Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe
Resource
win10v2004-20230220-en
General
-
Target
5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe
-
Size
1.5MB
-
MD5
c052ee6e1c1371dca07e5ff7152ed337
-
SHA1
44f3048247403e26fb541f5e46da05728688b50f
-
SHA256
5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a
-
SHA512
d6dab05fba4fe2dcc2a04dcc0d89fb5c11b1cc594e99b9f499feb341397328be660ff6a7fee41ac9025911529354418f309f22813baff618365d38d4fbb87802
-
SSDEEP
24576:tyM/CuB5TNpbViJIWSmpTbIOqhq2QVov2u6UW/8lhHsxtZ5/F08Yvsf0r7GGa:IMaSTbViJXG7QVov2u6U+8aTQ4
Malware Config
Extracted
redline
boom
217.196.96.56:4138
-
auth_value
1ce6aebe15bac07a7bc88b114bc49335
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" d7552660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" d7552660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" d7552660.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" d7552660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" d7552660.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a5573154.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation c5788704.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation e3114816.exe -
Executes dropped EXE 14 IoCs
pid Process 1844 v5604087.exe 3920 v0104839.exe 752 v5428357.exe 440 v3317162.exe 976 a5573154.exe 2988 b2675214.exe 1652 c5788704.exe 2056 oneetx.exe 2404 d7552660.exe 1808 e3114816.exe 1356 1.exe 1000 f7786510.exe 4700 oneetx.exe 4288 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4672 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a5573154.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" d7552660.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5604087.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0104839.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v0104839.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v5428357.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v5428357.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v5604087.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3317162.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" v3317162.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 31 IoCs
pid pid_target Process procid_target 2632 976 WerFault.exe 88 5000 1652 WerFault.exe 101 4672 1652 WerFault.exe 101 1904 1652 WerFault.exe 101 4288 1652 WerFault.exe 101 4484 1652 WerFault.exe 101 2264 1652 WerFault.exe 101 3976 1652 WerFault.exe 101 4788 1652 WerFault.exe 101 3992 1652 WerFault.exe 101 1636 1652 WerFault.exe 101 776 2056 WerFault.exe 121 652 2056 WerFault.exe 121 2632 2056 WerFault.exe 121 756 2056 WerFault.exe 121 2324 2056 WerFault.exe 121 3008 2056 WerFault.exe 121 1196 2056 WerFault.exe 121 2128 2056 WerFault.exe 121 3484 2056 WerFault.exe 121 4480 2056 WerFault.exe 121 3740 2056 WerFault.exe 121 3580 2056 WerFault.exe 121 4344 2056 WerFault.exe 121 1032 1808 WerFault.exe 161 756 2056 WerFault.exe 121 2724 4700 WerFault.exe 168 4312 2056 WerFault.exe 121 3028 2056 WerFault.exe 121 3196 2056 WerFault.exe 121 2088 4288 WerFault.exe 178 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 976 a5573154.exe 976 a5573154.exe 2988 b2675214.exe 2988 b2675214.exe 2404 d7552660.exe 2404 d7552660.exe 1356 1.exe 1356 1.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 976 a5573154.exe Token: SeDebugPrivilege 2988 b2675214.exe Token: SeDebugPrivilege 2404 d7552660.exe Token: SeDebugPrivilege 1808 e3114816.exe Token: SeDebugPrivilege 1356 1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1652 c5788704.