Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 02:09
Static task
static1
General
-
Target
51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe
-
Size
923KB
-
MD5
e3e753d917e6446c80054adb6e9048f5
-
SHA1
f7a91820f4050b6e53833a2a2d21b98914d62da3
-
SHA256
51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6
-
SHA512
43e87c236c05d0ba98d0c82c363c0aa780333237999c84b8f1ed20930bf7358282c2a4ad57c795cc113c242f2436894f340188b1f2103a74882a54305d8b7526
-
SSDEEP
24576:TytivbVmrNA1hwtFqLa5Z8TKoWq+sRFJHzxP8o:mtaVmG1hwt8m5Wmgdn0
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it837354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it837354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it837354.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it837354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it837354.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it837354.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation lr608798.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 1932 zimO6670.exe 2396 zioG9281.exe 1304 it837354.exe 408 jr625695.exe 1716 kp479399.exe 4956 lr608798.exe 5088 oneetx.exe 2400 oneetx.exe 5052 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 920 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it837354.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zimO6670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zimO6670.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zioG9281.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zioG9281.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 3896 408 WerFault.exe 87 3844 4956 WerFault.exe 93 3468 4956 WerFault.exe 93 4644 4956 WerFault.exe 93 3884 4956 WerFault.exe 93 2304 4956 WerFault.exe 93 1152 4956 WerFault.exe 93 4824 4956 WerFault.exe 93 2320 4956 WerFault.exe 93 1920 4956 WerFault.exe 93 520 4956 WerFault.exe 93 2184 5088 WerFault.exe 112 1016 5088 WerFault.exe 112 3184 5088 WerFault.exe 112 2080 5088 WerFault.exe 112 3496 5088 WerFault.exe 112 4632 5088 WerFault.exe 112 320 5088 WerFault.exe 112 3952 5088 WerFault.exe 112 8 5088 WerFault.exe 112 3264 5088 WerFault.exe 112 2716 5088 WerFault.exe 112 3080 5088 WerFault.exe 112 4576 5088 WerFault.exe 112 3844 5088 WerFault.exe 112 728 2400 WerFault.exe 153 3016 5088 WerFault.exe 112 4856 5088 WerFault.exe 112 5028 5088 WerFault.exe 112 1976 5052 WerFault.exe 163 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1304 it837354.exe 1304 it837354.exe 408 jr625695.exe 408 jr625695.exe 1716 kp479399.exe 1716 kp479399.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1304 it837354.exe Token: SeDebugPrivilege 408 jr625695.exe Token: SeDebugPrivilege 1716 kp479399.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4956 lr608798.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1932 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 83 PID 2440 wrote to memory of 1932 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 83 PID 2440 wrote to memory of 1932 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 83 PID 1932 wrote to memory of 2396 1932 zimO6670.exe 84 PID 1932 wrote to memory of 2396 1932 zimO6670.exe 84 PID 1932 wrote to memory of 2396 1932 zimO6670.exe 84 PID 2396 wrote to memory of 1304 2396 zioG9281.exe 85 PID 2396 wrote to memory of 1304 2396 zioG9281.exe 85 PID 2396 wrote to memory of 408 2396 zioG9281.exe 87 PID 2396 wrote to memory of 408 2396 zioG9281.exe 87 PID 2396 wrote to memory of 408 2396 zioG9281.exe 87 PID 1932 wrote to memory of 1716 1932 zimO6670.exe 92 PID 1932 wrote to memory of 1716 1932 zimO6670.exe 92 PID 1932 wrote to memory of 1716 1932 zimO6670.exe 92 PID 2440 wrote to memory of 4956 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 93 PID 2440 wrote to memory of 4956 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 93 PID 2440 wrote to memory of 4956 2440 51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe 93 PID 4956 wrote to memory of 5088 4956 lr608798.exe 112 PID 4956 wrote to memory of 5088 4956 lr608798.exe 112 PID 4956 wrote to memory of 5088 4956 lr608798.exe 112 PID 5088 wrote to memory of 856 5088 oneetx.exe 129 PID 5088 wrote to memory of 856 5088 oneetx.exe 129 PID 5088 wrote to memory of 856 5088 oneetx.exe 129 PID 5088 wrote to memory of 3208 5088 oneetx.exe 135 PID 5088 wrote to memory of 3208 5088 oneetx.exe 135 PID 5088 wrote to memory of 3208 5088 oneetx.exe 135 PID 3208 wrote to memory of 3648 3208 cmd.exe 139 PID 3208 wrote to