Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2023, 02:39
Static task
static1
General
-
Target
2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe
-
Size
965KB
-
MD5
314c8bbfdd70f91325c1418cb0406c84
-
SHA1
b97910eaa78d929af3cdc1c55192bc863f14d070
-
SHA256
2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c
-
SHA512
67f519d11ce2c16bbf4f3c2e37a0a0faaf03a6edf7d4b06f2ff3442f11584ef49cf3d8704076c36403c30ccdaad7983317e0e49ea7204ba037afda10de9cf9b9
-
SSDEEP
24576:Ay7FgsF+DdL2DMrJE9UDOaqjfd6TVdZb14INBsnQXEc8:HBgsF2dLHE9USWDVfX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr143927.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation si473947.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 2120 un148650.exe 3388 un398397.exe 4092 pr143927.exe 2832 qu798175.exe 4180 rk653843.exe 2380 si473947.exe 4720 oneetx.exe 1560 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4716 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr143927.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr143927.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un148650.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un148650.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un398397.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un398397.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 3324 4092 WerFault.exe 87 4876 2832 WerFault.exe 93 3340 2380 WerFault.exe 98 3164 2380 WerFault.exe 98 3992 2380 WerFault.exe 98 2144 2380 WerFault.exe 98 2480 2380 WerFault.exe 98 4024 2380 WerFault.exe 98 3448 2380 WerFault.exe 98 2328 2380 WerFault.exe 98 1868 2380 WerFault.exe 98 8 2380 WerFault.exe 98 1728 4720 WerFault.exe 118 4832 4720 WerFault.exe 118 1584 4720 WerFault.exe 118 3016 4720 WerFault.exe 118 2368 4720 WerFault.exe 118 2612 4720 WerFault.exe 118 4748 4720 WerFault.exe 118 2000 4720 WerFault.exe 118 3388 4720 WerFault.exe 118 2548 4720 WerFault.exe 118 1996 4720 WerFault.exe 118 4468 4720 WerFault.exe 118 4072 4720 WerFault.exe 118 2108 4720 WerFault.exe 118 4604 4720 WerFault.exe 118 4660 4720 WerFault.exe 118 3784 1560 WerFault.exe 167 1776 4720 WerFault.exe 118 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2632 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4092 pr143927.exe 4092 pr143927.exe 2832 qu798175.exe 2832 qu798175.exe 4180 rk653843.exe 4180 rk653843.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4092 pr143927.exe Token: SeDebugPrivilege 2832 qu798175.exe Token: SeDebugPrivilege 4180 rk653843.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 si473947.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3204 wrote to memory of 2120 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 85 PID 3204 wrote to memory of 2120 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 85 PID 3204 wrote to memory of 2120 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 85 PID 2120 wrote to memory of 3388 2120 un148650.exe 86 PID 2120 wrote to memory of 3388 2120 un148650.exe 86 PID 2120 wrote to memory of 3388 2120 un148650.exe 86 PID 3388 wrote to memory of 4092 3388 un398397.exe 87 PID 3388 wrote to memory of 4092 3388 un398397.exe 87 PID 3388 wrote to memory of 4092 3388 un398397.exe 87 PID 3388 wrote to memory of 2832 3388 un398397.exe 93 PID 3388 wrote to memory of 2832 3388 un398397.exe 93 PID 3388 wrote to memory of 2832 3388 un398397.exe 93 PID 2120 wrote to memory of 4180 2120 un148650.exe 96 PID 2120 wrote to memory of 4180 2120 un148650.exe 96 PID 2120 wrote to memory of 4180 2120 un148650.exe 96 PID 3204 wrote to memory of 2380 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 98 PID 3204 wrote to memory of 2380 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 98 PID 3204 wrote to memory of 2380 3204 2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe 98 PID 2380 wrote to memory of 4720 2380 si473947.exe 118 PID 2380 wrote to memory of 4720 2380 si473947.exe 118 PID 2380 wrote to memory of 4720 2380 si473947.exe 118 PID 4720 wrote to memory of 2632 4720 oneetx.exe 138 PID 4720 wrote to memory of 2632 4720 oneetx.exe 138 PID 4720 wrote to memory of 2632 4720 oneetx.exe 138 PID 4720 wrote to memory of 4396 4720 oneetx.exe 144 PID 4720 wrote to memory of 4396 4720 oneetx.exe 144 PID 4720 wrote to memory of 4396 4720 oneetx.exe 144 PID 4396 wrote to memory of 4852 4396 cmd.exe 148 PID 4396 wrote to memory of 4852 4396 cmd.exe 148 PID 4396 wrote to memory of 4852 4396 cmd.exe 148 PID 4396 wrote to memory of 1680 4396 cmd.exe 149 PID 4396 wrote to memory of 1680 4396 cmd.exe 149 PID 4396 wrote to memory of 1680 4396 cmd.exe 149 PID 4396 wrote to memory of 3160 4396 cmd.exe 150 PID 4396 wrote to memory of 3160 4396 cmd.exe 150 PID 4396 wrote to memory of 3160 4396 cmd.exe 150 PID 4396 wrote to memory of 3724 4396 cmd.exe 151 PID 4396 wrote to memory of 3724 4396 cmd.exe 151 PID 4396 wrote to memory of 3724 4396 cmd.exe 151 PID 4396 wrote to memory of 452 4396 cmd.exe 152 PID 4396 wrote to memory of 452 4396 cmd.exe 152 PID 4396 wrote to memory of 452 4396 cmd.exe 152 PID 4396 wrote to memory of 3060 4396 cmd.exe 153 PID 4396 wrote to memory of 3060 4396 cmd.exe 153 PID 4396 wrote to memory of 3060 4396 cmd.exe 153 PID 4720 wrote to memory of 4716 4720 oneetx.exe 164 PID 4720 wrote to memory of 4716 4720 oneetx.exe 164 PID 4720 wrote to memory of 4716 4720 oneetx.