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1844 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 84 PID 3968 wrote to memory of 1844 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 84 PID 3968 wrote to memory of 1844 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 84 PID 1844 wrote to memory of 3920 1844 v5604087.exe 85 PID 1844 wrote to memory of 3920 1844 v5604087.exe 85 PID 1844 wrote to memory of 3920 1844 v5604087.exe 85 PID 3920 wrote to memory of 752 3920 v0104839.exe 86 PID 3920 wrote to memory of 752 3920 v0104839.exe 86 PID 3920 wrote to memory of 752 3920 v0104839.exe 86 PID 752 wrote to memory of 440 752 v5428357.exe 87 PID 752 wrote to memory of 440 752 v5428357.exe 87 PID 752 wrote to memory of 440 752 v5428357.exe 87 PID 440 wrote to memory of 976 440 v3317162.exe 88 PID 440 wrote to memory of 976 440 v3317162.exe 88 PID 440 wrote to memory of 976 440 v3317162.exe 88 PID 440 wrote to memory of 2988 440 v3317162.exe 100 PID 440 wrote to memory of 2988 440 v3317162.exe 100 PID 440 wrote to memory of 2988 440 v3317162.exe 100 PID 752 wrote to memory of 1652 752 v5428357.exe 101 PID 752 wrote to memory of 1652 752 v5428357.exe 101 PID 752 wrote to memory of 1652 752 v5428357.exe 101 PID 1652 wrote to memory of 2056 1652 c5788704.exe 121 PID 1652 wrote to memory of 2056 1652 c5788704.exe 121 PID 1652 wrote to memory of 2056 1652 c5788704.exe 121 PID 3920 wrote to memory of 2404 3920 v0104839.exe 124 PID 3920 wrote to memory of 2404 3920 v0104839.exe 124 PID 3920 wrote to memory of 2404 3920 v0104839.exe 124 PID 2056 wrote to memory of 4076 2056 oneetx.exe 139 PID 2056 wrote to memory of 4076 2056 oneetx.exe 139 PID 2056 wrote to memory of 4076 2056 oneetx.exe 139 PID 2056 wrote to memory of 4196 2056 oneetx.exe 145 PID 2056 wrote to memory of 4196 2056 oneetx.exe 145 PID 2056 wrote to memory of 4196 2056 oneetx.exe 145 PID 4196 wrote to memory of 4588 4196 cmd.exe 149 PID 4196 wrote to memory of 4588 4196 cmd.exe 149 PID 4196 wrote to memory of 4588 4196 cmd.exe 149 PID 4196 wrote to memory of 772 4196 cmd.exe 150 PID 4196 wrote to memory of 772 4196 cmd.exe 150 PID 4196 wrote to memory of 772 4196 cmd.exe 150 PID 4196 wrote to memory of 2876 4196 cmd.exe 151 PID 4196 wrote to memory of 2876 4196 cmd.exe 151 PID 4196 wrote to memory of 2876 4196 cmd.exe 151 PID 4196 wrote to memory of 2756 4196 cmd.exe 152 PID 4196 wrote to memory of 2756 4196 cmd.exe 152 PID 4196 wrote to memory of 2756 4196 cmd.exe 152 PID 4196 wrote to memory of 4184 4196 cmd.exe 153 PID 4196 wrote to memory of 4184 4196 cmd.exe 153 PID 4196 wrote to memory of 4184 4196 cmd.exe 153 PID 4196 wrote to memory of 4016 4196 cmd.exe 154 PID 4196 wrote to memory of 4016 4196 cmd.exe 154 PID 4196 wrote to memory of 4016 4196 cmd.exe 154 PID 1844 wrote to memory of 1808 1844 v5604087.exe 161 PID 1844 wrote to memory of 1808 1844 v5604087.exe 161 PID 1844 wrote to memory of 1808 1844 v5604087.exe 161 PID 1808 wrote to memory of 1356 1808 e3114816.exe 162 PID 1808 wrote to memory of 1356 1808 e3114816.exe 162 PID 1808 wrote to memory of 1356 1808 e3114816.exe 162 PID 3968 wrote to memory of 1000 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 165 PID 3968 wrote to memory of 1000 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 165 PID 3968 wrote to memory of 1000 3968 5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe 165 PID 2056 wrote to memory of 4672 2056 oneetx.exe 173 PID 2056 wrote to memory of 4672 2056 oneetx.exe 173 PID 2056 wrote to memory of 4672 2056 oneetx.exe 173
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe"C:\Users\Admin\AppData\Local\Temp\5ea6a844b38777d7279a9549c8b2f546a2ef9dde5479fcc0aa634c0f7214745a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5604087.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5604087.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0104839.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v0104839.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5428357.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5428357.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3317162.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3317162.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5573154.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5573154.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 10847⤵
- Program crash
PID:2632
