9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe
Size

708KB
MD5

f24a2d8815208c059d798757ef09baff
SHA1

f8ea04e737bcba19239a97230234e1ba7466edae
SHA256

9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99
SHA512

f271f28f3df2c811b268757edb17c8a01d847f3b366b00fed09e9d969e2f772acca8f683b60baadae34586f2d01c8ecb9e30cbdf751d3642aacf91f1d5c75a60
SSDEEP

12288:9MrSy90TKlIwmCMtuyqqNBB1WH/vMy7SK+ez6I255eLhR:LyEEMcc1S/vMy7UT8LhR

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h4433355.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h4433355.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h4433355.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h4433355.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h4433355.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h4433355.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	i2530221.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 7 IoCs

pid	Process
3084	x5681502.exe
4032	g6386394.exe
3692	h4433355.exe
3076	i2530221.exe
2152	oneetx.exe
3960	oneetx.exe
4004	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
1828	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h4433355.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h4433355.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x5681502.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x5681502.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
3868	3692	WerFault.exe	92
4640	3076	WerFault.exe	98
4888	3076	WerFault.exe	98
2104	3076	WerFault.exe	98
4092	3076	WerFault.exe	98
1432	3076	WerFault.exe	98
2252	3076	WerFault.exe	98
4280	3076	WerFault.exe	98
5056	3076	WerFault.exe	98
1716	3076	WerFault.exe	98
240	3076	WerFault.exe	98
224	2152	WerFault.exe	118
4976	2152	WerFault.exe	118
1800	2152	WerFault.exe	118
2404	2152	WerFault.exe	118
2132	2152	WerFault.exe	118
3248	2152	WerFault.exe	118
4768	2152	WerFault.exe	118
4468	2152	WerFault.exe	118
1476	2152	WerFault.exe	118
1980	2152	WerFault.exe	118
3644	2152	WerFault.exe	118
3736	2152	WerFault.exe	118
2120	2152	WerFault.exe	118
4100	2152	WerFault.exe	118
4780	3960	WerFault.exe	159
1432	2152	WerFault.exe	118
5056	2152	WerFault.exe	118
5016	2152	WerFault.exe	118
5080	4004	WerFault.exe	169
4564	2152	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4032	g6386394.exe
4032	g6386394.exe
3692	h4433355.exe
3692	h4433355.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	g6386394.exe
Token: SeDebugPrivilege	3692	h4433355.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3076	i2530221.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3084	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	87
PID 2240 wrote to memory of 3084	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	87
PID 2240 wrote to memory of 3084	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	87
PID 3084 wrote to memory of 4032	3084	x5681502.exe	88
PID 3084 wrote to memory of 4032	3084	x5681502.exe	88
PID 3084 wrote to memory of 4032	3084	x5681502.exe	88
PID 3084 wrote to memory of 3692	3084	x5681502.exe	92
PID 3084 wrote to memory of 3692	3084	x5681502.exe	92
PID 3084 wrote to memory of 3692	3084	x5681502.exe	92
PID 2240 wrote to memory of 3076	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	98
PID 2240 wrote to memory of 3076	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	98
PID 2240 wrote to memory of 3076	2240	9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe	98
PID 3076 wrote to memory of 2152	3076	i2530221.exe	118
PID 3076 wrote to memory of 2152	3076	i2530221.exe	118
PID 3076 wrote to memory of 2152	3076	i2530221.exe	118
PID 2152 wrote to memory of 4388	2152	oneetx.exe	137
PID 2152 wrote to memory of 4388	2152	oneetx.exe	137
PID 2152 wrote to memory of 4388	2152	oneetx.exe	137
PID 2152 wrote to memory of 4056	2152	oneetx.exe	143
PID 2152 wrote to memory of 4056	2152	oneetx.exe	143
PID 2152 wrote to memory of 4056	2152	oneetx.exe	143
PID 4056 wrote to memory of 4300	4056	cmd.exe	147
PID 4056 wrote to memory of 4300	4056	cmd.exe	147
PID 4056 wrote to memory of 4300	4056	cmd.exe	147
PID 4056 wrote to memory of 4572	4056	cmd.exe	148
PID 4056 wrote to memory of 4572	4056	cmd.exe	148
PID 4056 wrote to memory of 4572	4056	cmd.exe	148
PID 4056 wrote to memory of 1412	4056	cmd.exe	149
PID 4056 wrote to memory of 1412	4056	cmd.exe	149
PID 4056 wrote to memory of 1412	4056	cmd.exe	149
PID 4056 wrote to memory of 2060	4056	cmd.exe	150
PID 4056 wrote to memory of 2060	4056	cmd.exe	150
PID 4056 wrote to memory of 2060	4056	cmd.exe	150
PID 4056 wrote to memory of 5044	4056	cmd.exe	151
PID 4056 wrote to memory of 5044	4056	cmd.exe	151
PID 4056 wrote to memory of 5044	4056	cmd.exe	151
PID 4056 wrote to memory of 3868	4056	cmd.exe	152
PID 4056 wrote to memory of 3868	4056	cmd.exe	152
PID 4056 wrote to memory of 3868	4056	cmd.exe	152
PID 2152 wrote to memory of 1828	2152	oneetx.exe	166
PID 2152 wrote to memory of 1828	2152	oneetx.exe	166
PID 2152 wrote to memory of 1828	2152	oneetx.exe	166

