Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 12:35
Static task
static1
General
-
Target
5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe
-
Size
708KB
-
MD5
cb72775bb64ed0c498e18b4e56f7f597
-
SHA1
010e9ec9e60da615373f2367e3e0dc663761803f
-
SHA256
5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8
-
SHA512
721eb6120262989e35458bc0d60ffea79952243e72a529c6fa9ddc703bd74fbd22f6a73ad467cc53d59020e976f4044455666786343c07a4bc35d9bb5964b952
-
SSDEEP
12288:MMrEy901XhZ0dGhK7ZPpvK3EhedF4xUVM3DEqN7GjsQE4UQ7rMpASvnVwz:4yK0dG07nMgedeyM3rkDoAm6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h8707623.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h8707623.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h8707623.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h8707623.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h8707623.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h8707623.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation i0176886.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 2608 x5689210.exe 4240 g3227849.exe 364 h8707623.exe 3384 i0176886.exe 4316 oneetx.exe 4248 oneetx.exe 4300 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3184 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h8707623.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h8707623.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x5689210.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x5689210.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 1552 364 WerFault.exe 85 3608 3384 WerFault.exe 92 1748 3384 WerFault.exe 92 4004 3384 WerFault.exe 92 4984 3384 WerFault.exe 92 2848 3384 WerFault.exe 92 4576 3384 WerFault.exe 92 3716 3384 WerFault.exe 92 4544 3384 WerFault.exe 92 4516 3384 WerFault.exe 92 4396 3384 WerFault.exe 92 4232 4316 WerFault.exe 111 4044 4316 WerFault.exe 111 4652 4316 WerFault.exe 111 440 4316 WerFault.exe 111 2424 4316 WerFault.exe 111 2816 4316 WerFault.exe 111 4816 4316 WerFault.exe 111 2700 4316 WerFault.exe 111 2996 4316 WerFault.exe 111 2472 4316 WerFault.exe 111 3508 4316 WerFault.exe 111 3140 4316 WerFault.exe 111 664 4316 WerFault.exe 111 920 4248 WerFault.exe 152 4484 4316 WerFault.exe 111 924 4316 WerFault.exe 111 4544 4316 WerFault.exe 111 1224 4300 WerFault.exe 165 4512 4316 WerFault.exe 111 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4240 g3227849.exe 4240 g3227849.exe 364 h8707623.exe 364 h8707623.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4240 g3227849.exe Token: SeDebugPrivilege 364 h8707623.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3384 i0176886.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5012 wrote to memory of 2608 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 83 PID 5012 wrote to memory of 2608 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 83 PID 5012 wrote to memory of 2608 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 83 PID 2608 wrote to memory of 4240 2608 x5689210.exe 84 PID 2608 wrote to memory of 4240 2608 x5689210.exe 84 PID 2608 wrote to memory of 4240 2608 x5689210.exe 84 PID 2608 wrote to memory of 364 2608 x5689210.exe 85 PID 2608 wrote to memory of 364 2608 x5689210.exe 85 PID 2608 wrote to memory of 364 2608 x5689210.exe 85 PID 5012 wrote to memory of 3384 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 92 PID 5012 wrote to memory of 3384 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 92 PID 5012 wrote to memory of 3384 5012 5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe 92 PID 3384 wrote to memory of 4316 3384 i0176886.exe 111 PID 3384 wrote to memory of 4316 3384 i0176886.exe 111 PID 3384 wrote to memory of 4316 3384 i0176886.exe 111 PID 4316 wrote to memory of 1580 4316 oneetx.exe 129 PID 4316 wrote to memory of 1580 4316 oneetx.exe 129 PID 4316 wrote to memory of 1580 4316 oneetx.exe 129 PID 4316 wrote to memory of 1064 4316 oneetx.exe 135 PID 4316 wrote to memory of 1064 4316 oneetx.exe 135 PID 4316 wrote to memory of 1064 4316 oneetx.exe 135 PID 1064 wrote to memory of 4540 1064 cmd.exe 139 PID 1064 wrote to memory of 4540 1064 cmd.exe 139 PID 1064 wrote to memory of 4540 1064 cmd.exe 139 PID 1064 wrote to memory of 1444 1064 cmd.exe 140 PID 1064 wrote to memory of 1444 1064 