a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2023, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe
Size

711KB
MD5

17b5e3febac7da943b8171124f0d1a8e
SHA1

30dd510e7c8f8ae1282c3731a86aace8d1d4fc61
SHA256

a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561
SHA512

b176c14674fbdd966e40c47d6d4b94588ee96363f1d9614d972c86bf6f03fb702740fb051d1d5c5dc9118b2ba1f948ded98ffb2eba1bc43dc0ced2302767d860
SSDEEP

12288:XMr7y90yFsaFB1ztBoV6TE8M41UCcLN5nMplO6tcdc7z0eoU4S4iPxtzTUzBU:UyzFsajdoVIE8HjO5MK6tX7QfU4PigBU

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h8381522.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h8381522.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h8381522.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h8381522.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h8381522.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h8381522.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	i1328771.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 7 IoCs

pid	Process
4780	x1472019.exe
2816	g9657585.exe
4288	h8381522.exe
3700	i1328771.exe
4992	oneetx.exe
776	oneetx.exe
3108	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
5000	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h8381522.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h8381522.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1472019.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	x1472019.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
776	4288	WerFault.exe	88
2264	3700	WerFault.exe	94
1120	3700	WerFault.exe	94
4084	3700	WerFault.exe	94
1340	3700	WerFault.exe	94
4796	3700	WerFault.exe	94
4228	3700	WerFault.exe	94
4544	3700	WerFault.exe	94
4988	3700	WerFault.exe	94
2304	3700	WerFault.exe	94
1564	3700	WerFault.exe	94
2560	4992	WerFault.exe	113
4676	4992	WerFault.exe	113
3324	4992	WerFault.exe	113
1572	4992	WerFault.exe	113
1848	4992	WerFault.exe	113
4820	4992	WerFault.exe	113
4716	4992	WerFault.exe	113
1332	4992	WerFault.exe	113
4472	4992	WerFault.exe	113
5012	4992	WerFault.exe	113
2100	4992	WerFault.exe	113
4996	4992	WerFault.exe	113
4504	4992	WerFault.exe	113
4492	4992	WerFault.exe	113
4112	776	WerFault.exe	155
3556	4992	WerFault.exe	113
8	4992	WerFault.exe	113
868	4992	WerFault.exe	113
1900	3108	WerFault.exe	165
3896	4992	WerFault.exe	113

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2816	g9657585.exe
2816	g9657585.exe
4288	h8381522.exe
4288	h8381522.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	g9657585.exe
Token: SeDebugPrivilege	4288	h8381522.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3700	i1328771.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4780	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	83
PID 1608 wrote to memory of 4780	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	83
PID 1608 wrote to memory of 4780	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	83
PID 4780 wrote to memory of 2816	4780	x1472019.exe	84
PID 4780 wrote to memory of 2816	4780	x1472019.exe	84
PID 4780 wrote to memory of 2816	4780	x1472019.exe	84
PID 4780 wrote to memory of 4288	4780	x1472019.exe	88
PID 4780 wrote to memory of 4288	4780	x1472019.exe	88
PID 4780 wrote to memory of 4288	4780	x1472019.exe	88
PID 1608 wrote to memory of 3700	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	94
PID 1608 wrote to memory of 3700	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	94
PID 1608 wrote to memory of 3700	1608	a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe	94
PID 3700 wrote to memory of 4992	3700	i1328771.exe	113
PID 3700 wrote to memory of 4992	3700	i1328771.exe	113
PID 3700 wrote to memory of 4992	3700	i1328771.exe	113
PID 4992 wrote to memory of 4604	4992	oneetx.exe	131
PID 4992 wrote to memory of 4604	4992	oneetx.exe	131
PID 4992 wrote to memory of 4604	4992	oneetx.exe	131
PID 4992 wrote to memory of 532	4992	oneetx.exe	137
PID 4992 wrote to memory of 532	4992	oneetx.exe	137
PID 4992 wrote to memory of 532	4992	oneetx.exe	137
PID 532 wrote to memory of 2624	532	cmd.exe	141
PID 532 wrote to memory of 2624	532	cmd.exe	141
PID 532 wrote to memory of 2624	532	cmd.exe	141
PID 532 wrote to memory of 4388	532	cmd.exe	142
PID 532 wrote to memory of 4388	532	cmd.exe	142
PID 532 wrote to memory of 4388	532	cmd.exe	142
PID 532 wrote to memory of 4948	532	cmd.exe	143
PID 532 wrote to memory of 4948	532	cmd.exe	143
PID 532 wrote to memory of 4948	532	cmd.exe	143
PID 532 wrote to memory of 2252	532	cmd.exe	144
PID 532 wrote to memory of 2252	532	cmd.exe	144
PID 532 wrote to memory of 2252	532	cmd.exe	144
PID 532 wrote to memory of 2308	532	cmd.exe	145
PID 532 wrote to memory of 2308	532	cmd.exe	145
PID 532 wrote to memory of 2308	532	cmd.exe	145
PID 532 wrote to memory of 516	532	cmd.exe	146
PID 532 wrote to memory of 516	532	cmd.exe	146
PID 532 wrote to memory of 516	532	cmd.exe	146
PID 4992 wrote to memory of 5000	4992	oneetx.exe	162
PID 4992 wrote to memory of 5000	4992	oneetx.exe	162
PID 4992 wrote to memory of 5000	4992	oneetx.exe	162