C:\Users\Admin\AppData\Local\Temp\9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe
"C:\Users\Admin\AppData\Local\Temp\9ef48a28b41de3fca719dd61a55e7fc63a61789c9a9c693f387fb674efe8fd99.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5681502.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5681502.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6386394.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6386394.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4433355.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4433355.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 1012
      4⤵
      Program crash
      PID:3868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2530221.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2530221.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 696
    3⤵
    - Program crash
    PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 764
    3⤵
    - Program crash
    PID:4888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 856
    3⤵
    - Program crash
    PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 864
    3⤵
    - Program crash
    PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 860
    3⤵
    - Program crash
    PID:1432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 856
    3⤵
    - Program crash
    PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1216
    3⤵
    - Program crash
    PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1244
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1316
    3⤵
    - Program crash
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 692
      4⤵
      Program crash
      PID:224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1004
      4⤵
      Program crash
      PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1012
      4⤵
      Program crash
      PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1088
      4⤵
      Program crash
      PID:2404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1096
      4⤵
      Program crash
      PID:2132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1124
      4⤵
      Program crash
      PID:3248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1120
      4⤵
      Program crash
      PID:4768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1140
      4⤵
      Program crash
      PID:4468
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 992
      4⤵
      Program crash
      PID:1476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 780
      4⤵
      Program crash
      PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4300
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4572
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:1412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2060
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:5044
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:3868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1268
      4⤵
      Program crash
      PID:3644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 780
      4⤵
      Program crash
      PID:3736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 132
      4⤵
      Program crash
      PID:2120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1248
      4⤵
      Program crash
      PID:4100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1136
      4⤵
      Program crash
      PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1616
      4⤵
      Program crash
      PID:5056
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1152
      4⤵
      Program crash
      PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 1608
      4⤵
      Program crash
      PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 1356
    3⤵
    - Program crash
    PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3692 -ip 3692
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3076 -ip 3076
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3076 -ip 3076
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3076 -ip 3076
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3076 -ip 3076
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3076 -ip 3076
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3076 -ip 3076
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3076 -ip 3076
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3076 -ip 3076
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3076 -ip 3076
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3076 -ip 3076
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2152 -ip 2152
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2152 -ip 2152
1⤵
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2152 -ip 2152
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2152 -ip 2152
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2152 -ip 2152
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2152 -ip 2152
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2152 -ip 2152
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2152 -ip 2152
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2152 -ip 2152
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2152 -ip 2152
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2152 -ip 2152
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2152 -ip 2152
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2152 -ip 2152
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2152 -ip 2152
1⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:3960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 320
  2⤵
  - Program crash
  PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3960 -ip 3960
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2152 -ip 2152
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2152 -ip 2152
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2152 -ip 2152
1⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 320
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4004 -ip 4004
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2152 -ip 2152
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2530221.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2530221.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5681502.exe

Filesize
416KB

MD5
0dc444c3d44e7d25ec228f345456d322

SHA1
29607add6c76e6e5d12040521c95d918c7f6c7e4

SHA256
8bb3a49f6e27116b753f6d8ea26bfd122606b9e7e840844d6e296cb5728d05d9

SHA512
ec1a4f8142ab2e69a500c304a36fd5c2f3acd96640dee1e6763eccf1a29e583ba8c2bebed0c519efadab8ba4cb14f992e72c7e6a9a0271a5167276303a9a3d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5681502.exe

Filesize
416KB

MD5
0dc444c3d44e7d25ec228f345456d322

SHA1
29607add6c76e6e5d12040521c95d918c7f6c7e4

SHA256
8bb3a49f6e27116b753f6d8ea26bfd122606b9e7e840844d6e296cb5728d05d9

SHA512
ec1a4f8142ab2e69a500c304a36fd5c2f3acd96640dee1e6763eccf1a29e583ba8c2bebed0c519efadab8ba4cb14f992e72c7e6a9a0271a5167276303a9a3d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6386394.exe