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2675214.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2675214.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5788704.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5788704.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 6966⤵
- Program crash
PID:5000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 7526⤵
- Program crash
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 8566⤵
- Program crash
PID:1904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 9606⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 9806⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 9806⤵
- Program crash
PID:2264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 12166⤵
- Program crash
PID:3976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 12326⤵
- Program crash
PID:4788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 13126⤵
- Program crash
PID:3992
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 6927⤵
- Program crash
PID:776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 8447⤵
- Program crash
PID:652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 8887⤵
- Program crash
PID:2632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 10527⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 10727⤵
- Program crash
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 10887⤵
- Program crash
PID:3008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 11207⤵
- Program crash
PID:1196
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 7927⤵
- Program crash
PID:2128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 7767⤵
- Program crash
PID:3484
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4588
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"8⤵PID:772
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E8⤵PID:2876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2756
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"8⤵PID:4184
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E8⤵PID:4016
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 12967⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 12687⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 7687⤵
- Program crash
PID:3580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 7927⤵
- Program crash
PID:4344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 10647⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 13767⤵
- Program crash
PID:4312
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 10647⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 16287⤵
- Program crash
PID:3196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 14126⤵
- Program crash
PID:1636
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d7552660.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\d7552660.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3114816.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\e3114816.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 13724⤵
- Program crash
PID:1032
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f7786510.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\f7786510.exe2⤵
- Executes dropped EXE
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 976 -ip 9761⤵PID:4364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 16521⤵PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1652 -ip 16521⤵PID:1424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1652 -ip 16521⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1652 -ip 16521⤵PID:3028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1652 -ip 16521⤵PID:2444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1652 -ip 16521⤵PID:1312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1652 -ip 16521⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1652 -ip 16521⤵PID:3904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1652 -ip 16521⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1652 -ip 16521⤵PID:912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2056 -ip 20561⤵PID:2384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2056 -ip 20561⤵PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2056 -ip 20561⤵PID:4372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2056 -ip 20561⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2056 -ip 20561⤵PID:1468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2056 -ip 20561⤵PID:3972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2056 -ip 20561⤵PID:512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2056 -ip 20561⤵PID:2016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2056 -ip 20561⤵PID:3004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2056 -ip 20561⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2056 -ip 20561⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2056 -ip 20561⤵PID:1888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2056 -ip 20561⤵PID:3904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1808 -ip 18081⤵PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2056 -ip 20561⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 3202⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4700 -ip 47001⤵PID:2160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2056 -ip 20561⤵PID:1424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2056 -ip 20561⤵PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2056 -ip 20561⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 3162⤵
- Program crash
PID:2088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4288 -ip 42881⤵PID:4264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5a6da3940b681c8321606d36a3fb9e940
SHA12119019cf73dc3f4ef520e9eba9d857580f9b7df
SHA256a85d352429389aeaf210e4e688c84334134b9f43ee7d2622d66dd1bdeb4bb9fd
SHA512b25ad0e3549a0f1aab0f7fea2f333081d3abe289857898f9001188320082f80677a96eeed8bf9e77c471a3cc16f7bde3fdd44abef0d34f05aab5aea311a5278a
-
Filesize
204KB
MD5a6da3940b681c8321606d36a3fb9e940
SHA12119019cf73dc3f4ef520e9eba9d857580f9b7df
SHA256a85d352429389aeaf210e4e688c84334134b9f43ee7d2622d66dd1bdeb4bb9fd
SHA512b25ad0e3549a0f1aab0f7fea2f333081d3abe289857898f9001188320082f80677a96eeed8bf9e77c471a3cc16f7bde3fdd44abef0d34f05aab5aea311a5278a
-
Filesize
1.4MB
MD5c488463c02444acfb5cc9955e53171f8
SHA10c2b9115f162baef1433e1ba94f88deebd3e8a01
SHA256da9f275aa37841c0bc7ec09d97b38bb7223bdefe2208005151cb411422c33394
SHA512d48899187ba0c544af72dacdf273f6ea16dbd7704b15811b38e7c9be4248401a7ee9b87a6ebba4e55388af4bf163f9a282fc88868f430ff21985eb2bfb44900e
-
Filesize
1.4MB
MD5c488463c02444acfb5cc9955e53171f8
SHA10c2b9115f162baef1433e1ba94f88deebd3e8a01
SHA256da9f275aa37841c0bc7ec09d97b38bb7223bdefe2208005151cb411422c33394
SHA512d48899187ba0c544af72dacdf273f6ea16dbd7704b15811b38e7c9be4248401a7ee9b87a6ebba4e55388af4bf163f9a282fc88868f430ff21985eb2bfb44900e
-
Filesize
547KB
MD59a9613bb1622790ee39a174d6b5b435e
SHA1cec0c5217b227de27bd2a17b3c62a49cf8eb1797
SHA2562600d49d88e352a617f81b14bda54ae2d41d314f95375915db94f660b20e8db0
SHA512abf06650b9ae0db6fc34a5f3331ba19bc596f2a8cf139b1d254ce3e5613429321ffeb93874d39397fd8f3fa367ea83491a318e4960bc962c1d7ee44165086041
-
Filesize
547KB
MD59a9613bb1622790ee39a174d6b5b435e
SHA1cec0c5217b227de27bd2a17b3c62a49cf8eb1797
SHA2562600d49d88e352a617f81b14bda54ae2d41d314f95375915db94f660b20e8db0
SHA512abf06650b9ae0db6fc34a5f3331ba19bc596f2a8cf139b1d254ce3e5613429321ffeb93874d39397fd8f3fa367ea83491a318e4960bc962c1d7ee44165086041
-
Filesize
913KB
MD54f36414478b46af79c99b3a557f8fed0
SHA1a4676261d5bee51f0b92b7c328c063dc81bcf098
SHA256b46e07a21efc78d081e2bb19ae0ee74478620b65be259bccc3eb379ef0b4d213
SHA5128053ab6da55d3911f888232dee0527823ff722d6dd12daecae167bc7816d03fe91fce6579836f4ae7daa70817272d7f17917005bee68681febb0107041aa8692
-
Filesize
913KB
MD54f36414478b46af79c99b3a557f8fed0
SHA1a4676261d5bee51f0b92b7c328c063dc81bcf098
SHA256b46e07a21efc78d081e2bb19ae0ee74478620b65be259bccc3eb379ef0b4d213
SHA5128053ab6da55d3911f888232dee0527823ff722d6dd12daecae167bc7816d03fe91fce6579836f4ae7daa70817272d7f17917005bee68681febb0107041aa8692
-
Filesize
175KB
MD585425d0986488a17c69ad68b7030ba90
SHA109893a9af516136ef0237f2b3c6084ea626a26e5
SHA256e4cb9beefaeec45fdbf0a4f20fafbf38fa2babf2fdd90b605f2a2a7ba71eda8d