cmd.exe 140 PID 1064 wrote to memory of 1444 1064 cmd.exe 140 PID 1064 wrote to memory of 5088 1064 cmd.exe 141 PID 1064 wrote to memory of 5088 1064 cmd.exe 141 PID 1064 wrote to memory of 5088 1064 cmd.exe 141 PID 1064 wrote to memory of 3132 1064 cmd.exe 142 PID 1064 wrote to memory of 3132 1064 cmd.exe 142 PID 1064 wrote to memory of 3132 1064 cmd.exe 142 PID 1064 wrote to memory of 2308 1064 cmd.exe 143 PID 1064 wrote to memory of 2308 1064 cmd.exe 143 PID 1064 wrote to memory of 2308 1064 cmd.exe 143 PID 1064 wrote to memory of 2932 1064 cmd.exe 144 PID 1064 wrote to memory of 2932 1064 cmd.exe 144 PID 1064 wrote to memory of 2932 1064 cmd.exe 144 PID 4316 wrote to memory of 3184 4316 oneetx.exe 162 PID 4316 wrote to memory of 3184 4316 oneetx.exe 162 PID 4316 wrote to memory of 3184 4316 oneetx.exe 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe"C:\Users\Admin\AppData\Local\Temp\5ab1b3850e3fec00145fc6df6de8695d93274053bf2fd53e3a4b9f41ef4a10e8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5689210.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5689210.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3227849.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3227849.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8707623.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8707623.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 10804⤵
- Program crash
PID:1552
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0176886.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0176886.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 6963⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 7923⤵
- Program crash
PID:1748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 7483⤵
- Program crash
PID:4004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 9603⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 8043⤵
- Program crash
PID:2848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 8043⤵
- Program crash
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 12203⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 12363⤵
- Program crash
PID:4544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 13163⤵
- Program crash
PID:4516
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 6924⤵
- Program crash
PID:4232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 8844⤵
- Program crash
PID:4044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 9404⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 10964⤵
- Program crash
PID:440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 10764⤵
- Program crash
PID:2424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 10764⤵
- Program crash
PID:2816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 8884⤵
- Program crash
PID:4816
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 9324⤵
- Program crash
PID:2700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 7764⤵
- Program crash
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4540
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1444
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:2308
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:2932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 7284⤵
- Program crash
PID:2472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 7764⤵
- Program crash
PID:3508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 7804⤵
- Program crash
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 13284⤵
- Program crash
PID:664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 11124⤵
- Program crash
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 16204⤵
- Program crash
PID:924
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 15564⤵
- Program crash
PID:4544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 16284⤵
- Program crash
PID:4512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 13763⤵
- Program crash
PID:4396
