Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2023, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe
Resource
win10v2004-20230220-en
General
-
Target
1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe
-
Size
643KB
-
MD5
6f562811f9e2b48e8d1c2e4a1ee454a9
-
SHA1
9ece8dc06ed22ae61bc91cc54f406cdc587828ab
-
SHA256
1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f
-
SHA512
c262927b45e9cbe40087b4303192bd82d9e6914ddd7c9410c641099602c7d87dd88a99648272c0ad5db336b07158b1d73a153e2499426f7e9cff690ed900b377
-
SSDEEP
12288:VMr3y90ko1v6FpTV+3oCexcSZGIa5RaujYGwvMOvtaFiqyU2U:yy61v6HxHC0cSZkTauQaoa
Malware Config
Extracted
redline
darm
217.196.96.56:4138
-
auth_value
d88ac8ccc04ab9979b04b46313db1648
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h8590112.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h8590112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h8590112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h8590112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h8590112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h8590112.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation i3223784.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 1660 x7752826.exe 448 g3913895.exe 208 h8590112.exe 4072 i3223784.exe 5104 oneetx.exe 1716 oneetx.exe 920 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2696 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h8590112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h8590112.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x7752826.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x7752826.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 4948 208 WerFault.exe 87 4840 4072 WerFault.exe 91 968 4072 WerFault.exe 91 4740 4072 WerFault.exe 91 4296 4072 WerFault.exe 91 2984 4072 WerFault.exe 91 2840 4072 WerFault.exe 91 3620 4072 WerFault.exe 91 2056 4072 WerFault.exe 91 1168 4072 WerFault.exe 91 1920 4072 WerFault.exe 91 3664 5104 WerFault.exe 110 3804 5104 WerFault.exe 110 2608 5104 WerFault.exe 110 1016 5104 WerFault.exe 110 4860 5104 WerFault.exe 110 2180 5104 WerFault.exe 110 216 5104 WerFault.exe 110 2932 5104 WerFault.exe 110 4588 5104 WerFault.exe 110 1504 5104 WerFault.exe 110 4480 5104 WerFault.exe 110 1268 5104 WerFault.exe 110 4924 5104 WerFault.exe 110 4576 1716 WerFault.exe 149 3872 5104 WerFault.exe 110 3344 5104 WerFault.exe 110 3772 5104 WerFault.exe 110 4856 920 WerFault.exe 159 5112 5104 WerFault.exe 110 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 448 g3913895.exe 448 g3913895.exe 208 h8590112.exe 208 h8590112.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 448 g3913895.exe Token: SeDebugPrivilege 208 h8590112.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4072 i3223784.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1660 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 83 PID 2440 wrote to memory of 1660 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 83 PID 2440 wrote to memory of 1660 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 83 PID 1660 wrote to memory of 448 1660 x7752826.exe 84 PID 1660 wrote to memory of 448 1660 x7752826.exe 84 PID 1660 wrote to memory of 448 1660 x7752826.exe 84 PID 1660 wrote to memory of 208 1660 x7752826.exe 87 PID 1660 wrote to memory of 208 1660 x7752826.exe 87 PID 1660 wrote to memory of 208 1660 x7752826.exe 87 PID 2440 wrote to memory of 4072 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 91 PID 2440 wrote to memory of 4072 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 91 PID 2440 wrote to memory of 4072 2440 1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe 91 PID 4072 wrote to memory of 5104 4072 i3223784.exe 110 PID 4072 wrote to memory of 5104 4072 i3223784.exe 110 PID 4072 wrote to memory of 5104 4072 i3223784.exe 110 PID 5104 wrote to memory of 1260 5104 oneetx.exe 127 PID 5104 wrote to memory of 1260 5104 oneetx.exe 127 PID 5104 wrote to memory of 1260 5104 oneetx.exe 127 PID 5104 wrote to memory of 2392 5104 oneetx.exe 133 PID 5104 wrote to memory of 2392 5104 oneetx.exe 133 PID 5104 wrote to memory of 2392 5104 oneetx.exe 133 PID 2392 wrote to memory of 1172 2392 cmd.exe 137 PID 2392 wrote to memory of 1172 2392 cmd.exe 137 PID 2392 wrote to memory of 1172 2392 cmd.exe 