Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2023, 04:15
Static task
static1
General
-
Target
5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe
-
Size
922KB
-
MD5
723d61be61ae10e67b4a8b7a6f72d6f5
-
SHA1
8eee68ce7679d713b28214be6e9d768d309e1630
-
SHA256
5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3
-
SHA512
bbc4c325dca30c4b5c5376e593097bf3f52e36b9600f713db2e29e2f3d2face683bb4549d7f1411d0ade457bd1002c58e46395fdebeea1e4aa8ba489fac8a5e8
-
SSDEEP
12288:My90rjwd3O8Em/Xi4PJB3axnog5HamjWCGEo+xFVV4rLnY7dzHYIN:MyMEde8Em/XigPaxn5dWa/OrLY7hfN
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it957954.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it957954.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it957954.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it957954.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it957954.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it957954.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation lr598897.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 9 IoCs
pid Process 2740 zijr0626.exe 5064 zisa5594.exe 1052 it957954.exe 3140 jr891206.exe 2660 kp147651.exe 5104 lr598897.exe 2008 oneetx.exe 2236 oneetx.exe 4420 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4668 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it957954.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zijr0626.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zijr0626.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zisa5594.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zisa5594.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 4344 3140 WerFault.exe 90 4444 5104 WerFault.exe 97 3040 5104 WerFault.exe 97 3648 5104 WerFault.exe 97 1708 5104 WerFault.exe 97 764 5104 WerFault.exe 97 4680 5104 WerFault.exe 97 4636 5104 WerFault.exe 97 2312 5104 WerFault.exe 97 2184 5104 WerFault.exe 97 3604 5104 WerFault.exe 97 1556 2008 WerFault.exe 117 4736 2008 WerFault.exe 117 1128 2008 WerFault.exe 117 1808 2008 WerFault.exe 117 4080 2008 WerFault.exe 117 1900 2008 WerFault.exe 117 1240 2008 WerFault.exe 117 2976 2008 WerFault.exe 117 4716 2008 WerFault.exe 117 3996 2008 WerFault.exe 117 1832 2008 WerFault.exe 117 4132 2008 WerFault.exe 117 3440 2008 WerFault.exe 117 4444 2236 WerFault.exe 156 1764 2008 WerFault.exe 117 4908 2008 WerFault.exe 117 1668 2008 WerFault.exe 117 3900 4420 WerFault.exe 166 1896 2008 WerFault.exe 117 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1052 it957954.exe 1052 it957954.exe 3140 jr891206.exe 3140 jr891206.exe 2660 kp147651.exe 2660 kp147651.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1052 it957954.exe Token: SeDebugPrivilege 3140 jr891206.exe Token: SeDebugPrivilege 2660 kp147651.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5104 lr598897.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2740 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 83 PID 4604 wrote to memory of 2740 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 83 PID 4604 wrote to memory of 2740 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 83 PID 2740 wrote to memory of 5064 2740 zijr0626.exe 84 PID 2740 wrote to memory of 5064 2740 zijr0626.exe 84 PID 2740 wrote to memory of 5064 2740 zijr0626.exe 84 PID 5064 wrote to memory of 1052 5064 zisa5594.exe 85 PID 5064 wrote to memory of 1052 5064 zisa5594.exe 85 PID 5064 wrote to memory of 3140 5064 zisa5594.exe 90 PID 5064 wrote to memory of 3140 5064 zisa5594.exe 90 PID 5064 wrote to memory of 3140 5064 zisa5594.exe 90 PID 2740 wrote to memory of 2660 2740 zijr0626.exe 96 PID 2740 wrote to memory of 2660 2740 zijr0626.exe 96 PID 2740 wrote to memory of 2660 2740 zijr0626.exe 96 PID 4604 wrote to memory of 5104 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 97 PID 4604 wrote to memory of 5104 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 97 PID 4604 wrote to memory of 5104 4604 5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe 97 PID 5104 wrote to memory of 2008 5104 lr598897.exe 117 PID 5104 wrote to memory of 2008 5104 lr598897.exe 117 PID 5104 wrote to memory of 2008 5104 lr598897.exe 117 PID 2008 wrote to memory of 3520 2008 oneetx.exe 134 PID 2008 wrote to memory of 3520 2008 oneetx.exe 134 PID 2008 wrote to memory of 3520 2008 oneetx.exe 134 PID 2008 wrote to memory of 4432 2008 oneetx.exe 140 PID 2008 wrote to memory of 4432 2008 oneetx.exe 140 PID 2008 wrote to memory of 4432 2008 oneetx.exe 140 PID 4432 wrote to memory of 3816 4432 cmd.exe 144 PID 4432 wrote to memory of 3816 4432 cmd.exe 144 PID 4432 wrote to memory of 3816 4432 cmd.exe 144 PID 4432 wrote to memory of 5060 4432 cmd.exe 145 PID 4432 wrote to memory of 5060 4432 cmd.exe 