Filesize
136KB

MD5
310526c50e572be1c92425d4bd0379fc

SHA1
515bc99357d82bc5774b2bc4c70d748ca735b166

SHA256
b0acdfdf41805a82631ee008520ab2baec189da765d0dec4def41a9f42ebef1f

SHA512
c5b0bccb9d7cd100ec5654ee3dc7010c58df1fb4e6537bf489382631b54e4c6ce402911fd4431e63f0d14970bc420bfe994ff61c10d79afff59194df7541de9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6386394.exe

Filesize
136KB

MD5
310526c50e572be1c92425d4bd0379fc

SHA1
515bc99357d82bc5774b2bc4c70d748ca735b166

SHA256
b0acdfdf41805a82631ee008520ab2baec189da765d0dec4def41a9f42ebef1f

SHA512
c5b0bccb9d7cd100ec5654ee3dc7010c58df1fb4e6537bf489382631b54e4c6ce402911fd4431e63f0d14970bc420bfe994ff61c10d79afff59194df7541de9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4433355.exe

Filesize
361KB

MD5
654200ab24d815dd2c80d6bae9aebc08

SHA1
fea6e9c7696908f91b29f1cc7de0ff4e6c695484

SHA256
763304e98af70eaea247f13fea3254563b3baa39f718bb0528e6e6103bb6ece3

SHA512
2e6e86ce4d5f2634758d49d1dab345631389f671864b46c7fddd9c201a314eaac91ba03fbfa225fa95275136da729448151f86a8543f0256c92c70e94a7b43d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4433355.exe

Filesize
361KB

MD5
654200ab24d815dd2c80d6bae9aebc08

SHA1
fea6e9c7696908f91b29f1cc7de0ff4e6c695484

SHA256
763304e98af70eaea247f13fea3254563b3baa39f718bb0528e6e6103bb6ece3

SHA512
2e6e86ce4d5f2634758d49d1dab345631389f671864b46c7fddd9c201a314eaac91ba03fbfa225fa95275136da729448151f86a8543f0256c92c70e94a7b43d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
499b8fb3e5d2ccfe5a5c44f5b9d16c67

SHA1
f7d339e9b05ea4ede3efb467b62ec3c46c3623e1

SHA256
cf65c4f34988072c94370c81a509078d2fe46bf1e40e69491871226e04c57a59

SHA512
90a523a701c6332bedec61110bdd1f4edd901396ce7dcd6bc9ec84c1dbbec01d644307dbf151b9376adc8d359ce40723819b3f77e244377de8e36607268a5328

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2152-224-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/2152-249-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/2152-252-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/3076-208-0x0000000002390000-0x00000000023C5000-memory.dmp

Filesize
212KB

Download
memory/3076-223-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/3692-184-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-201-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-172-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-174-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-176-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-178-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-180-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-182-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-168-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-186-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-188-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-190-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-192-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-194-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-195-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-196-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-197-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-198-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3692-200-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-170-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-202-0x0000000002580000-0x0000000002590000-memory.dmp

Filesize
64KB

Download
memory/3692-203-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/3692-167-0x0000000002730000-0x0000000002742000-memory.dmp

Filesize
72KB

Download
memory/3692-166-0x0000000000850000-0x000000000087D000-memory.dmp

Filesize
180KB

Download
memory/3960-228-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/4004-256-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/4032-153-0x0000000008860000-0x00000000088C6000-memory.dmp

Filesize
408KB

Download
memory/4032-152-0x0000000007DE0000-0x0000000007DF0000-memory.dmp

Filesize
64KB

Download
memory/4032-156-0x0000000008ED0000-0x0000000008F46000-memory.dmp

Filesize
472KB

Download
memory/4032-155-0x0000000008DB0000-0x0000000008E42000-memory.dmp

Filesize
584KB

Download
memory/4032-154-0x0000000009290000-0x0000000009834000-memory.dmp

Filesize
5.6MB

Download
memory/4032-158-0x0000000009F40000-0x000000000A46C000-memory.dmp

Filesize
5.2MB

Download
memory/4032-160-0x00000000017A0000-0x00000000017F0000-memory.dmp

Filesize
320KB

Download
memory/4032-157-0x0000000009840000-0x0000000009A02000-memory.dmp

Filesize
1.8MB

Download
memory/4032-151-0x0000000007D40000-0x0000000007D7C000-memory.dmp

Filesize
240KB

Download
memory/4032-150-0x0000000007E10000-0x0000000007F1A000-memory.dmp

Filesize
1.0MB

Download
memory/4032-149-0x0000000007CE0000-0x0000000007CF2000-memory.dmp

Filesize
72KB

Download
memory/4032-148-0x0000000008240000-0x0000000008858000-memory.dmp

Filesize
6.1MB

Download
memory/4032-147-0x0000000000FD0000-0x0000000000FF8000-memory.dmp

Filesize
160KB

Download
memory/4032-159-0x0000000009000000-0x000000000901E000-memory.dmp

Filesize
120KB

Download