137 PID 2392 wrote to memory of 1460 2392 cmd.exe 138 PID 2392 wrote to memory of 1460 2392 cmd.exe 138 PID 2392 wrote to memory of 1460 2392 cmd.exe 138 PID 2392 wrote to memory of 1400 2392 cmd.exe 139 PID 2392 wrote to memory of 1400 2392 cmd.exe 139 PID 2392 wrote to memory of 1400 2392 cmd.exe 139 PID 2392 wrote to memory of 4692 2392 cmd.exe 140 PID 2392 wrote to memory of 4692 2392 cmd.exe 140 PID 2392 wrote to memory of 4692 2392 cmd.exe 140 PID 2392 wrote to memory of 4120 2392 cmd.exe 141 PID 2392 wrote to memory of 4120 2392 cmd.exe 141 PID 2392 wrote to memory of 4120 2392 cmd.exe 141 PID 2392 wrote to memory of 1924 2392 cmd.exe 142 PID 2392 wrote to memory of 1924 2392 cmd.exe 142 PID 2392 wrote to memory of 1924 2392 cmd.exe 142 PID 5104 wrote to memory of 2696 5104 oneetx.exe 156 PID 5104 wrote to memory of 2696 5104 oneetx.exe 156 PID 5104 wrote to memory of 2696 5104 oneetx.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe"C:\Users\Admin\AppData\Local\Temp\1ea36e1bb2e4c1b9f15e19adbcc7443ccb74b272820551b9f7672dc3b2ab2e5f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7752826.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7752826.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3913895.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3913895.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8590112.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8590112.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 10804⤵
- Program crash
PID:4948
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3223784.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3223784.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 6963⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 7643⤵
- Program crash
PID:968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 7643⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 8643⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 10083⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 10083⤵
- Program crash
PID:2840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 12203⤵
- Program crash
PID:3620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 12363⤵
- Program crash
PID:2056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 13283⤵
- Program crash
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6924⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8564⤵
- Program crash
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 9124⤵
- Program crash
PID:2608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 10604⤵
- Program crash
PID:1016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 10604⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 10604⤵
- Program crash
PID:2180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 10844⤵
- Program crash
PID:216
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 9964⤵
- Program crash
PID:2932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 13204⤵
- Program crash
PID:4588
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1172
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1460
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4692
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4120
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:1924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8804⤵
- Program crash
PID:1504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 7604⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 13324⤵
- Program crash
PID:1268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 13244⤵
- Program crash
PID:4924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 11324⤵
- Program crash
PID:3872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 16164⤵
- Program crash
PID:3344
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 11324⤵
- Program crash
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 16284⤵
- Program crash
PID:5112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 7963⤵
- Program crash
PID:1920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 208 -ip 2081⤵PID:8
