Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 14:43
Static task
static1
General
-
Target
da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe
-
Size
711KB
-
MD5
1b4c6bf324f4e45b97ff33343ac5652f
-
SHA1
877f2cd7a1b85cd380b45e7c99c4ffc16e76fefb
-
SHA256
da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b
-
SHA512
4254be18de6e878668f6d157b212554f3f0f9a8a2c526347e823560741a6ab6594a430f822c7990bade8aa8eb7072851911cf99307797dc27ba75f55fc19101a
-
SSDEEP
12288:2Mr/y9086YfrkfNlPiIRCfLl9E8DYJgU3chvSh6QtwkSOrbMawaXEG4l0rixmFnz:Jy96YaNlPXRMLnE8DY+SgowXOPMawdN+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h4666163.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation i8823526.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 3628 x0360410.exe 4616 g1539777.exe 744 h4666163.exe 2856 i8823526.exe 2328 oneetx.exe 2384 oneetx.exe 776 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3764 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h4666163.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h4666163.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x0360410.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x0360410.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 30 IoCs
pid pid_target Process procid_target 4756 744 WerFault.exe 89 3456 2856 WerFault.exe 94 4920 2856 WerFault.exe 94 2148 2856 WerFault.exe 94 4528 2856 WerFault.exe 94 564 2856 WerFault.exe 94 5044 2856 WerFault.exe 94 4624 2856 WerFault.exe 94 1476 2856 WerFault.exe 94 1048 2856 WerFault.exe 94 2060 2856 WerFault.exe 94 2444 2328 WerFault.exe 114 2184 2328 WerFault.exe 114 4076 2328 WerFault.exe 114 180 2328 WerFault.exe 114 4176 2328 WerFault.exe 114 2300 2328 WerFault.exe 114 1096 2328 WerFault.exe 114 3140 2328 WerFault.exe 114 5012 2328 WerFault.exe 114 4128 2328 WerFault.exe 114 3932 2328 WerFault.exe 114 4372 2328 WerFault.exe 114 3464 2328 WerFault.exe 114 4300 2384 WerFault.exe 153 4556 2328 WerFault.exe 114 2692 2328 WerFault.exe 114 1460 2328 WerFault.exe 114 1732 776 WerFault.exe 163 1608 2328 WerFault.exe 114 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4732 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4616 g1539777.exe 4616 g1539777.exe 744 h4666163.exe 744 h4666163.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4616 g1539777.exe Token: SeDebugPrivilege 744 h4666163.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2856 i8823526.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1972 wrote to memory of 3628 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 83 PID 1972 wrote to memory of 3628 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 83 PID 1972 wrote to memory of 3628 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 83 PID 3628 wrote to memory of 4616 3628 x0360410.exe 84 PID 3628 wrote to memory of 4616 3628 x0360410.exe 84 PID 3628 wrote to memory of 4616 3628 x0360410.exe 84 PID 3628 wrote to memory of 744 3628 x0360410.exe 89 PID 3628 wrote to memory of 744 3628 x0360410.exe 89 PID 3628 wrote to memory of 744 3628 x0360410.exe 89 PID 1972 wrote to memory of 2856 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 94 PID 1972 wrote to memory of 2856 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 94 PID 1972 wrote to memory of 2856 1972 da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe 94 PID 2856 wrote to memory of 2328 2856 i8823526.exe 114 PID 2856 wrote to memory of 2328 2856 i8823526.exe 114 PID 2856 wrote to memory of 2328 2856 i8823526.exe 114 PID 2328 wrote to memory of 4732 2328 oneetx.exe 131 PID 2328 wrote to memory of 4732 2328 oneetx.exe 131 PID 2328 wrote to memory of 4732 2328 oneetx.exe 131 PID 2328 wrote to memory of 5112 2328 oneetx.exe 137 PID 2328 wrote to memory of 5112 2328 oneetx.exe 137 PID 2328 wrote to memory of 5112 2328 oneetx.exe 137 PID 5112 wrote to memory of 1424 5112 cmd.exe 141 PID 5112 wrote to memory of 1424 5112 cmd.exe 141 PID 5112 wrote to memory of 1424 5112 cmd.exe 141 PID 5112 wrote to memory of 5020 5112 cmd.exe 142 PID 5112 wrote to memory of 5020 5112 cmd.exe 142 PID 5112 wrote to memory of 5020 5112 cmd.exe 142 PID 5112 wrote to memory of 3380 5112 cmd.exe 143 PID 5112 wrote to memory of 3380 5112 cmd.exe 143 PID 