Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 03:35
Static task
static1
General
-
Target
b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe
-
Size
1.0MB
-
MD5
1d1c1ba5e448a21d7aa7ce71221fa3de
-
SHA1
a3ccb891b97aa22c29fe7547eadfcf1b69e5c5c2
-
SHA256
b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6
-
SHA512
d6c839ab985dab68ac1ea1ac8ad52561ca606621ccf6c1063ffb30605e64c58d985324c0b6563e1a55ddf9317623b9948b1d2ce04159b824ffdd433a4276126f
-
SSDEEP
24576:HyV7C2a4dVFM0qPA40Uxlovm2+5zPnw6ihKQFN/:SVG2auHnqPgUc9+5zPJ6KAN
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr161660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr161660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr161660.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr161660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr161660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr161660.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation si531711.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2492 un511669.exe 4928 un063153.exe 3632 pr161660.exe 2060 qu808649.exe 2244 rk465505.exe 3276 si531711.exe 5024 oneetx.exe 4316 oneetx.exe 3844 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5056 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr161660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr161660.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un063153.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un511669.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un511669.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un063153.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
pid pid_target Process procid_target 2232 3632 WerFault.exe 86 432 2060 WerFault.exe 92 2160 3276 WerFault.exe 96 4524 3276 WerFault.exe 96 1316 3276 WerFault.exe 96 3688 3276 WerFault.exe 96 4732 3276 WerFault.exe 96 1528 3276 WerFault.exe 96 1260 3276 WerFault.exe 96 4840 3276 WerFault.exe 96 5076 3276 WerFault.exe 96 2788 3276 WerFault.exe 96 1336 5024 WerFault.exe 116 1816 5024 WerFault.exe 116 3028 5024 WerFault.exe 116 4620 5024 WerFault.exe 116 4668 5024 WerFault.exe 116 1088 5024 WerFault.exe 116 2756 5024 WerFault.exe 116 3232 5024 WerFault.exe 116 1452 5024 WerFault.exe 116 3740 5024 WerFault.exe 116 4464 5024 WerFault.exe 116 2336 5024 WerFault.exe 116 2492 5024 WerFault.exe 116 2488 5024 WerFault.exe 116 2412 4316 WerFault.exe 161 4308 5024 WerFault.exe 116 4968 5024 WerFault.exe 116 3488 5024 WerFault.exe 116 1336 3844 WerFault.exe 171 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3632 pr161660.exe 3632 pr161660.exe 2060 qu808649.exe 2060 qu808649.exe 2244 rk465505.exe 2244 rk465505.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3632 pr161660.exe Token: SeDebugPrivilege 2060 qu808649.exe Token: SeDebugPrivilege 2244 rk465505.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3276 si531711.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2492 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 84 PID 4124 wrote to memory of 2492 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 84 PID 4124 wrote to memory of 2492 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 84 PID 2492 wrote to memory of 4928 2492 un511669.exe 85 PID 2492 wrote to memory of 4928 2492 un511669.exe 85 PID 2492 wrote to memory of 4928 2492 un511669.exe 85 PID 4928 wrote to memory of 3632 4928 un063153.exe 86 PID 4928 wrote to memory of 3632 4928 un063153.exe 86 PID 4928 wrote to memory of 3632 4928 un063153.exe 86 PID 4928 wrote to memory of 2060 4928 un063153.exe 92 PID 4928 wrote to memory of 2060 4928 un063153.exe 92 PID 4928 wrote to memory of 2060 4928 un063153.exe 92 PID 2492 wrote to memory of 2244 2492 un511669.exe 95 PID 2492 wrote to memory of 2244 2492 un511669.exe 95 PID 2492 wrote to memory of 2244 2492 un511669.exe 95 PID 4124 wrote to memory of 3276 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 96 PID 4124 wrote to memory of 3276 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 96 PID 4124 wrote to memory of 3276 4124 b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe 96 PID 3276 wrote to memory of 5024 3276 si531711.exe 116 PID 3276 wrote to memory of 5024 3276 si531711.exe 116 PID 3276 wrote to memory of 5024 3276 si531711.exe 116 PID 5024 wrote to memory of 1516 5024 oneetx.exe 136 PID 5024 wrote to memory of 1516 5024 oneetx.exe 136 PID 5024 wrote to memory of 1516 5024 oneetx.exe 136 PID 5024 wrote to memory of 2748 5024 oneetx.exe 142 PID 5024 wrote to memory of 2748 5024 oneetx.exe 142 PID 5024 wrote to memory of 2748 5024 oneetx.exe 142 PID 2748 wrote to memory of 676 2748 cmd.exe 146 PID 2748 wrote to memory of 676 2748 cmd.exe 146 PID 2748 wrote to memory of 676 2748 cmd.exe 146 PID 2748 wrote to memory of 4076 