Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 03:06
Static task
static1
General
-
Target
95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe
-
Size
922KB
-
MD5
c81e0154aae227ae719026ddcb0e588d
-
SHA1
a5beadaa93705bfc1d27905b16c9f2b12fb8b91c
-
SHA256
95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007
-
SHA512
ff0ce26020858328618d6d6d73e97d57c4813d9af68fc7495d397da850bd30216cfa80b01da5d3bf88483b7f49be96d4b50fbbc23027ce405f734eacc7a17746
-
SSDEEP
24576:Fy1/dbxYHkdhSGjmCRReMYwHluVHC9en2ljMP:g1tj4G6Cz0U4u
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it092347.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it092347.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it092347.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it092347.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it092347.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it092347.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr418173.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 4624 zidc2833.exe 1836 zivy8403.exe 1372 it092347.exe 1140 jr951450.exe 532 kp403442.exe 536 lr418173.exe 3080 oneetx.exe 3388 oneetx.exe 3996 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 1760 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it092347.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zivy8403.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zidc2833.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zidc2833.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zivy8403.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 2648 1140 WerFault.exe 91 2280 536 WerFault.exe 95 1596 536 WerFault.exe 95 2036 536 WerFault.exe 95 2588 536 WerFault.exe 95 4952 536 WerFault.exe 95 2800 536 WerFault.exe 95 4788 536 WerFault.exe 95 2472 536 WerFault.exe 95 4928 536 WerFault.exe 95 788 536 WerFault.exe 95 1584 3080 WerFault.exe 115 1988 3080 WerFault.exe 115 1272 3080 WerFault.exe 115 5064 3080 WerFault.exe 115 4272 3080 WerFault.exe 115 228 3080 WerFault.exe 115 4284 3080 WerFault.exe 115 4324 3080 WerFault.exe 115 1408 3080 WerFault.exe 115 2096 3080 WerFault.exe 115 2536 3080 WerFault.exe 115 2648 3080 WerFault.exe 115 2444 3080 WerFault.exe 115 772 3080 WerFault.exe 115 1812 3388 WerFault.exe 160 1440 3080 WerFault.exe 115 2400 3080 WerFault.exe 115 1044 3080 WerFault.exe 115 1260 3996 WerFault.exe 170 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1372 it092347.exe 1372 it092347.exe 1140 jr951450.exe 1140 jr951450.exe 532 kp403442.exe 532 kp403442.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1372 it092347.exe Token: SeDebugPrivilege 1140 jr951450.exe Token: SeDebugPrivilege 532 kp403442.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 536 lr418173.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3032 wrote to memory of 4624 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 85 PID 3032 wrote to memory of 4624 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 85 PID 3032 wrote to memory of 4624 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 85 PID 4624 wrote to memory of 1836 4624 zidc2833.exe 86 PID 4624 wrote to memory of 1836 4624 zidc2833.exe 86 PID 4624 wrote to memory of 1836 4624 zidc2833.exe 86 PID 1836 wrote to memory of 1372 1836 zivy8403.exe 87 PID 1836 wrote to memory of 1372 1836 zivy8403.exe 87 PID 1836 wrote to memory of 1140 1836 zivy8403.exe 91 PID 1836 wrote to memory of 1140 1836 zivy8403.exe 91 PID 1836 wrote to memory of 1140 1836 zivy8403.exe 91 PID 4624 wrote to memory of 532 4624 zidc2833.exe 94 PID 4624 wrote to memory of 532 4624 zidc2833.exe 94 PID 4624 wrote to memory of 532 4624 zidc2833.exe 94 PID 3032 wrote to memory of 536 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 95 PID 3032 wrote to memory of 536 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 95 PID 3032 wrote to memory of 536 3032 95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe 95 PID 536 wrote to memory of 3080 536 lr418173.exe 115 PID 536 wrote to memory of 3080 536 lr418173.exe 115 PID 536 wrote to memory of 3080 536 lr418173.exe 115 PID 3080 wrote to memory of 2252 3080 oneetx.exe 133 PID 3080 wrote to memory of 2252 3080 oneetx.exe 133 PID 3080 wrote to memory of 2252 3080 oneetx.exe 133 PID 3080 wrote to memory of 4148 3080 oneetx.exe 139 PID 3080 wrote to memory of 4148 3080 oneetx.exe 139 PID 3080 wrote to memory of 4148 3080 oneetx.exe 139 PID 4148 wrote to memory of 3908 4148 cmd.exe 142 PID 4148 wrote to memory of 3908 4148 cmd.exe 142 