Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 13:13
Static task
static1
General
-
Target
ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe
-
Size
600KB
-
MD5
adec3465767c454231b686e25466678c
-
SHA1
28a36b553e2be2c857f8669740c12db88836b664
-
SHA256
ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75
-
SHA512
0c3d20251d584a37b09e0d3b9db3c4b346e42ce19551317cb699b5a438958a79a5d297e3d46e7f2567da082ab6942ab6912120f174253ba10af1dd31a52c0da2
-
SSDEEP
12288:3Mr4y90mFWFdTkiOoX1Ivq3qPal6Mes9/FaXO6L3fqwFPTuc:Hy7rgaygalXHRFf6L3fqwZb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l0464620.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation m2024823.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 368 y8410265.exe 4388 k6073053.exe 4684 l0464620.exe 4812 m2024823.exe 3396 oneetx.exe 4492 oneetx.exe 1668 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4904 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features l0464620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" l0464620.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y8410265.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y8410265.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
pid pid_target Process procid_target 4840 4812 WerFault.exe 93 4208 4812 WerFault.exe 93 3980 4812 WerFault.exe 93 2460 4812 WerFault.exe 93 4272 4812 WerFault.exe 93 944 4812 WerFault.exe 93 3176 4812 WerFault.exe 93 4992 4812 WerFault.exe 93 2608 4812 WerFault.exe 93 1884 4812 WerFault.exe 93 3660 3396 WerFault.exe 113 1412 3396 WerFault.exe 113 2308 3396 WerFault.exe 113 332 3396 WerFault.exe 113 4056 3396 WerFault.exe 113 60 3396 WerFault.exe 113 4912 3396 WerFault.exe 113 4980 3396 WerFault.exe 113 4944 3396 WerFault.exe 113 3064 3396 WerFault.exe 113 4132 3396 WerFault.exe 113 4684 3396 WerFault.exe 113 3920 3396 WerFault.exe 113 4712 4492 WerFault.exe 153 1564 3396 WerFault.exe 113 5008 3396 WerFault.exe 113 2756 3396 WerFault.exe 113 3180 1668 WerFault.exe 164 4188 3396 WerFault.exe 113 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4388 k6073053.exe 4388 k6073053.exe 4684 l0464620.exe 4684 l0464620.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4388 k6073053.exe Token: SeDebugPrivilege 4684 l0464620.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4812 m2024823.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4644 wrote to memory of 368 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 84 PID 4644 wrote to memory of 368 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 84 PID 4644 wrote to memory of 368 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 84 PID 368 wrote to memory of 4388 368 y8410265.exe 85 PID 368 wrote to memory of 4388 368 y8410265.exe 85 PID 368 wrote to memory of 4388 368 y8410265.exe 85 PID 368 wrote to memory of 4684 368 y8410265.exe 89 PID 368 wrote to memory of 4684 368 y8410265.exe 89 PID 368 wrote to memory of 4684 368 y8410265.exe 89 PID 4644 wrote to memory of 4812 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 93 PID 4644 wrote to memory of 4812 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 93 PID 4644 wrote to memory of 4812 4644 ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe 93 PID 4812 wrote to memory of 3396 4812 m2024823.exe 113 PID 4812 wrote to memory of 3396 4812 m2024823.exe 113 PID 4812 wrote to memory of 3396 4812 m2024823.exe 113 PID 3396 wrote to memory of 1600 3396 oneetx.exe 131 PID 3396 wrote to memory of 1600 3396 oneetx.exe 131 PID 3396 wrote to memory of 1600 3396 oneetx.exe 131 PID 3396 wrote to memory of 3440 3396 oneetx.exe 137 PID 3396 wrote to memory of 3440 3396 oneetx.exe 137 PID 3396 wrote to memory of 3440 3396 oneetx.exe 137 PID 3440 wrote to memory of 4844 3440 cmd.exe 141 PID 3440 wrote to memory of 4844 3440 cmd.exe 141 PID 3440 wrote to memory of 4844 3440 cmd.exe 141 PID 3440 wrote to memory of 1568 3440 cmd.exe 142 PID 3440 wrote to memory of 1568 3440 cmd.exe 142 PID 3440 wrote to memory of 1568 3440 cmd.exe 142 PID 3440 wrote to memory of 4404 3440 cmd.exe 143 PID 3440 wrote to memory of 4404 3440 cmd.exe 143 PID 3440 wrote to memory of 4404 3440 cmd.exe 143 PID 3440 wrote to memory of 4464 3440 cmd.exe 144 PID 3440 wrote to memory of 4464 3440 cmd.exe 144 PID 3440 wrote to memory of 4464 3440 cmd.exe 144 PID 3440 wrote to memory of 1240 3440 cmd.exe 145 PID 3440 wrote to memory of 1240 3440 cmd.exe 145 PID 3440 wrote to memory of 1240 3440 cmd.exe 145 PID 3440 wrote to memory of 3748 3440 cmd.exe 146 PID 3440 wrote to memory of 3748 3440 cmd.exe 146 PID 3440 wrote to memory of 3748 3440 cmd.exe 146 PID 3396 wrote to memory of 4904 3396 oneetx.exe 161 PID 3396 wrote to memory of 4904 3396 oneetx.exe 161 PID 3396 wrote to memory of 4904 3396 oneetx.exe 161
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe"C:\Users\Admin\AppData\Local\Temp\ebe235fa7784df86594d5b5fda09bb96a4459068ce1ec67d35167570d79d5b75.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8410265.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y8410265.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6073053.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6073053.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0464620.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0464620.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2024823.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m2024823.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 6963⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 7723⤵
- Program crash
PID:4208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 7923⤵
- Program crash
PID:3980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 8643⤵
- Program crash
PID:2460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 9763⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 9763⤵
- Program crash
PID:944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 12163⤵
- Program crash
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 12283⤵
- Program crash
PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 13163⤵
- Program crash
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 6924⤵