145 PID 4432 wrote to memory of 5060 4432 cmd.exe 145 PID 4432 wrote to memory of 2664 4432 cmd.exe 146 PID 4432 wrote to memory of 2664 4432 cmd.exe 146 PID 4432 wrote to memory of 2664 4432 cmd.exe 146 PID 4432 wrote to memory of 2744 4432 cmd.exe 147 PID 4432 wrote to memory of 2744 4432 cmd.exe 147 PID 4432 wrote to memory of 2744 4432 cmd.exe 147 PID 4432 wrote to memory of 2536 4432 cmd.exe 148 PID 4432 wrote to memory of 2536 4432 cmd.exe 148 PID 4432 wrote to memory of 2536 4432 cmd.exe 148 PID 4432 wrote to memory of 4708 4432 cmd.exe 149 PID 4432 wrote to memory of 4708 4432 cmd.exe 149 PID 4432 wrote to memory of 4708 4432 cmd.exe 149 PID 2008 wrote to memory of 4668 2008 oneetx.exe 163 PID 2008 wrote to memory of 4668 2008 oneetx.exe 163 PID 2008 wrote to memory of 4668 2008 oneetx.exe 163
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe"C:\Users\Admin\AppData\Local\Temp\5e1b175839fdfe2ccd20bd8dd2ffacd0448de5d815d6472b61c55a478400d5e3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijr0626.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zijr0626.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zisa5594.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zisa5594.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it957954.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it957954.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr891206.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr891206.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 13245⤵
- Program crash
PID:4344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp147651.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp147651.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr598897.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr598897.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6963⤵
- Program crash
PID:4444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 7803⤵
- Program crash
PID:3040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8563⤵
- Program crash
PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 9523⤵
- Program crash
PID:1708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8603⤵
- Program crash
PID:764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8603⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 12163⤵
- Program crash
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 12003⤵
- Program crash
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 13163⤵
- Program crash
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 6924⤵
- Program crash
PID:1556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 9084⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 9124⤵
- Program crash
PID:1128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 10884⤵
- Program crash
PID:1808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 8964⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 8964⤵
- Program crash
PID:1900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 9124⤵
- Program crash
PID:1240
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:3520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 10204⤵
- Program crash
PID:2976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 8724⤵
- Program crash
PID:4716
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3816
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:5060
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2744
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:2536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:4708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 7444⤵
- Program crash
PID:3996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 7684⤵
- Program crash
PID:1832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 10164⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 13004⤵
- Program crash
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 8964⤵
- Program crash
PID:1764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 16084⤵
- Program crash
PID:4908
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 11044⤵
- Program crash
PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 16204⤵
- Program crash
PID:1896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 13563⤵
- Program crash