2748 cmd.exe 147 PID 2748 wrote to memory of 4076 2748 cmd.exe 147 PID 2748 wrote to memory of 4076 2748 cmd.exe 147 PID 2748 wrote to memory of 1400 2748 cmd.exe 148 PID 2748 wrote to memory of 1400 2748 cmd.exe 148 PID 2748 wrote to memory of 1400 2748 cmd.exe 148 PID 2748 wrote to memory of 432 2748 cmd.exe 150 PID 2748 wrote to memory of 432 2748 cmd.exe 150 PID 2748 wrote to memory of 432 2748 cmd.exe 150 PID 2748 wrote to memory of 2908 2748 cmd.exe 149 PID 2748 wrote to memory of 2908 2748 cmd.exe 149 PID 2748 wrote to memory of 2908 2748 cmd.exe 149 PID 2748 wrote to memory of 4024 2748 cmd.exe 151 PID 2748 wrote to memory of 4024 2748 cmd.exe 151 PID 2748 wrote to memory of 4024 2748 cmd.exe 151 PID 5024 wrote to memory of 5056 5024 oneetx.exe 166 PID 5024 wrote to memory of 5056 5024 oneetx.exe 166 PID 5024 wrote to memory of 5056 5024 oneetx.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe"C:\Users\Admin\AppData\Local\Temp\b7c5eef6c5e9dd1af0cfe0e201f9d52f77f2df1ca2af487f60fa77ab03272ac6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un511669.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un511669.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un063153.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un063153.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr161660.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr161660.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 10845⤵
- Program crash
PID:2232
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu808649.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu808649.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 19325⤵
- Program crash
PID:432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk465505.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk465505.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si531711.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si531711.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 6963⤵
- Program crash
PID:2160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7803⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 8563⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9603⤵
- Program crash
PID:3688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9843⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 8563⤵
- Program crash
PID:1528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 12043⤵
- Program crash
PID:1260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 12403⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 12883⤵
- Program crash
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6924⤵
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 8644⤵
- Program crash
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 8484⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 10524⤵
- Program crash
PID:4620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 10524⤵
- Program crash
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 10524⤵
- Program crash
PID:1088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 10844⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 9924⤵
- Program crash
PID:3232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7644⤵
- Program crash
PID:1452
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:676
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1400
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2908
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:432
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 9924⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 9084⤵
- Program crash
PID:4464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 12764⤵
- Program crash
PID:2336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7564⤵
- Program crash
PID:2492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 11324⤵
- Program crash
PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 16204⤵
- Program crash
PID:4308
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 15804⤵
- Program crash
PID:4968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 16364⤵
- Program crash
PID:3488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 17523⤵
- Program crash