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 364 -ip 3641⤵PID:3052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3384 -ip 33841⤵PID:980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3384 -ip 33841⤵PID:1772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3384 -ip 33841⤵PID:3664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3384 -ip 33841⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3384 -ip 33841⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3384 -ip 33841⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3384 -ip 33841⤵PID:4688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3384 -ip 33841⤵PID:460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3384 -ip 33841⤵PID:3244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3384 -ip 33841⤵PID:3536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4316 -ip 43161⤵PID:3724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4316 -ip 43161⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4316 -ip 43161⤵PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4316 -ip 43161⤵PID:2164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4316 -ip 43161⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4316 -ip 43161⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4316 -ip 43161⤵PID:540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4316 -ip 43161⤵PID:1500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4316 -ip 43161⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4316 -ip 43161⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4316 -ip 43161⤵PID:2460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4316 -ip 43161⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4316 -ip 43161⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 3122⤵
- Program crash
PID:920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4248 -ip 42481⤵PID:3052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4316 -ip 43161⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4316 -ip 43161⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4316 -ip 43161⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 3122⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4300 -ip 43001⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4316 -ip 43161⤵PID:2536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
416KB
MD5734e765b4e967ecb94ed401740d1f34f
SHA14bdc70d273e3c6ba35bcd361dfce69d885b036ae
SHA2560bf851ec1436869f3b145fd16b2e3f9fc3b2e75232df05dc8ec94d284e56b4e0
SHA512a87027c58e743a7df0e62f4568245b137cf60cf0e4a8731522298ae9287e877ac3bf0c42da0c25d67e9e78d072c7e808eb5653f039fd7e1f0d26412650f9d536
-
Filesize
416KB
MD5734e765b4e967ecb94ed401740d1f34f
SHA14bdc70d273e3c6ba35bcd361dfce69d885b036ae
SHA2560bf851ec1436869f3b145fd16b2e3f9fc3b2e75232df05dc8ec94d284e56b4e0
SHA512a87027c58e743a7df0e62f4568245b137cf60cf0e4a8731522298ae9287e877ac3bf0c42da0c25d67e9e78d072c7e808eb5653f039fd7e1f0d26412650f9d536
-
Filesize
136KB
MD523e36b8342c31b6be931821a7553cb20
SHA1a1036f2cb221da4063a3ee94c38de6ca1ed7d713
SHA2563fe1df7898f6fdf607f75083d9b130cf5299c29e30b53be3cc2f5035cc27bb93
SHA5123b78d1ee3de1351a190da7675fe9a8277bb7927309e393dc479389f56ba20948417644992fd69c6d172fef92ca477412550799613b3303962133ed361b35b4ed
-
Filesize
136KB
MD523e36b8342c31b6be931821a7553cb20
SHA1a1036f2cb221da4063a3ee94c38de6ca1ed7d713
SHA2563fe1df7898f6fdf607f75083d9b130cf5299c29e30b53be3cc2f5035cc27bb93
SHA5123b78d1ee3de1351a190da7675fe9a8277bb7927309e393dc479389f56ba20948417644992fd69c6d172fef92ca477412550799613b3303962133ed361b35b4ed
-
Filesize
361KB
MD54e61f8b71b992fc1660b95e8b8ca1aeb
SHA115ea64e1c0ca8ff7dfc55b2190e11907932a22b9
SHA25620e897f9fea669d9407dc90fe8cbccdd4d90f3c27794cc30688ba3f30daeafbe
SHA51275f26280758a66e77da3998532e90dee4787790c11a4b33d2935a9ca6e2ae5da53ef6337a997e12e33d5c7048d3c52b02a70dd1d0c28c154194ca1ad828baf4e
-
Filesize
361KB
MD54e61f8b71b992fc1660b95e8b8ca1aeb
SHA115ea64e1c0ca8ff7dfc55b2190e11907932a22b9
SHA25620e897f9fea669d9407dc90fe8cbccdd4d90f3c27794cc30688ba3f30daeafbe
SHA51275f26280758a66e77da3998532e90dee4787790c11a4b33d2935a9ca6e2ae5da53ef6337a997e12e33d5c7048d3c52b02a70dd1d0c28c154194ca1ad828baf4e
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
340KB
MD58d8970914146d0fd05d5059d5466c9a1
SHA14f9e03b3a529563bd92b66f333894c560cbd74a8
SHA256e5ca7bc7b91a97a3ff5d4bd5025ac5a3f1af9b263d0e654ec1399ad9eb90b9bb
SHA5129d38897e5472bdb64d44f76f6cf2d98f70552f4ce3f430de1a5973c86bbb535d1a52a3ea41f643c4a9c0169415db536fb73fdbae10b6da69ace0d57ce34bf6af
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5