5112 wrote to memory of 3380 5112 cmd.exe 143 PID 5112 wrote to memory of 2700 5112 cmd.exe 144 PID 5112 wrote to memory of 2700 5112 cmd.exe 144 PID 5112 wrote to memory of 2700 5112 cmd.exe 144 PID 5112 wrote to memory of 4216 5112 cmd.exe 145 PID 5112 wrote to memory of 4216 5112 cmd.exe 145 PID 5112 wrote to memory of 4216 5112 cmd.exe 145 PID 5112 wrote to memory of 4604 5112 cmd.exe 146 PID 5112 wrote to memory of 4604 5112 cmd.exe 146 PID 5112 wrote to memory of 4604 5112 cmd.exe 146 PID 2328 wrote to memory of 3764 2328 oneetx.exe 160 PID 2328 wrote to memory of 3764 2328 oneetx.exe 160 PID 2328 wrote to memory of 3764 2328 oneetx.exe 160
Processes
-
C:\Users\Admin\AppData\Local\Temp\da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe"C:\Users\Admin\AppData\Local\Temp\da554e831e2c1d03fd29383b1721bc148cdcbb936b452fd7f49d78b8a74c0d8b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0360410.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0360410.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1539777.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1539777.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4666163.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4666163.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 10844⤵
- Program crash
PID:4756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8823526.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8823526.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 6963⤵
- Program crash
PID:3456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 7763⤵
- Program crash
PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 7963⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 8043⤵
- Program crash
PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 8083⤵
- Program crash
PID:564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 8083⤵
- Program crash
PID:5044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 12203⤵
- Program crash
PID:4624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 12043⤵
- Program crash
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 12923⤵
- Program crash
PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 6964⤵
- Program crash
PID:2444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 8364⤵
- Program crash
PID:2184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 8924⤵
- Program crash
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 10524⤵
- Program crash
PID:180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 10524⤵
- Program crash
PID:4176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 10524⤵
- Program crash
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 11004⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 9924⤵
- Program crash
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 7004⤵
- Program crash
PID:5012
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:1424
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:5020
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2700
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4216
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4604
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 12924⤵
- Program crash
PID:4128
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 12484⤵
- Program crash
PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 7684⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 7644⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 11364⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 16644⤵
- Program crash
PID:2692
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 15764⤵
- Program crash
PID:1460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 16804⤵
- Program crash
PID:1608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 17563⤵
- Program crash