PID:2788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3632 -ip 36321⤵PID:980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2060 -ip 20601⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3276 -ip 32761⤵PID:3640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3276 -ip 32761⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3276 -ip 32761⤵PID:1108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3276 -ip 32761⤵PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3276 -ip 32761⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3276 -ip 32761⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3276 -ip 32761⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3276 -ip 32761⤵PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3276 -ip 32761⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3276 -ip 32761⤵PID:4116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5024 -ip 50241⤵PID:4852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5024 -ip 50241⤵PID:832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5024 -ip 50241⤵PID:2992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5024 -ip 50241⤵PID:3524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5024 -ip 50241⤵PID:1132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5024 -ip 50241⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5024 -ip 50241⤵PID:2140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5024 -ip 50241⤵PID:1676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5024 -ip 50241⤵PID:1904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5024 -ip 50241⤵PID:3124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5024 -ip 50241⤵PID:2792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5024 -ip 50241⤵PID:768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5024 -ip 50241⤵PID:2480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5024 -ip 50241⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 3202⤵
- Program crash
PID:2412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4316 -ip 43161⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5024 -ip 50241⤵PID:4992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5024 -ip 50241⤵PID:3088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5024 -ip 50241⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 3202⤵
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3844 -ip 38441⤵PID:1180
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
753KB
MD525e524e1a4f283c9d66f9dfcaac70638
SHA1c9c362f8b2cfb12d3ed17d424eb8faf071defce9
SHA256749e754f73b1c8b2b9d6f9e8dade875faa43f7588fa3f1c683c3104732ca652e
SHA5128ccd4e983b46882dca6d366095d251ed215101768802bf199c533ce98124c510c70bf527193d5bdb0eb30baa4b213d7b05d46bf543551636daf4579ba25b4fb4
-
Filesize
753KB
MD525e524e1a4f283c9d66f9dfcaac70638
SHA1c9c362f8b2cfb12d3ed17d424eb8faf071defce9
SHA256749e754f73b1c8b2b9d6f9e8dade875faa43f7588fa3f1c683c3104732ca652e
SHA5128ccd4e983b46882dca6d366095d251ed215101768802bf199c533ce98124c510c70bf527193d5bdb0eb30baa4b213d7b05d46bf543551636daf4579ba25b4fb4
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
598KB
MD5bd637b0f4e7789fbc6d6a512418ec063
SHA189cf09525fcb948ddf5889e2ee47e441f6f7a3f1
SHA25623a98a64d98061ad8ed1ac8fe14329f4521187ec39a78b4637abdd8c01c9a289
SHA51295789a3ff551b2d16be42d038a2ce7b541d67abfb7f27b002d468d70b4b5f077586ab0120727dcdcd869ff374bc1b9c7c9dd31afb4e39052977afd35b0fc44a0
-
Filesize
598KB
MD5bd637b0f4e7789fbc6d6a512418ec063
SHA189cf09525fcb948ddf5889e2ee47e441f6f7a3f1
SHA25623a98a64d98061ad8ed1ac8fe14329f4521187ec39a78b4637abdd8c01c9a289
SHA51295789a3ff551b2d16be42d038a2ce7b541d67abfb7f27b002d468d70b4b5f077586ab0120727dcdcd869ff374bc1b9c7c9dd31afb4e39052977afd35b0fc44a0
-
Filesize
391KB
MD50f1a243189247f885ec10aa39c7423a2
SHA1782e1f7e22a36235be75063de055a4902ecac1e9
SHA2569bc3d6702f3b6481d272c387c184ca8cba885a27391c29dc53517db8ec7a9dff
SHA512d7c08d8a511809f1ada4d6789f4d240d09ba34b069d81f29ae3730fd37e883aa1eef6691ec1a84b94bcf75ae86124a3d9500cdb6e37a4c6d74c97e969bb781de
-
Filesize
391KB
MD50f1a243189247f885ec10aa39c7423a2
SHA1782e1f7e22a36235be75063de055a4902ecac1e9
SHA2569bc3d6702f3b6481d272c387c184ca8cba885a27391c29dc53517db8ec7a9dff
SHA512d7c08d8a511809f1ada4d6789f4d240d09ba34b069d81f29ae3730fd37e883aa1eef6691ec1a84b94bcf75ae86124a3d9500cdb6e37a4c6d74c97e969bb781de
-
Filesize
474KB
MD5f27b053210c8845d0bec75be815d8626
SHA1ab10c82fcbe983abf0eed753226015b4d2125795
SHA256724c7b60e862542fdf2f1f62efc9192650750a98fe6a2e89f375edb96d135519
SHA5122a4a84a8cf1bc269e3cda0aed9893018410d287d76065d4b1374a3883a7b06903319ae131409216c7849814dfdc0d347592da5cc5e5a674d59107e4f577b0a80
-
Filesize
474KB
MD5f27b053210c8845d0bec75be815d8626
SHA1ab10c82fcbe983abf0eed753226015b4d2125795
SHA256724c7b60e862542fdf2f1f62efc9192650750a98fe6a2e89f375edb96d135519
SHA5122a4a84a8cf1bc269e3cda0aed9893018410d287d76065d4b1374a3883a7b06903319ae131409216c7849814dfdc0d347592da5cc5e5a674d59107e4f577b0a80
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
370KB
MD59f905979c1451c99f47050ff2ef28d9c
SHA14cc0bf5aa1f86ca3e3bb4e6025e2a46efe98d2ff
SHA256ccbf511660f4eee3932ae793fa9da24eb9d4ac3f01e1ad62bbc28d3d03a7b9f3
SHA51271000767746c18b4e89b90223e1f52468f09a3e4c590860ec4c5ab9f4c6d048d176716218b5b2873b3837c6497b0a4288664610811c5eb0067e53901ad00e538
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5