C:\Users\Admin\AppData\Local\Temp\a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe
"C:\Users\Admin\AppData\Local\Temp\a10680a57e6cb714dddb2f39adb3ddb90781d0cff119efe9470d5e56768d5561.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1472019.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1472019.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9657585.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9657585.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8381522.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8381522.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 1084
      4⤵
      Program crash
      PID:776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1328771.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1328771.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 696
    3⤵
    - Program crash
    PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 772
    3⤵
    - Program crash
    PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 888
    3⤵
    - Program crash
    PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 976
    3⤵
    - Program crash
    PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1012
    3⤵
    - Program crash
    PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1012
    3⤵
    - Program crash
    PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1216
    3⤵
    - Program crash
    PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1248
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 1252
    3⤵
    - Program crash
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 692
      4⤵
      Program crash
      PID:2560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 836
      4⤵
      Program crash
      PID:4676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 892
      4⤵
      Program crash
      PID:3324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1052
      4⤵
      Program crash
      PID:1572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1072
      4⤵
      Program crash
      PID:1848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1072
      4⤵
      Program crash
      PID:4820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1144
      4⤵
      Program crash
      PID:4716
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1000
      4⤵
      Program crash
      PID:1332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 772
      4⤵
      Program crash
      PID:4472
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2624
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4388
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2252
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:N"
        5⤵
        
        PID:2308
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c3912af058" /P "Admin:R" /E
        5⤵
        
        PID:516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1316
      4⤵
      Program crash
      PID:5012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 776
      4⤵
      Program crash
      PID:2100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1328
      4⤵
      Program crash
      PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
      4⤵
      Program crash
      PID:4504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1472
      4⤵
      Program crash
      PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1168
      4⤵
      Program crash
      PID:3556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1052
      4⤵
      Program crash
      PID:8
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:5000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1472
      4⤵
      Program crash
      PID:868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1656
      4⤵
      Program crash
      PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 748
    3⤵
    - Program crash
    PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4288 -ip 4288
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3700 -ip 3700
1⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3700 -ip 3700
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3700 -ip 3700
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3700 -ip 3700
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3700 -ip 3700
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3700 -ip 3700
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3700 -ip 3700
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 3700
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 3700
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 3700
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4992 -ip 4992
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4992 -ip 4992
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4992 -ip 4992
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4992 -ip 4992
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4992 -ip 4992
1⤵
PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4992 -ip 4992
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4992 -ip 4992
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4992 -ip 4992
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4992 -ip 4992
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4992 -ip 4992
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 312
  2⤵
  - Program crash
  PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 776 -ip 776
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4992 -ip 4992
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4992 -ip 4992
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4992 -ip 4992
1⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
1⤵
- Executes dropped EXE
PID:3108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 312
  2⤵
  - Program crash
  PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3108 -ip 3108
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4992 -ip 4992
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1328771.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i1328771.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1472019.exe

Filesize
420KB

MD5
0b84eccb84bf3ad382e629cd1f0a8343

SHA1
bca52aa7dd91386ef0bea2a195d8df10d7589c00

SHA256
021746e9b700cbbfa5801051b4e3fb3731eb7f4265e20b510333b7307838ccc0

SHA512
f8fa1131ddcc3b91f321fc94d54834bac7f90d7b3e3aec0bf98ab67ec93b4f7d339a592a33c087f4bb21c2b6ff39423adc96cdd652a548217fc7bf5c45f6e7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1472019.exe