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe"C:\Users\Admin\AppData\Local\Temp\2d85ebf354dd95e3e46ab65bd6e45aff16790594383ebef773bcb23405a03f9c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un148650.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un148650.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398397.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un398397.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr143927.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr143927.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 10845⤵
- Program crash
PID:3324
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu798175.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu798175.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 13245⤵
- Program crash
PID:4876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk653843.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si473947.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si473947.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 6963⤵
- Program crash
PID:3340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 7683⤵
- Program crash
PID:3164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 8123⤵
- Program crash
PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 8683⤵
- Program crash
PID:2144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 8643⤵
- Program crash
PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 9843⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 12203⤵
- Program crash
PID:3448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 12523⤵
- Program crash
PID:2328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 13203⤵
- Program crash
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 6964⤵
- Program crash
PID:1728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 8284⤵
- Program crash
PID:4832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 7924⤵
- Program crash
PID:1584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 10604⤵
- Program crash
PID:3016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 10604⤵
- Program crash
PID:2368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 10604⤵
- Program crash
PID:2612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 10844⤵
- Program crash
PID:4748
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 9924⤵
- Program crash
PID:2000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 7644⤵
- Program crash
PID:3388
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4852
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1680
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3160
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3724
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"5⤵PID:452
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E5⤵PID:3060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 13604⤵
- Program crash
PID:2548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 12924⤵
- Program crash
PID:1996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 13884⤵
- Program crash
PID:4468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 13204⤵
- Program crash
PID:4072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 11084⤵
- Program crash
PID:2108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 16044⤵
- Program crash
PID:4604
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 10964⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 15844⤵
- Program crash
PID:1776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 17563⤵
- Program crash
PID:8
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4092 -ip 40921⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2832 -ip 28321⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2380 -ip 23801⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2380 -ip 23801⤵PID:2100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2380 -ip 23801⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2380 -ip 23801⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2380 -ip 23801⤵PID:4280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2380 -ip 23801⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2380 -ip 23801⤵PID:4672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2380 -ip 23801⤵PID:1472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2380 -ip 23801⤵PID:1144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2380 -ip 