PID 4148 wrote to memory of 3908 4148 cmd.exe 142 PID 4148 wrote to memory of 2652 4148 cmd.exe 144 PID 4148 wrote to memory of 2652 4148 cmd.exe 144 PID 4148 wrote to memory of 2652 4148 cmd.exe 144 PID 4148 wrote to memory of 1324 4148 cmd.exe 145 PID 4148 wrote to memory of 1324 4148 cmd.exe 145 PID 4148 wrote to memory of 1324 4148 cmd.exe 145 PID 4148 wrote to memory of 3068 4148 cmd.exe 146 PID 4148 wrote to memory of 3068 4148 cmd.exe 146 PID 4148 wrote to memory of 3068 4148 cmd.exe 146 PID 4148 wrote to memory of 1976 4148 cmd.exe 147 PID 4148 wrote to memory of 1976 4148 cmd.exe 147 PID 4148 wrote to memory of 1976 4148 cmd.exe 147 PID 4148 wrote to memory of 4352 4148 cmd.exe 148 PID 4148 wrote to memory of 4352 4148 cmd.exe 148 PID 4148 wrote to memory of 4352 4148 cmd.exe 148 PID 3080 wrote to memory of 1760 3080 oneetx.exe 165 PID 3080 wrote to memory of 1760 3080 oneetx.exe 165 PID 3080 wrote to memory of 1760 3080 oneetx.exe 165
Processes
-
C:\Users\Admin\AppData\Local\Temp\95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe"C:\Users\Admin\AppData\Local\Temp\95fe65b7df9a40defe88170655852b2b03c17b499e06cda0eb26178cd37ef007.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidc2833.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zidc2833.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zivy8403.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zivy8403.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it092347.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it092347.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr951450.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr951450.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 17085⤵
- Program crash
PID:2648
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403442.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403442.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418173.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr418173.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 6963⤵
- Program crash
PID:2280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 7803⤵
- Program crash
PID:1596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 8563⤵
- Program crash
PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 9523⤵
- Program crash
PID:2588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 9563⤵
- Program crash
PID:4952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 9763⤵
- Program crash
PID:2800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 12163⤵
- Program crash
PID:4788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 12283⤵
- Program crash
PID:2472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 13163⤵
- Program crash
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6924⤵
- Program crash
PID:1584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 8484⤵
- Program crash
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 8764⤵
- Program crash
PID:1272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10604⤵
- Program crash
PID:5064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10884⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10884⤵
- Program crash
PID:228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10804⤵
- Program crash
PID:4284
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9284⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7444⤵
- Program crash
PID:1408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3908
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2652
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3068
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:1976
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9124⤵
- Program crash
PID:2096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 12964⤵
- Program crash
PID:2536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9084⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 12644⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 11404⤵
- Program crash
PID:772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 16164⤵
- Program crash
PID:1440
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 11404⤵
- Program crash
PID:2400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 16284⤵
- Program crash
PID:1044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 8643⤵
- Program crash
