Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2023, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe
Resource
win10v2004-20230220-en
General
-
Target
fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe
-
Size
643KB
-
MD5
4208d027ddf5f12dcd187fedac78f4ec
-
SHA1
8560404b5258380600d33a5df5ab27411538f500
-
SHA256
fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d
-
SHA512
c2003275d7f432dcafd1d86e4361da1f5c0118bb5efb35ac7cf145243e960c6506d6f768572e697acfe7f39b33ca270257e87761fabd18ad5fa73e9c5359a5da
-
SSDEEP
12288:8MrRy906zM2yYA3D/fi3EqQEOmncX2ifGkyyky7w1mxZ:1yjMESJfGGky/Z
Malware Config
Extracted
redline
darm
217.196.96.56:4138
-
auth_value
d88ac8ccc04ab9979b04b46313db1648
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h1711811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h1711811.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h1711811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h1711811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h1711811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h1711811.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation i6206260.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 112 x1668713.exe 4296 g0388222.exe 3632 h1711811.exe 2620 i6206260.exe 3252 oneetx.exe 4436 oneetx.exe 4820 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2100 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h1711811.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h1711811.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x1668713.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1668713.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
pid pid_target Process procid_target 4908 3632 WerFault.exe 91 3784 2620 WerFault.exe 94 4720 2620 WerFault.exe 94 3752 2620 WerFault.exe 94 4192 2620 WerFault.exe 94 3368 2620 WerFault.exe 94 4832 2620 WerFault.exe 94 4508 2620 WerFault.exe 94 2104 2620 WerFault.exe 94 2244 2620 WerFault.exe 94 4764 2620 WerFault.exe 94 4260 3252 WerFault.exe 114 4516 3252 WerFault.exe 114 2188 3252 WerFault.exe 114 4712 3252 WerFault.exe 114 3780 3252 WerFault.exe 114 4632 3252 WerFault.exe 114 3992 3252 WerFault.exe 114 3664 3252 WerFault.exe 114 1492 3252 WerFault.exe 114 2360 3252 WerFault.exe 114 1076 3252 WerFault.exe 114 4080 3252 WerFault.exe 114 1312 3252 WerFault.exe 114 1816 3252 WerFault.exe 114 3764 4436 WerFault.exe 155 3380 3252 WerFault.exe 114 2208 3252 WerFault.exe 114 2144 3252 WerFault.exe 114 4596 4820 WerFault.exe 165 1484 3252 WerFault.exe 114 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2296 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4296 g0388222.exe 4296 g0388222.exe 3632 h1711811.exe 3632 h1711811.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4296 g0388222.exe Token: SeDebugPrivilege 3632 h1711811.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2620 i6206260.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4388 wrote to memory of 112 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 83 PID 4388 wrote to memory of 112 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 83 PID 4388 wrote to memory of 112 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 83 PID 112 wrote to memory of 4296 112 x1668713.exe 84 PID 112 wrote to memory of 4296 112 x1668713.exe 84 PID 112 wrote to memory of 4296 112 x1668713.exe 84 PID 112 wrote to memory of 3632 112 x1668713.exe 91 PID 112 wrote to memory of 3632 112 x1668713.exe 91 PID 112 wrote to memory of 3632 112 x1668713.exe 91 PID 4388 wrote to memory of 2620 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 94 PID 4388 wrote to memory of 2620 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 94 PID 4388 wrote to memory of 2620 4388 fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe 94 PID 2620 wrote to memory of 3252 2620 i6206260.exe 114 PID 2620 wrote to memory of 3252 2620 i6206260.exe 114 PID 2620 wrote to memory of 3252 2620 i6206260.exe 114 PID 3252 wrote to memory of 2296 3252 oneetx.exe 133 PID 3252 wrote to memory of 2296 3252 oneetx.exe 133 PID 3252 wrote to memory of 2296 3252 oneetx.exe 133 PID 3252 wrote to memory of 3872 3252 oneetx.exe 139 PID 3252 wrote to memory of 3872 3252 oneetx.exe 139 PID 3252 wrote to memory of 3872 3252 oneetx.exe 139 PID 3872 wrote to memory of 2572 3872 cmd.exe 143 PID 3872 wrote to memory of 2572 3872 cmd.exe 143 PID 3872 wrote to memory