23801⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4720 -ip 47201⤵PID:2876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4720 -ip 47201⤵PID:2296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4720 -ip 47201⤵PID:4760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4720 -ip 47201⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4720 -ip 47201⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4720 -ip 47201⤵PID:3776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4720 -ip 47201⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4720 -ip 47201⤵PID:3456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4720 -ip 47201⤵PID:3224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4720 -ip 47201⤵PID:3984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4720 -ip 47201⤵PID:3352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4720 -ip 47201⤵PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4720 -ip 47201⤵PID:2916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4720 -ip 47201⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4720 -ip 47201⤵PID:912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4720 -ip 47201⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 3162⤵
- Program crash
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1560 -ip 15601⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4720 -ip 47201⤵PID:2088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
706KB
MD5d3fd5caf59cb77106adb479c4d709da6
SHA1b695559930fb215f81fa4460d7a9f24052bbb127
SHA256657a3d582522acda4d91d16d9f0d4d2461919ecaaea4b920e48fc8276e1dd44d
SHA512e40df540a82ba0ff95df31f495ff8f2ad583402f96cc187b80aa5a8cbf1e53ba773053fa3bedb1bfd571c9eaf470a51c43f6427024fc0675f54b0688c237e593
-
Filesize
706KB
MD5d3fd5caf59cb77106adb479c4d709da6
SHA1b695559930fb215f81fa4460d7a9f24052bbb127
SHA256657a3d582522acda4d91d16d9f0d4d2461919ecaaea4b920e48fc8276e1dd44d
SHA512e40df540a82ba0ff95df31f495ff8f2ad583402f96cc187b80aa5a8cbf1e53ba773053fa3bedb1bfd571c9eaf470a51c43f6427024fc0675f54b0688c237e593
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
136KB
MD59c75a048f066d01b19ed80dc6e7a7101
SHA17d37c8ef50e8b83fcdd44032fb082f226ab3d8c3
SHA256c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625
SHA512b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33
-
Filesize
552KB
MD56e920b0c6bafb503669b7391f5c22061
SHA1952a4699c35dc080ff2281271b58f14634ae7b9c
SHA25638a6065a50f6c5ed8413079a15817771654cef4978bc7354a73baa94bd73d089
SHA512eca4a874bc85bea1da40025ac95ee39337ea8ec16bf03c156db0e4b1c64c39cfe2506fec876e476217597c71b9673cc9d34269327a356384f14f2f4935cdd12d
-
Filesize
552KB
MD56e920b0c6bafb503669b7391f5c22061
SHA1952a4699c35dc080ff2281271b58f14634ae7b9c
SHA25638a6065a50f6c5ed8413079a15817771654cef4978bc7354a73baa94bd73d089
SHA512eca4a874bc85bea1da40025ac95ee39337ea8ec16bf03c156db0e4b1c64c39cfe2506fec876e476217597c71b9673cc9d34269327a356384f14f2f4935cdd12d
-
Filesize
299KB
MD5eab95263ebc1a144e50e846e306f3cf5
SHA1538a97cc9bf96a36884cf022619c235219acbf82
SHA256a3fdf70d301a054afc4c01a40ee7ba056682dbfab2ab8c145db0b14239450d9c
SHA512b719d7dd02bd2d48f2068a773b9ed7cc9a68301a8bf53337ca43faa2eb4904d3dc9780abae5cbee956834a4a955cdcb6a3cd7d0cc67f808311933bc046964a39
-
Filesize
299KB
MD5eab95263ebc1a144e50e846e306f3cf5
SHA1538a97cc9bf96a36884cf022619c235219acbf82
SHA256a3fdf70d301a054afc4c01a40ee7ba056682dbfab2ab8c145db0b14239450d9c
SHA512b719d7dd02bd2d48f2068a773b9ed7cc9a68301a8bf53337ca43faa2eb4904d3dc9780abae5cbee956834a4a955cdcb6a3cd7d0cc67f808311933bc046964a39
-
Filesize
381KB
MD5005cad880697132078f78c3415b2838d
SHA168dd34a5564efaf9b01456d50598b7b901e4fa6d
SHA25620864b7e3e6bf77be52d711ce3f7c00dcc82ed092b103f2b6d762cefeb57127c
SHA512377a6fa4fc146d7940529ad83c6034bb1a45cc6a16def36757798a7d2e65712fa47c4d96c0a62bfb99165483aabfe6f4a5d1cb3468e0c265db62b53ba4f93c8b
-
Filesize
381KB
MD5005cad880697132078f78c3415b2838d
SHA168dd34a5564efaf9b01456d50598b7b901e4fa6d
SHA25620864b7e3e6bf77be52d711ce3f7c00dcc82ed092b103f2b6d762cefeb57127c
SHA512377a6fa4fc146d7940529ad83c6034bb1a45cc6a16def36757798a7d2e65712fa47c4d96c0a62bfb99165483aabfe6f4a5d1cb3468e0c265db62b53ba4f93c8b
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
277KB
MD56c943f271d2c8610daaf8c645c7b453c
SHA110042f3a746ce2ac614ae9a0de38f70f027bf6bd
SHA2567fd6df0f2cfa26168fc0322a80a304c6f1adf4dcdc8c30fb7a8e6ea20926aff2
SHA5120100671d83e6c8ea0f2f6291b3f0b4460dcd033ae7f0a5533c644c1c8f013e0732909bd3a3c8078aee48497c025ffa65dc73a973f6ee04c26e7601523cd077da
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
89KB
MD5cfe2ef912f30ac9bc36d8686888ca0d3
SHA1ddbbb63670b2f5bd903dadcff54ff8270825499b
SHA256675771ae0ef1ba5c7fdde82f950461c2c4487e56b3fc41f5c544b73c8b33f10d
SHA5125e0f51d137000e42e9cd0a41ab9de5a4c91bda677fce992f7b391ea5f9cb7cfb44c31a990bc6249b9dfed8f346881311c7c56f63fb1ef41ea8f757247cd9b68a
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5