PID:2060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 744 -ip 7441⤵PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2856 -ip 28561⤵PID:4136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2856 -ip 28561⤵PID:1216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2856 -ip 28561⤵PID:2736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2856 -ip 28561⤵PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2856 -ip 28561⤵PID:3764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2856 -ip 28561⤵PID:896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2856 -ip 28561⤵PID:4320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2856 -ip 28561⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2856 -ip 28561⤵PID:1724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2856 -ip 28561⤵PID:1292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2328 -ip 23281⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2328 -ip 23281⤵PID:3960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2328 -ip 23281⤵PID:1116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2328 -ip 23281⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2328 -ip 23281⤵PID:2460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2328 -ip 23281⤵PID:2748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2328 -ip 23281⤵PID:1404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2328 -ip 23281⤵PID:1324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2328 -ip 23281⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2328 -ip 23281⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2328 -ip 23281⤵PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2328 -ip 23281⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2328 -ip 23281⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 3202⤵
- Program crash
PID:4300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2384 -ip 23841⤵PID:2496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2328 -ip 23281⤵PID:3148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2328 -ip 23281⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2328 -ip 23281⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 3122⤵
- Program crash
PID:1732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 776 -ip 7761⤵PID:2860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2328 -ip 23281⤵PID:4104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
420KB
MD55978bafdb35c6a31ae3728c32404f1c5
SHA1f67d426763fe34b3e49128c3b5f1a5e790b9ca98
SHA256596d4d7bf7dd52bfdd00353e03b16e78e2525c9ecb9dce89bd26800d1cee4ad6
SHA512594c94b11c91c5ed4dc01204356b8cf20d329cbb86048bd59eed8b5733a92a8920da938e26bf2fe9c14d60ab9ab3680f94d5fe55518d84d9229466c3a592a0b4
-
Filesize
420KB
MD55978bafdb35c6a31ae3728c32404f1c5
SHA1f67d426763fe34b3e49128c3b5f1a5e790b9ca98
SHA256596d4d7bf7dd52bfdd00353e03b16e78e2525c9ecb9dce89bd26800d1cee4ad6
SHA512594c94b11c91c5ed4dc01204356b8cf20d329cbb86048bd59eed8b5733a92a8920da938e26bf2fe9c14d60ab9ab3680f94d5fe55518d84d9229466c3a592a0b4
-
Filesize
136KB
MD5229a829c03ee5ff276f04b3e1f4450ac
SHA1e284d5147f9627a26199ef08ef4f73cd46434a73
SHA256b872f5e25db9ebfa527b73f02d35283f42429823b0c046e16ff08f3b0ed619fa
SHA5129059fd7f2028228ee10015b7163417bcafe59adc1c8587d1a3929c08178f628417d54a2a0f0f9d442d844cec6d26a29b6104e9156ff7c4f9a7c5f2ee01fd2f13
-
Filesize
136KB
MD5229a829c03ee5ff276f04b3e1f4450ac
SHA1e284d5147f9627a26199ef08ef4f73cd46434a73
SHA256b872f5e25db9ebfa527b73f02d35283f42429823b0c046e16ff08f3b0ed619fa
SHA5129059fd7f2028228ee10015b7163417bcafe59adc1c8587d1a3929c08178f628417d54a2a0f0f9d442d844cec6d26a29b6104e9156ff7c4f9a7c5f2ee01fd2f13
-
Filesize
371KB
MD5428c1c365645756360d14bdfa8de4def
SHA1a8c3c8f0a5db22d3473e296bea4721d9f4d1d4e3
SHA2562c593a420ecc6cb4d6daf5e533192e025ad8272db6a6708271a36c46821a1086
SHA512cd2a324ddf938831c42e444819daebfa1dce44fbbde07643681ffdd718fa12a009000dbe5fcb3c942a22294594dadd3a806f55067b285bc4b809a20b98b68ac3
-
Filesize
371KB
MD5428c1c365645756360d14bdfa8de4def
SHA1a8c3c8f0a5db22d3473e296bea4721d9f4d1d4e3
SHA2562c593a420ecc6cb4d6daf5e533192e025ad8272db6a6708271a36c46821a1086
SHA512cd2a324ddf938831c42e444819daebfa1dce44fbbde07643681ffdd718fa12a009000dbe5fcb3c942a22294594dadd3a806f55067b285bc4b809a20b98b68ac3
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
340KB
MD567c396a85be48f7028d5cff2022b72c4
SHA1743e64df19245d7e9a52d154ad6873fe49a24ee6
SHA256814580d54be876fe773d9e94b220cff8bc363918bd003995584729593bbaacdc
SHA51277c8ff1f556b40b459864c5db8df06fb31fe2a2a66eb18b27fe85ded98505c4c5920ecd673fd692bf9e65ff96ecf540b0c2dd3470fc213a225baef2bc98c235d
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5