: SeDebugPrivilege 3088 qu176148.exe Token: SeDebugPrivilege 4560 rk653290.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4524 si004671.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4232 wrote to memory of 1028 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 84 PID 4232 wrote to memory of 1028 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 84 PID 4232 wrote to memory of 1028 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 84 PID 1028 wrote to memory of 3044 1028 un562001.exe 85 PID 1028 wrote to memory of 3044 1028 un562001.exe 85 PID 1028 wrote to memory of 3044 1028 un562001.exe 85 PID 3044 wrote to memory of 1672 3044 un472440.exe 86 PID 3044 wrote to memory of 1672 3044 un472440.exe 86 PID 3044 wrote to memory of 1672 3044 un472440.exe 86 PID 3044 wrote to memory of 3088 3044 un472440.exe 92 PID 3044 wrote to memory of 3088 3044 un472440.exe 92 PID 3044 wrote to memory of 3088 3044 un472440.exe 92 PID 1028 wrote to memory of 4560 1028 un562001.exe 95 PID 1028 wrote to memory of 4560 1028 un562001.exe 95 PID 1028 wrote to memory of 4560 1028 un562001.exe 95 PID 4232 wrote to memory of 4524 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 97 PID 4232 wrote to memory of 4524 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 97 PID 4232 wrote to memory of 4524 4232 c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe 97 PID 4524 wrote to memory of 4488 4524 si004671.exe 117 PID 4524 wrote to memory of 4488 4524 si004671.exe 117 PID 4524 wrote to memory of 4488 4524 si004671.exe 117 PID 4488 wrote to memory of 4876 4488 oneetx.exe 136 PID 4488 wrote to memory of 4876 4488 oneetx.exe 136 PID 4488 wrote to memory of 4876 4488 oneetx.exe 136 PID 4488 wrote to memory of 3088 4488 oneetx.exe 142 PID 4488 wrote to memory of 3088 4488 oneetx.exe 142 PID 4488 wrote to memory of 3088 4488 oneetx.exe 142 PID 3088 wrote to memory of 5068 3088 cmd.exe 146 PID 3088 wrote to memory of 5068 3088 cmd.exe 146 PID 3088 wrote to memory of 5068 3088 cmd.exe 146 PID 3088 wrote to memory of 4104 3088 cmd.exe 147 PID 3088 wrote to memory of 4104 3088 cmd.exe 147 PID 3088 wrote to memory of 4104 3088 cmd.exe 147 PID 3088 wrote to memory of 1244 3088 cmd.exe 148 PID 3088 wrote to memory of 1244 3088 cmd.exe 148 PID 3088 wrote to memory of 1244 3088 cmd.exe 148 PID 3088 wrote to memory of 1320 3088 cmd.exe 150 PID 3088 wrote to memory of 1320 3088 cmd.exe 150 PID 3088 wrote to memory of 1320 3088 cmd.exe 150 PID 3088 wrote to memory of 3376 3088 cmd.exe 149 PID 3088 wrote to memory of 3376 3088 cmd.exe 149 PID 3088 wrote to memory of 3376 3088 cmd.exe 149 PID 3088 wrote to memory of 2568 3088 cmd.exe 151 PID 3088 wrote to memory of 2568 3088 cmd.exe 151 PID 3088 wrote to memory of 2568 3088 cmd.exe 151 PID 4488 wrote to memory of 3296 4488 oneetx.exe 166 PID 4488 wrote to memory of 3296 4488 oneetx.exe 166 PID 4488 wrote to memory of 3296 4488 oneetx.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe"C:\Users\Admin\AppData\Local\Temp\c5ce151b3cd668b5bb4e7e09e76a58dd996f7f7ffe10121314f07d1bdc4a2fb6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un562001.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un562001.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un472440.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un472440.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr675895.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr675895.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 10885⤵
- Program crash
PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu176148.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu176148.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 13205⤵
- Program crash
PID:4260
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653290.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653290.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si004671.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si004671.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 6963⤵
- Program crash
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 7803⤵
- Program crash
PID:436
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8003⤵
- Program crash
PID:4956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8083⤵
- Program crash
PID:4748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8123⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8123⤵
- Program crash
PID:3128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 12163⤵
- Program crash
PID:236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 12323⤵
- Program crash
PID:1504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 13163⤵
- Program crash
PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 6924⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 8564⤵
- Program crash
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 9084⤵
- Program crash
PID:3744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 10524⤵
- Program crash
PID:544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 10884⤵
- Program crash
PID:4600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 10884⤵
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 11124⤵
- Program crash
PID:4884
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 9124⤵
- Program crash
PID:2092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 7564⤵
- Program crash
PID:2228
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5068
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4104
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1244
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:3376
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1320
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:2568
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 9124⤵
- Program crash
PID:2696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 7764⤵