SHA512c79d1ddf1ec0904d32efc7dcc26b61b4b761616471f844d4700b1398ebe2ef8abb1207cff80189fcdc868b92fdc573bb82ff7022383a42cf5d9e91610c631728
-
Filesize
175KB
MD585425d0986488a17c69ad68b7030ba90
SHA109893a9af516136ef0237f2b3c6084ea626a26e5
SHA256e4cb9beefaeec45fdbf0a4f20fafbf38fa2babf2fdd90b605f2a2a7ba71eda8d
SHA512c79d1ddf1ec0904d32efc7dcc26b61b4b761616471f844d4700b1398ebe2ef8abb1207cff80189fcdc868b92fdc573bb82ff7022383a42cf5d9e91610c631728
-
Filesize
709KB
MD5a9bfcca456f38c996bffbae481c0cd0a
SHA15c4642ee0be50623af1247c482f0f16ef298d5ea
SHA256a322a490d0b08da3526f3232b4143b30499b260b370f2ad6eca5cc4b9d44e532
SHA512bdc85d0fbe43000440e8d68ebcc13f52e4b23ff15b41d0e6dd53edc063e805742d58858c3072f9316409452b47b9d3d73f64265da018d0e923963bc6cf718559
-
Filesize
709KB
MD5a9bfcca456f38c996bffbae481c0cd0a
SHA15c4642ee0be50623af1247c482f0f16ef298d5ea
SHA256a322a490d0b08da3526f3232b4143b30499b260b370f2ad6eca5cc4b9d44e532
SHA512bdc85d0fbe43000440e8d68ebcc13f52e4b23ff15b41d0e6dd53edc063e805742d58858c3072f9316409452b47b9d3d73f64265da018d0e923963bc6cf718559
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
418KB
MD5dc953fef68011b8032dc418b60c534dc
SHA181525719b95f00d3bab8306b1f58992c564eecb0
SHA2569827f4d9a5aedacf3bd4df177f69ac7f33d9bfd447f0a0c6a17a10e73ce1d6ef
SHA512615a367d564ad7b561aa7b20078649750f5766f1fbef9998ebf88d0b313ff27baf7346b25bd6df9e6e26e407a7ce1e12ab1b06b0b0ae64460dbf03a7eaadcf0f
-
Filesize
418KB
MD5dc953fef68011b8032dc418b60c534dc
SHA181525719b95f00d3bab8306b1f58992c564eecb0
SHA2569827f4d9a5aedacf3bd4df177f69ac7f33d9bfd447f0a0c6a17a10e73ce1d6ef
SHA512615a367d564ad7b561aa7b20078649750f5766f1fbef9998ebf88d0b313ff27baf7346b25bd6df9e6e26e407a7ce1e12ab1b06b0b0ae64460dbf03a7eaadcf0f
-
Filesize
361KB
MD54e112262207fa060728c8bfe959ad565
SHA1f4248c5e47622ac838b94f05e53e504be4a08980
SHA256b713b86f2b5d3d55dff82c9de71c5528aae831920036ab33f5f605718eb57cbb
SHA5120e71d901b7af0e143acbb3b6431edf8711181f4c54a03da3b8ad435ab460b954615d33652d7e4543391328ef80f0474c3e3b6b425a428c71f0c33eac7a363571
-
Filesize
361KB
MD54e112262207fa060728c8bfe959ad565
SHA1f4248c5e47622ac838b94f05e53e504be4a08980
SHA256b713b86f2b5d3d55dff82c9de71c5528aae831920036ab33f5f605718eb57cbb
SHA5120e71d901b7af0e143acbb3b6431edf8711181f4c54a03da3b8ad435ab460b954615d33652d7e4543391328ef80f0474c3e3b6b425a428c71f0c33eac7a363571
-
Filesize
136KB
MD50a3c7599495498887587c6ae294045ad
SHA116e2dc03a4335d89ff80b2d4f3a70c957a579353
SHA256909d725860c28d0346313e50d32a02c1f3ac160365a52c995f0f5a95ae8c8356
SHA512e7c8237df2c1e5769cf75305822db669fdf80f2dc9a94ec7d13eb037fdd0584d8ecaf9766ce2360efeafa67e292a8c66ad948ae7b909eb631e320060f0a462b4
-
Filesize
136KB
MD50a3c7599495498887587c6ae294045ad
SHA116e2dc03a4335d89ff80b2d4f3a70c957a579353
SHA256909d725860c28d0346313e50d32a02c1f3ac160365a52c995f0f5a95ae8c8356
SHA512e7c8237df2c1e5769cf75305822db669fdf80f2dc9a94ec7d13eb037fdd0584d8ecaf9766ce2360efeafa67e292a8c66ad948ae7b909eb631e320060f0a462b4
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
340KB
MD558037b9d342b33042488292a3b8b252e
SHA1d6b5000811e42233fe31d0688d04d455e75d7de3
SHA2563da406763bfdcc7060f7cf1f4db4ec7cf808e59f6790374269380f3daece95de
SHA512c55214751c0368331f98ca5b80047e79dd1ed54d37a620345e73582900b7c58c84f414aeaa060d502cf667b83d32f4e9e31a8ecad08b3e4616a13fdab9605518
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD57070d754b720fe5162742116d8683a49
SHA1e1e928cacf55633f30125dcf2e7aa6a0e6f4172e
SHA2565eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2
SHA512cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b
-
Filesize
168KB
MD57070d754b720fe5162742116d8683a49
SHA1e1e928cacf55633f30125dcf2e7aa6a0e6f4172e
SHA2565eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2
SHA512cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b
-
Filesize
168KB
MD57070d754b720fe5162742116d8683a49
SHA1e1e928cacf55633f30125dcf2e7aa6a0e6f4172e
SHA2565eec6e9402f614e6c92a23665003ad26a2606aa0700ebe58a86557bb84f4b7a2
SHA512cb8d4382b3e9617a9bb98f3e6b1a2a15df004a33008cfbc92049e3ef588b1bf7deb3748a4262962543588e1a36ac737001c3d99659dca974bb12ff78eac9739b