of 2572 3872 cmd.exe 143 PID 3872 wrote to memory of 4304 3872 cmd.exe 144 PID 3872 wrote to memory of 4304 3872 cmd.exe 144 PID 3872 wrote to memory of 4304 3872 cmd.exe 144 PID 3872 wrote to memory of 4392 3872 cmd.exe 145 PID 3872 wrote to memory of 4392 3872 cmd.exe 145 PID 3872 wrote to memory of 4392 3872 cmd.exe 145 PID 3872 wrote to memory of 3932 3872 cmd.exe 147 PID 3872 wrote to memory of 3932 3872 cmd.exe 147 PID 3872 wrote to memory of 3932 3872 cmd.exe 147 PID 3872 wrote to memory of 4036 3872 cmd.exe 146 PID 3872 wrote to memory of 4036 3872 cmd.exe 146 PID 3872 wrote to memory of 4036 3872 cmd.exe 146 PID 3872 wrote to memory of 1808 3872 cmd.exe 148 PID 3872 wrote to memory of 1808 3872 cmd.exe 148 PID 3872 wrote to memory of 1808 3872 cmd.exe 148 PID 3252 wrote to memory of 2100 3252 oneetx.exe 162 PID 3252 wrote to memory of 2100 3252 oneetx.exe 162 PID 3252 wrote to memory of 2100 3252 oneetx.exe 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe"C:\Users\Admin\AppData\Local\Temp\fbd9ec03aa2f54ef82e274ad36ebc2bd1f7dc1703d94f9a7f0c4dce8d5d2f24d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1668713.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1668713.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0388222.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0388222.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1711811.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h1711811.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 10844⤵
- Program crash
PID:4908
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6206260.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6206260.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 6963⤵
- Program crash
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 7803⤵
- Program crash
PID:4720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 8563⤵
- Program crash
PID:3752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 9683⤵
- Program crash
PID:4192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 9763⤵
- Program crash
PID:3368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 9763⤵
- Program crash
PID:4832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 12203⤵
- Program crash
PID:4508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 12083⤵
- Program crash
PID:2104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 13163⤵
- Program crash
PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 6364⤵
- Program crash
PID:4260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 8844⤵
- Program crash
PID:4516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 8804⤵
- Program crash
PID:2188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 9164⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 10924⤵
- Program crash
PID:3780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 11004⤵
- Program crash
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 10884⤵
- Program crash
PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 11004⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 10164⤵
- Program crash
PID:1492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 12964⤵
- Program crash
PID:2360
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2572
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4304
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4392
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:1808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 13364⤵
- Program crash
PID:1076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 6364⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 13124⤵
- Program crash
PID:1312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 13564⤵
- Program crash
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 9164⤵
- Program crash
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 9164⤵
- Program crash
PID:2208
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 15404⤵
- Program crash
PID:2144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 16284⤵
- Program crash
PID:1484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 13603⤵
- Program crash