memory of 3648 3208 cmd.exe 139 PID 3208 wrote to memory of 3648 3208 cmd.exe 139 PID 3208 wrote to memory of 1460 3208 cmd.exe 140 PID 3208 wrote to memory of 1460 3208 cmd.exe 140 PID 3208 wrote to memory of 1460 3208 cmd.exe 140 PID 3208 wrote to memory of 4896 3208 cmd.exe 141 PID 3208 wrote to memory of 4896 3208 cmd.exe 141 PID 3208 wrote to memory of 4896 3208 cmd.exe 141 PID 3208 wrote to memory of 2188 3208 cmd.exe 142 PID 3208 wrote to memory of 2188 3208 cmd.exe 142 PID 3208 wrote to memory of 2188 3208 cmd.exe 142 PID 3208 wrote to memory of 2932 3208 cmd.exe 143 PID 3208 wrote to memory of 2932 3208 cmd.exe 143 PID 3208 wrote to memory of 2932 3208 cmd.exe 143 PID 3208 wrote to memory of 4732 3208 cmd.exe 144 PID 3208 wrote to memory of 4732 3208 cmd.exe 144 PID 3208 wrote to memory of 4732 3208 cmd.exe 144 PID 5088 wrote to memory of 920 5088 oneetx.exe 158 PID 5088 wrote to memory of 920 5088 oneetx.exe 158 PID 5088 wrote to memory of 920 5088 oneetx.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe"C:\Users\Admin\AppData\Local\Temp\51019743593125ba0e371c415ada7ef3d3c68709bf6cbcf3289c2d88def929a6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimO6670.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zimO6670.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioG9281.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zioG9281.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it837354.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it837354.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr625695.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr625695.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 17805⤵
- Program crash
PID:3896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp479399.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp479399.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr608798.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr608798.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 6963⤵
- Program crash
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 7803⤵
- Program crash
PID:3468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 8563⤵
- Program crash
PID:4644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 9523⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 9683⤵
- Program crash
PID:2304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 8563⤵
- Program crash
PID:1152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 12203⤵
- Program crash
PID:4824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 12443⤵
- Program crash
PID:2320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 13203⤵
- Program crash
PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 6924⤵
- Program crash
PID:2184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 8364⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 9124⤵
- Program crash
PID:3184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10524⤵
- Program crash
PID:2080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10964⤵
- Program crash
PID:3496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10524⤵
- Program crash
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10844⤵
- Program crash
PID:320
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 9924⤵
- Program crash
PID:3952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 7644⤵
- Program crash
PID:8
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3648
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1460
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2188
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 13164⤵
- Program crash
PID:3264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 9924⤵
- Program crash
PID:2716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 7764⤵
- Program crash
PID:3080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 13244⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10684⤵
- Program crash
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 16404⤵
- Program crash
PID:3016
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 10684⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 16604⤵
- Program crash
PID:5028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 14083⤵
- Program crash