- Program crash
PID:1688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 13044⤵
- Program crash
PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 12844⤵
- Program crash
PID:4016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 11404⤵
- Program crash
PID:236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 16044⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 11404⤵
- Program crash
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 16204⤵
- Program crash
PID:968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 7483⤵
- Program crash
PID:1264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1672 -ip 16721⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3088 -ip 30881⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4524 -ip 45241⤵PID:3752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 45241⤵PID:1528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 45241⤵PID:1444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4524 -ip 45241⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4524 -ip 45241⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4524 -ip 45241⤵PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4524 -ip 45241⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4524 -ip 45241⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4524 -ip 45241⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4524 -ip 45241⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4488 -ip 44881⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 44881⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 44881⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4488 -ip 44881⤵PID:2180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4488 -ip 44881⤵PID:2480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4488 -ip 44881⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4488 -ip 44881⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4488 -ip 44881⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 44881⤵PID:1148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4488 -ip 44881⤵PID:936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4488 -ip 44881⤵PID:3152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4488 -ip 44881⤵PID:3612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4488 -ip 44881⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 3202⤵
- Program crash
PID:2636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4652 -ip 46521⤵PID:1620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4488 -ip 44881⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4488 -ip 44881⤵PID:728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4488 -ip 44881⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4488 -ip 44881⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 3122⤵
- Program crash
PID:3700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4232 -ip 42321⤵PID:1568
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
695KB
MD57f515d98c27f62ab378ec534864be0ed
SHA1e7fc941b37a50190b2ed8dd03d3b5ec242ab1cd2
SHA2564da5453d3eb5ac49fa5374f709b6d7d55c1e417b6c234982d37e8c25eb782f84
SHA512c3b5310e3e72c2bc57ffc993043950cfa2c7696ca8d3624425d3d27c3a4beef4ffa56c9a8ed184376baf3a117ec2be253e304f787ea08a41d550abbb795e550b
-
Filesize
695KB
MD57f515d98c27f62ab378ec534864be0ed
SHA1e7fc941b37a50190b2ed8dd03d3b5ec242ab1cd2
SHA2564da5453d3eb5ac49fa5374f709b6d7d55c1e417b6c234982d37e8c25eb782f84
SHA512c3b5310e3e72c2bc57ffc993043950cfa2c7696ca8d3624425d3d27c3a4beef4ffa56c9a8ed184376baf3a117ec2be253e304f787ea08a41d550abbb795e550b
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
541KB
MD5bd648f0e1ba03a5b286eb285c25090f6
SHA18afbbe449c6d29397b33b346b3a4dd7ed95513e1
SHA256e1cb33eb542bdc3f577b23ab19a4176ae7964c8ab23fd48c606d34c64f164e35
SHA51299861435479b76dc7e05a5d324cf6654fb62885827a613ce327b4e112c3282570f0b4cbf180f9b944018cb4b204e564bd4dd829a1bd702b449b00c9c008b4d85
-
Filesize
541KB
MD5bd648f0e1ba03a5b286eb285c25090f6
SHA18afbbe449c6d29397b33b346b3a4dd7ed95513e1
SHA256e1cb33eb542bdc3f577b23ab19a4176ae7964c8ab23fd48c606d34c64f164e35
SHA51299861435479b76dc7e05a5d324cf6654fb62885827a613ce327b4e112c3282570f0b4cbf180f9b944018cb4b204e564bd4dd829a1bd702b449b00c9c008b4d85
-
Filesize
277KB
MD5c5446847d01c57dd21a59ec4a326fd18
SHA15bdf14127d61f4e42a7602a2e0017ed977e9a957
SHA256822581f3343bb68d377c7d361705efdd22e5b3ce7abcfd462d3b5e1642fe0be9
SHA5123cda8609745570146b376ec51c76fad802d02d89ec3189bb9a3b94cc8d24ab20cfe14c857963c31ec9a12c0ec91824869a1df18cdcf64ab2620e447359ea5152
-
Filesize
277KB
MD5c5446847d01c57dd21a59ec4a326fd18
SHA15bdf14127d61f4e42a7602a2e0017ed977e9a957
SHA256822581f3343bb68d377c7d361705efdd22e5b3ce7abcfd462d3b5e1642fe0be9
SHA5123cda8609745570146b376ec51c76fad802d02d89ec3189bb9a3b94cc8d24ab20cfe14c857963c31ec9a12c0ec91824869a1df18cdcf64ab2620e447359ea5152
-
Filesize
360KB
MD5473952def4a0d345a1970b3b138d6ef8
SHA1800bea147f20689e9513dc0217b5fb2bcd8977ea
SHA256fabeeda9fb146c75d627876647b82ee8bb828258c87e1a78f15b0f838a49125c
SHA512d5a73a981e51bdf5d03d00dc05ae0bfe15f322a11928e3a3c9ac35f1691ab767ed07a99bdaf7c621e1a5d725b4eb26f34843c767a633632285a9ba8b24cc6f83
-
Filesize
360KB
MD5473952def4a0d345a1970b3b138d6ef8
SHA1800bea147f20689e9513dc0217b5fb2bcd8977ea
SHA256fabeeda9fb146c75d627876647b82ee8bb828258c87e1a78f15b0f838a49125c
SHA512d5a73a981e51bdf5d03d00dc05ae0bfe15f322a11928e3a3c9ac35f1691ab767ed07a99bdaf7c621e1a5d725b4eb26f34843c767a633632285a9ba8b24cc6f83
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
256KB
MD50ee95f7c2550197c894b53e6053ed787
SHA112a23cefa0d908ac38da400919bbe644088bd920
SHA2561752d678fb245a8c061fee84c7f621bc70cf1a619957bfada6bfbf569fea563f
SHA5121dbb557c3fc6ec13414eacbd3bd8ea9b01d2600b17f0395a1993778f0836872deec0180dee8942be053e3dafe1113cbfe8940c7635ffde49e1903f6ee123b892
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5