PID:4764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3632 -ip 36321⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2620 -ip 26201⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2620 -ip 26201⤵PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2620 -ip 26201⤵PID:2256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2620 -ip 26201⤵PID:2756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2620 -ip 26201⤵PID:380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2620 -ip 26201⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2620 -ip 26201⤵PID:2584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2620 -ip 26201⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2620 -ip 26201⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2620 -ip 26201⤵PID:3564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3252 -ip 32521⤵PID:1792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3252 -ip 32521⤵PID:5036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3252 -ip 32521⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3252 -ip 32521⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3252 -ip 32521⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3252 -ip 32521⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3252 -ip 32521⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3252 -ip 32521⤵PID:2800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3252 -ip 32521⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3252 -ip 32521⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3252 -ip 32521⤵PID:4584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3252 -ip 32521⤵PID:4740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3252 -ip 32521⤵PID:1256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3252 -ip 32521⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 3202⤵
- Program crash
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4436 -ip 44361⤵PID:2192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3252 -ip 32521⤵PID:1604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3252 -ip 32521⤵PID:4272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3252 -ip 32521⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 3122⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4820 -ip 48201⤵PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3252 -ip 32521⤵PID:4764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
383KB
MD5b9bbb1369f5cc3ef01b96015ff230d3a
SHA118a974606e21b6d727cef7869fff3a67fa60492d
SHA256f88bd129dfe64e1a56518bc21fc884c102af965c10c1f9477dab553fdf80885a
SHA5126306f510b7cf830794dcbaee2407386081c2932d8b9aa6340d09beeb0e5dc82744a1cd7892bfd09a4c35474af337a00a7a55422193981927e21ce75346f3c99d
-
Filesize
383KB
MD5b9bbb1369f5cc3ef01b96015ff230d3a
SHA118a974606e21b6d727cef7869fff3a67fa60492d
SHA256f88bd129dfe64e1a56518bc21fc884c102af965c10c1f9477dab553fdf80885a
SHA5126306f510b7cf830794dcbaee2407386081c2932d8b9aa6340d09beeb0e5dc82744a1cd7892bfd09a4c35474af337a00a7a55422193981927e21ce75346f3c99d
-
Filesize
168KB
MD51f86ddcddfe0771846550fc7ba1b22ec
SHA1dfdee3f353731bdad4a16ea2125b7a4f59e85a93
SHA2561616b1457cc848e40cfe0102161097423eeea4f6adbd9d941ffd2d9f92ec965c
SHA512bd066a931d036c0aceb1defdd29d875f77628510b91481b76d3f4c38fbc237745cd46f4cf0a4fb2392bf7c9eafdc12a98f91ece9050eec195cd4caaeddc8eae7
-
Filesize
168KB
MD51f86ddcddfe0771846550fc7ba1b22ec
SHA1dfdee3f353731bdad4a16ea2125b7a4f59e85a93
SHA2561616b1457cc848e40cfe0102161097423eeea4f6adbd9d941ffd2d9f92ec965c
SHA512bd066a931d036c0aceb1defdd29d875f77628510b91481b76d3f4c38fbc237745cd46f4cf0a4fb2392bf7c9eafdc12a98f91ece9050eec195cd4caaeddc8eae7
-
Filesize
292KB
MD535082b65c6fb6360e95c2238a30d5f1b
SHA1f62bf094d46e5e236f100c76283d5816e784d4c1
SHA256cb4d374972b57b45030c9bce1cf7511b51695a4d2c56640262cc22e6213ebcfd
SHA51217a7c82c6b407287d9c02b2a519003427e5c12bde25c99e79cab08fbca0690f9c2f6cec67ae99c8b07b8696c200b457d8788a15b418df00722d3d39ff85230ba
-
Filesize
292KB
MD535082b65c6fb6360e95c2238a30d5f1b
SHA1f62bf094d46e5e236f100c76283d5816e784d4c1
SHA256cb4d374972b57b45030c9bce1cf7511b51695a4d2c56640262cc22e6213ebcfd
SHA51217a7c82c6b407287d9c02b2a519003427e5c12bde25c99e79cab08fbca0690f9c2f6cec67ae99c8b07b8696c200b457d8788a15b418df00722d3d39ff85230ba
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
271KB
MD55dc4fa74a25a00464fce8c09714cc576
SHA18c0523bd8b059979fa96af7109693c9457b183ea
SHA2567926d35fed3fa249e5b02b6040383594ad7c4d9ccc7ae1fdea762cc49c891777
SHA512979250c5d8946e05ffcb4c1ffc56d6f44752c90a2ebe7ec767ad9efe5e5d2e9b78eab293c0a67b493f09c377da4e3319f86cb1a9de5d29a6e720f4b7ec61dfa0
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5