PID:3604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3140 -ip 31401⤵PID:3364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5104 -ip 51041⤵PID:3516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5104 -ip 51041⤵PID:1460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5104 -ip 51041⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5104 -ip 51041⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5104 -ip 51041⤵PID:3092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5104 -ip 51041⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5104 -ip 51041⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5104 -ip 51041⤵PID:1828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5104 -ip 51041⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5104 -ip 51041⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2008 -ip 20081⤵PID:924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2008 -ip 20081⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2008 -ip 20081⤵PID:4924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2008 -ip 20081⤵PID:2320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2008 -ip 20081⤵PID:2600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2008 -ip 20081⤵PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2008 -ip 20081⤵PID:2392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2008 -ip 20081⤵PID:2412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2008 -ip 20081⤵PID:3884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2008 -ip 20081⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2008 -ip 20081⤵PID:4584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2008 -ip 20081⤵PID:3936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2008 -ip 20081⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 3202⤵
- Program crash
PID:4444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2236 -ip 22361⤵PID:4980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2008 -ip 20081⤵PID:5112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2008 -ip 20081⤵PID:4672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2008 -ip 20081⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 3122⤵
- Program crash
PID:3900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4420 -ip 44201⤵PID:2096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2008 -ip 20081⤵PID:4812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
616KB
MD5a66bd6cdf3597a577c445efff50a1b7c
SHA1a997fcc65c9a95b2b99a0a8bb69e9e98561433f4
SHA256378d3dfd85d27511c894483251e1b452faeb74b8d678ac2a4f7a235de7f3e923
SHA512fbbfd7f52d038a8957a31fd28515613633d85ef6b1a4a72509d4440e2cace07449ad8d7da3eb2359325bf27f2cd92206d67df6b18a68bcb9a0f1f009a4222e87
-
Filesize
616KB
MD5a66bd6cdf3597a577c445efff50a1b7c
SHA1a997fcc65c9a95b2b99a0a8bb69e9e98561433f4
SHA256378d3dfd85d27511c894483251e1b452faeb74b8d678ac2a4f7a235de7f3e923
SHA512fbbfd7f52d038a8957a31fd28515613633d85ef6b1a4a72509d4440e2cace07449ad8d7da3eb2359325bf27f2cd92206d67df6b18a68bcb9a0f1f009a4222e87
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
136KB
MD5ac0ffc4fceebe7be421ae8fc8517d1bf
SHA1fa6a6f1878e561b5401ae36422add3d34cfdf6dd
SHA256fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718
SHA51223de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93
-
Filesize
462KB
MD55ce6b486b1a12f98c70cb5b2e40d5dfa
SHA1354bd4b0616c3d8b3af6f33caa501ca2b9f6db31
SHA2561653e0d479c7d0cf62be10f9cfa26f8351c44d2b79c191889974397cf35ede22
SHA5125efc07b6766671d221380a0264cf300fc39c6516b842488a22fb0ce3c7cc13c0471333d64f4243ecd1bb32765c8f624f3e14b379a1a13388d916637f5ef56859
-
Filesize
462KB
MD55ce6b486b1a12f98c70cb5b2e40d5dfa
SHA1354bd4b0616c3d8b3af6f33caa501ca2b9f6db31
SHA2561653e0d479c7d0cf62be10f9cfa26f8351c44d2b79c191889974397cf35ede22
SHA5125efc07b6766671d221380a0264cf300fc39c6516b842488a22fb0ce3c7cc13c0471333d64f4243ecd1bb32765c8f624f3e14b379a1a13388d916637f5ef56859
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
474KB
MD5f7d92a10fb6758586d3181108840c67f
SHA1d32f8631d527e26b1adbbf5811e91e457340f872
SHA256b233fa8a7b682ad2b7106d7d623b05d350d4ed203fe9706ff575e2b699e7c219
SHA512145854b2b67791b5af823eebc51576ff81ae06e773c49cf34fca3ee96c63a3aaf9738480cc47fca8df97f6c5489676fcc1da1d16e2f3573dfb2cd9261719cb25
-
Filesize
474KB
MD5f7d92a10fb6758586d3181108840c67f
SHA1d32f8631d527e26b1adbbf5811e91e457340f872
SHA256b233fa8a7b682ad2b7106d7d623b05d350d4ed203fe9706ff575e2b699e7c219
SHA512145854b2b67791b5af823eebc51576ff81ae06e773c49cf34fca3ee96c63a3aaf9738480cc47fca8df97f6c5489676fcc1da1d16e2f3573dfb2cd9261719cb25
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
370KB
MD5d54a0c331a48d599bd18a298181972e7
SHA1b70853be56d8596f10bfd9cb4b7b3e47ab82cca5
SHA2568421eef9febcbb7f1fb72899782c737707b0526b951d01ccc6ac362f7f615c18
SHA512dea634febae54a6e731c37ede1465e2110a45297dcdcc0e08e28f9a12fcd3ad9e8a8c02eef4220344b415852c70144da3db55a11b7f742debac2fb6375cfddc3
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
89KB
MD5f577e9f9bb3716a1405af573fbf2afb4
SHA17e2a18c86e4912f9218fbe7c8cf64e04afb90f6e
SHA2564b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb
SHA512fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5