PID:788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1140 -ip 11401⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 536 -ip 5361⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 536 -ip 5361⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 536 -ip 5361⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 536 -ip 5361⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 536 -ip 5361⤵PID:5004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 536 -ip 5361⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 536 -ip 5361⤵PID:3924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 536 -ip 5361⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 536 -ip 5361⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 536 -ip 5361⤵PID:1780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3080 -ip 30801⤵PID:4864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3080 -ip 30801⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3080 -ip 30801⤵PID:4960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3080 -ip 30801⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3080 -ip 30801⤵PID:3500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3080 -ip 30801⤵PID:1124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3080 -ip 30801⤵PID:2188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3080 -ip 30801⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3080 -ip 30801⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3080 -ip 30801⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3080 -ip 30801⤵PID:3516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3080 -ip 30801⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3080 -ip 30801⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3080 -ip 30801⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 3122⤵
- Program crash
PID:1812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3388 -ip 33881⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3080 -ip 30801⤵PID:1648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3080 -ip 30801⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3080 -ip 30801⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 3122⤵
- Program crash
PID:1260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3996 -ip 39961⤵PID:1820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
617KB
MD54dc1557ad9653106a1360ce931139180
SHA15bca863cf74ecc78b8300c5be5f63307660ee3b6
SHA2563027a773a3ad7c6f34f1c332c6415909cb93f60f01308b93e40fb183e4581af3
SHA5126a8ab796dab633e8ef7d7fcd9b3baa353345f06125808eb49b27767e6e41ed4470d0f38814af05bcc6ef61aecbbe0ac5d151f643d2b11590218f2dd9d804f4db
-
Filesize
617KB
MD54dc1557ad9653106a1360ce931139180
SHA15bca863cf74ecc78b8300c5be5f63307660ee3b6
SHA2563027a773a3ad7c6f34f1c332c6415909cb93f60f01308b93e40fb183e4581af3
SHA5126a8ab796dab633e8ef7d7fcd9b3baa353345f06125808eb49b27767e6e41ed4470d0f38814af05bcc6ef61aecbbe0ac5d151f643d2b11590218f2dd9d804f4db
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
462KB
MD5c5c7cf60fee694dba6e0a1dc64d21e21
SHA173d9d2f325fd52de8a647e4c4a5b7e5bcbd6c29d
SHA2563d9067d9b614e59ebfb1430bd2cad66da1a3b98400889787b6c84bbff29f1b18
SHA51248a5161ed934a1805dba8348f027b30802ce9538265d16e33921c36e2fda474eb12b5e156dde8e5d95c2b141c2030a04c18ef935c36fddeaf56bb90a59e95e73
-
Filesize
462KB
MD5c5c7cf60fee694dba6e0a1dc64d21e21
SHA173d9d2f325fd52de8a647e4c4a5b7e5bcbd6c29d
SHA2563d9067d9b614e59ebfb1430bd2cad66da1a3b98400889787b6c84bbff29f1b18
SHA51248a5161ed934a1805dba8348f027b30802ce9538265d16e33921c36e2fda474eb12b5e156dde8e5d95c2b141c2030a04c18ef935c36fddeaf56bb90a59e95e73
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
474KB
MD5e05455413000a34833904de34b0b9d07
SHA130faf1b24703236b939acb5df687b7cf33de674a
SHA2561304c21fb47cb9719f51912be35cfdd8d6e8635a40513b48ec2db29983f901b0
SHA51256f85cee7edd467af4f633a8c2edc25e8ca1bccc6dc3a49ced885bca71ee745f867f9f650fd4342538e0d293e649d89224c0f843376a97842967d38daefd2af6
-
Filesize
474KB
MD5e05455413000a34833904de34b0b9d07
SHA130faf1b24703236b939acb5df687b7cf33de674a
SHA2561304c21fb47cb9719f51912be35cfdd8d6e8635a40513b48ec2db29983f901b0
SHA51256f85cee7edd467af4f633a8c2edc25e8ca1bccc6dc3a49ced885bca71ee745f867f9f650fd4342538e0d293e649d89224c0f843376a97842967d38daefd2af6
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
370KB
MD5b35290e29103bf3518a778af1959ace8
SHA1707f5ed0735d4097ad392cb09ac9486e5f9aabb0
SHA2567da4ec117ab760b40deb6c58008cc2da7e3fbfff9ca0f58be8951d772b27e1cc
SHA5129452c1931ac8b4408cafb279fe875bf43eec9c39b1cdc426424b5fb5fabf1191deb8a50d9e2ceecb6c60eee4930272679cf459c5ba489fbdbde3e5575635ba84
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5