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4072 -ip 40721⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4072 -ip 40721⤵PID:3840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4072 -ip 40721⤵PID:2404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4072 -ip 40721⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4072 -ip 40721⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4072 -ip 40721⤵PID:4644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4072 -ip 40721⤵PID:648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4072 -ip 40721⤵PID:3772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4072 -ip 40721⤵PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4072 -ip 40721⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5104 -ip 51041⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5104 -ip 51041⤵PID:5020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5104 -ip 51041⤵PID:2152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5104 -ip 51041⤵PID:3640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5104 -ip 51041⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5104 -ip 51041⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5104 -ip 51041⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5104 -ip 51041⤵PID:2248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5104 -ip 51041⤵PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5104 -ip 51041⤵PID:3936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5104 -ip 51041⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5104 -ip 51041⤵PID:4964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5104 -ip 51041⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 3122⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1716 -ip 17161⤵PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5104 -ip 51041⤵PID:2360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5104 -ip 51041⤵PID:2580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5104 -ip 51041⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 3162⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 920 -ip 9201⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5104 -ip 51041⤵PID:5108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
384KB
MD55db7a6afd7bf8d92f74aa9379fb32045
SHA15c45ddd6f7e3ee21a725126e4e1ac3f1868a7bc9
SHA25612cee0ec995e26c6899d19aa329a0dc29e352994047a15a940f495abbffaf231
SHA512d177de7b9effd4cfc2ecb95a5c1df3acc0852f8d73566dd4f059cb7f85f03a70e6c5ed6365734c6497c3b43444ed13798d86dc71ecaba091946728a0c899ff30
-
Filesize
384KB
MD55db7a6afd7bf8d92f74aa9379fb32045
SHA15c45ddd6f7e3ee21a725126e4e1ac3f1868a7bc9
SHA25612cee0ec995e26c6899d19aa329a0dc29e352994047a15a940f495abbffaf231
SHA512d177de7b9effd4cfc2ecb95a5c1df3acc0852f8d73566dd4f059cb7f85f03a70e6c5ed6365734c6497c3b43444ed13798d86dc71ecaba091946728a0c899ff30
-
Filesize
168KB
MD5a5b031a9ccab62ba5f61aa50a88a3f67
SHA13d41b982726069cc55d0166404c41bab3274d397
SHA256089a88f0aa686836d23ebf5edbdc25d681857a401f020ea35511deb87a2f2e03
SHA5125da29a2f48b00c3300478c6287942115091828a5c93f2e2ab99c03ea107a5e9195bb7e0f9b742f50762e10ce9a8dfd586a3290c1a0d00419b9c9dac0a2a0c785
-
Filesize
168KB
MD5a5b031a9ccab62ba5f61aa50a88a3f67
SHA13d41b982726069cc55d0166404c41bab3274d397
SHA256089a88f0aa686836d23ebf5edbdc25d681857a401f020ea35511deb87a2f2e03
SHA5125da29a2f48b00c3300478c6287942115091828a5c93f2e2ab99c03ea107a5e9195bb7e0f9b742f50762e10ce9a8dfd586a3290c1a0d00419b9c9dac0a2a0c785
-
Filesize
292KB
MD561a787b8c95cbf5790365d43fea98e85
SHA14aaea8a3c184062641cbdb549396da51e8af0ca7
SHA256b5b5554888ad50b59344bbf85601e63dbe71fe796eb678994d5358ed58d9d5d4
SHA512f8c3135b8d7d5e2de52dbfbd1c20d3830a232ef2cd703f84e872176c8c1bc335e13d119e78c090b56de0865fe591c9b4d1c7ab6e438741654523c896fe8ea9c8
-
Filesize
292KB
MD561a787b8c95cbf5790365d43fea98e85
SHA14aaea8a3c184062641cbdb549396da51e8af0ca7
SHA256b5b5554888ad50b59344bbf85601e63dbe71fe796eb678994d5358ed58d9d5d4
SHA512f8c3135b8d7d5e2de52dbfbd1c20d3830a232ef2cd703f84e872176c8c1bc335e13d119e78c090b56de0865fe591c9b4d1c7ab6e438741654523c896fe8ea9c8
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
271KB
MD5b8338b896cc0810dd9a8603d054b850f
SHA12d1fb9ec807d5e2d9ff45e7f4245cc5e34298b63
SHA256bccbab3e0961070d507fde310abf01a904e8b4030a341191c45c064e83630ce9
SHA512da0818ccb0100404ee150a1f005912e9c2a8c0e11c5b805ae8029aa8bfaf2fe85cf00e87a35db5cbd5a58296121d03c9e0d70aa7972db4028e653fbc2ba265ea
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5