- Program crash
PID:3660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 8844⤵
- Program crash
PID:1412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 9284⤵
- Program crash
PID:2308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10524⤵
- Program crash
PID:332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10724⤵
- Program crash
PID:4056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10724⤵
- Program crash
PID:60
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10924⤵
- Program crash
PID:4912
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10204⤵
- Program crash
PID:4980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7524⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:1568
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:4404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4464
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:1240
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:3748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 10164⤵
- Program crash
PID:3064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 13124⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 13004⤵
- Program crash
PID:4684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 8724⤵
- Program crash
PID:3920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 11364⤵
- Program crash
PID:1564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 15724⤵
- Program crash
PID:5008
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 11124⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 16164⤵
- Program crash
PID:4188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 9603⤵
- Program crash
PID:1884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4812 -ip 48121⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4812 -ip 48121⤵PID:1168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4812 -ip 48121⤵PID:4328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4812 -ip 48121⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4812 -ip 48121⤵PID:1280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4812 -ip 48121⤵PID:4760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4812 -ip 48121⤵PID:428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4812 -ip 48121⤵PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4812 -ip 48121⤵PID:1836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4812 -ip 48121⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3396 -ip 33961⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3396 -ip 33961⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3396 -ip 33961⤵PID:3144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3396 -ip 33961⤵PID:1588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3396 -ip 33961⤵PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3396 -ip 33961⤵PID:2964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3396 -ip 33961⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3396 -ip 33961⤵PID:2276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3396 -ip 33961⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3396 -ip 33961⤵PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3396 -ip 33961⤵PID:4848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3396 -ip 33961⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3396 -ip 33961⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 3122⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4492 -ip 44921⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3396 -ip 33961⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3396 -ip 33961⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3396 -ip 33961⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 3122⤵
- Program crash
PID:3180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1668 -ip 16681⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3396 -ip 33961⤵PID:1144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
307KB
MD5a54db35d5d53f7e9bb6434cf00119bcc
SHA1bcb8fdeb27c0598d4a660854f1445589fe5052a4
SHA2560d51eb24a7e41ead037605fed9208a878d0859599464fae23464de440962af0a
SHA512521f2b3a4edd1a11f1cdfc5fa1dacafcb295a2d3124e353e03bd8d763a9fb71ce40ab88a7509c326f64b01b606deb4159b3a0be4ebf7904df3dde6b258740d42
-
Filesize
307KB
MD5a54db35d5d53f7e9bb6434cf00119bcc
SHA1bcb8fdeb27c0598d4a660854f1445589fe5052a4
SHA2560d51eb24a7e41ead037605fed9208a878d0859599464fae23464de440962af0a
SHA512521f2b3a4edd1a11f1cdfc5fa1dacafcb295a2d3124e353e03bd8d763a9fb71ce40ab88a7509c326f64b01b606deb4159b3a0be4ebf7904df3dde6b258740d42
-
Filesize
136KB
MD538c5d68ac8023f6fcd46e4a61459c7de
SHA1a895e0ff5bfb6ee41a85e038aaa7d9274d92ffe8
SHA256015095dfa96f7b7416721ac45e02f9fd9742ac0e40f6b130290bdb4139f68068
SHA51258f0f280d4253aa50ed9e92fc9b32683d80d3c5ce3ff87d34e25a7dd57637d048f043ab9a524886705dc31e71a3570e3d01c6c5582562d1d1d32b8e3e8793b06
-
Filesize
136KB
MD538c5d68ac8023f6fcd46e4a61459c7de
SHA1a895e0ff5bfb6ee41a85e038aaa7d9274d92ffe8
SHA256015095dfa96f7b7416721ac45e02f9fd9742ac0e40f6b130290bdb4139f68068
SHA51258f0f280d4253aa50ed9e92fc9b32683d80d3c5ce3ff87d34e25a7dd57637d048f043ab9a524886705dc31e71a3570e3d01c6c5582562d1d1d32b8e3e8793b06
-
Filesize
175KB
MD51dbc3d6a2ef324246e320b33123836a7
SHA1287c814ce172fc1a68eb32e180d6ff0c89f0177d
SHA2568679d35e35d01f95411418601f142fda63495b8cbe166ddccaa93d8d35720982
SHA5123a2a446df0196fbd1a26fe95aba6e5a6c02c214656ec808bf5f458fe30f7e30d0c81c25dae0a242d9c688ce5f07aa0c584d7e56af8b366fef9671b6eeee7dcbf
-
Filesize
175KB
MD51dbc3d6a2ef324246e320b33123836a7
SHA1287c814ce172fc1a68eb32e180d6ff0c89f0177d
SHA2568679d35e35d01f95411418601f142fda63495b8cbe166ddccaa93d8d35720982
SHA5123a2a446df0196fbd1a26fe95aba6e5a6c02c214656ec808bf5f458fe30f7e30d0c81c25dae0a242d9c688ce5f07aa0c584d7e56af8b366fef9671b6eeee7dcbf
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
340KB
MD511accc1a8a6eafa379be6234038cfe5f
SHA1b2e752bdd89f4c6d38d0fd60ec7177b81de2b1f8
SHA25676843b6850833a003b8437b9a5822e69777172b53404f2a9c6699632bd6327a1
SHA512a9d59709e769312f7faee67d875a89f06cfc1f0edd785d59bde7e28b2d7242addd04c2e2f715ea157ba9d6403dcaf8c9f1b03b6acda3533f9c372436bd583998
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5