PID:520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 408 -ip 4081⤵PID:3208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4956 -ip 49561⤵PID:3760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4956 -ip 49561⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4956 -ip 49561⤵PID:728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4956 -ip 49561⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4956 -ip 49561⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4956 -ip 49561⤵PID:1420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4956 -ip 49561⤵PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4956 -ip 49561⤵PID:1036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4956 -ip 49561⤵PID:5072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4956 -ip 49561⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5088 -ip 50881⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5088 -ip 50881⤵PID:1196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5088 -ip 50881⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5088 -ip 50881⤵PID:2484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5088 -ip 50881⤵PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5088 -ip 50881⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5088 -ip 50881⤵PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5088 -ip 50881⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5088 -ip 50881⤵PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5088 -ip 50881⤵PID:3464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5088 -ip 50881⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5088 -ip 50881⤵PID:3396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5088 -ip 50881⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5088 -ip 50881⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 3122⤵
- Program crash
PID:728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2400 -ip 24001⤵PID:2848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5088 -ip 50881⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5088 -ip 50881⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5088 -ip 50881⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 3162⤵
- Program crash
PID:1976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5052 -ip 50521⤵PID:3664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
617KB
MD5699ebbccc38dad86aec39ec05e0f047a
SHA1ffa8881241667291df1a223a5ddb149318a97da7
SHA25668b5bdbe6ecfab768b86889fc2914b8619e6e4942f65d3a3e9ed893d853e2772
SHA512bd1a64435b5ed080ecae98932697065435fafc4cbaa51fe970cdeb2b76edfd8d25c46f36153f91b1633f0f81ba31f2be7fc5a17ebced58f95f473d9509c6b679
-
Filesize
617KB
MD5699ebbccc38dad86aec39ec05e0f047a
SHA1ffa8881241667291df1a223a5ddb149318a97da7
SHA25668b5bdbe6ecfab768b86889fc2914b8619e6e4942f65d3a3e9ed893d853e2772
SHA512bd1a64435b5ed080ecae98932697065435fafc4cbaa51fe970cdeb2b76edfd8d25c46f36153f91b1633f0f81ba31f2be7fc5a17ebced58f95f473d9509c6b679
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
462KB
MD5c4f0be5ba88ee39468789a64b3cd6fd4
SHA1ee8dfac257afc17478739b98ad3d45cae4331af3
SHA25656c5721073d117916c0c2012c6348455530b977858f473b0f273b46dcb3e6799
SHA5120b00f0b6592715806c09a42ca8ace861fbc6ef854265b221ec7e37aa4bd48f9064fdccbbf7e7171c908c236264f8256412cd4d33967712328a6f0806b8a73629
-
Filesize
462KB
MD5c4f0be5ba88ee39468789a64b3cd6fd4
SHA1ee8dfac257afc17478739b98ad3d45cae4331af3
SHA25656c5721073d117916c0c2012c6348455530b977858f473b0f273b46dcb3e6799
SHA5120b00f0b6592715806c09a42ca8ace861fbc6ef854265b221ec7e37aa4bd48f9064fdccbbf7e7171c908c236264f8256412cd4d33967712328a6f0806b8a73629
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
474KB
MD57a995e10af424c1f878ee6e9f00f8935
SHA1ca1ae82c986477b1d2990e64b80b05a90f4d5937
SHA2565d3a42ffc39c85093af42f8b9b1dffe0ffaa2a35e8f9cbedff12fdd73cca8fdf
SHA51230c0085f93c232840383298bf075199ca80cc537292b90d66153ee17780e9d2b5ffba3ccb2bbe92f8e19408d7ab3c3e698243ae68226d79cf189f7a071d0d03b
-
Filesize
474KB
MD57a995e10af424c1f878ee6e9f00f8935
SHA1ca1ae82c986477b1d2990e64b80b05a90f4d5937
SHA2565d3a42ffc39c85093af42f8b9b1dffe0ffaa2a35e8f9cbedff12fdd73cca8fdf
SHA51230c0085f93c232840383298bf075199ca80cc537292b90d66153ee17780e9d2b5ffba3ccb2bbe92f8e19408d7ab3c3e698243ae68226d79cf189f7a071d0d03b
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
370KB
MD5453fe506bc174c2fda5058719e46c74b
SHA1f547e94fe0dfd4da9d19976448e47e7dc86ea9be
SHA256c5cd56f77db5647175ceeba983b89b6056fa648dfce7f4b6c9b61414952bc71c
SHA5128634afffd083aebddaf35ddcca66e04710e2c80ea54e266c0a7775b0e3fc1a77ba99279b21e1c8c06c309ed0d7a5e86040e9965ba4ae9daf8cde03a2732cbd88
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5