Filesize
420KB

MD5
0b84eccb84bf3ad382e629cd1f0a8343

SHA1
bca52aa7dd91386ef0bea2a195d8df10d7589c00

SHA256
021746e9b700cbbfa5801051b4e3fb3731eb7f4265e20b510333b7307838ccc0

SHA512
f8fa1131ddcc3b91f321fc94d54834bac7f90d7b3e3aec0bf98ab67ec93b4f7d339a592a33c087f4bb21c2b6ff39423adc96cdd652a548217fc7bf5c45f6e7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9657585.exe

Filesize
136KB

MD5
acc4a6be8982395a3d7e9f24fd7db5b7

SHA1
3e666dedd035d2930b5d8b6fa355366fe3632a63

SHA256
54e46af278fdd2a08066ff99f2ffbb0cfe424269af81d544b613a295c0bf1b42

SHA512
0ef8d382cb811711c28f03c4014688f42034cdeb6d3c4aa42a109ea2d9cac6f85f6631423067b7c12fbb849d5f1a7c74b73a484a79b833a8c136115d929070cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g9657585.exe

Filesize
136KB

MD5
acc4a6be8982395a3d7e9f24fd7db5b7

SHA1
3e666dedd035d2930b5d8b6fa355366fe3632a63

SHA256
54e46af278fdd2a08066ff99f2ffbb0cfe424269af81d544b613a295c0bf1b42

SHA512
0ef8d382cb811711c28f03c4014688f42034cdeb6d3c4aa42a109ea2d9cac6f85f6631423067b7c12fbb849d5f1a7c74b73a484a79b833a8c136115d929070cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8381522.exe

Filesize
371KB

MD5
cbcbe4585c3a01898b2e393a5d19a124

SHA1
86cfa2f99ba22ba772257af0b4f1db6aeafca9a9

SHA256
c7505c5126865ecbd01e0d1b48de9632ce29cd86ff52e1fed75cab2cf4740087

SHA512
8cd95a9ea11fdedc46fbdcc055834abfaa9670db788d2ce169ab98448f4176fa87d9c4929f3d21a827aa0a9cb6939a1efa88208390388798e7c9588d3d1c9d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8381522.exe

Filesize
371KB

MD5
cbcbe4585c3a01898b2e393a5d19a124

SHA1
86cfa2f99ba22ba772257af0b4f1db6aeafca9a9

SHA256
c7505c5126865ecbd01e0d1b48de9632ce29cd86ff52e1fed75cab2cf4740087

SHA512
8cd95a9ea11fdedc46fbdcc055834abfaa9670db788d2ce169ab98448f4176fa87d9c4929f3d21a827aa0a9cb6939a1efa88208390388798e7c9588d3d1c9d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

Filesize
340KB

MD5
962a645a7fc093128f8fb9e8b407e7bf

SHA1
9354d1f8be7a45d2f9bf284412408e89381b4e3a

SHA256
1d79048b4b381811deefc90dde1dc437370361893f9e2223e485531e356f2f69

SHA512
61ad7d4831f6019ce7e934d4156cc2ad006e258f4faf34f7b3d96a625e3a3c35b5f088cee0114a64e2bf1b9300d9c0fc7fbfe88200d3318d6ca2d99989755bb8

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
8451a2c5daa42b25333b1b2089c5ea39

SHA1
700cc99ec8d3113435e657070d2d6bde0a833adc

SHA256
b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

SHA512
6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/776-228-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/2816-158-0x0000000009830000-0x00000000099F2000-memory.dmp

Filesize
1.8MB

Download
memory/2816-153-0x0000000008000000-0x0000000008066000-memory.dmp

Filesize
408KB

Download
memory/2816-157-0x0000000008B90000-0x0000000008BAE000-memory.dmp

Filesize
120KB

Download
memory/2816-147-0x0000000000F30000-0x0000000000F58000-memory.dmp

Filesize
160KB

Download
memory/2816-148-0x00000000081A0000-0x00000000087B8000-memory.dmp

Filesize
6.1MB

Download
memory/2816-149-0x0000000007C40000-0x0000000007C52000-memory.dmp

Filesize
72KB

Download
memory/2816-150-0x0000000007D70000-0x0000000007E7A000-memory.dmp

Filesize
1.0MB

Download
memory/2816-151-0x0000000007CC0000-0x0000000007CFC000-memory.dmp

Filesize
240KB

Download
memory/2816-152-0x0000000007C70000-0x0000000007C80000-memory.dmp

Filesize
64KB

Download
memory/2816-159-0x0000000009F30000-0x000000000A45C000-memory.dmp

Filesize
5.2MB

Download
memory/2816-156-0x0000000008C80000-0x0000000008CF6000-memory.dmp

Filesize
472KB

Download
memory/2816-160-0x0000000005270000-0x00000000052C0000-memory.dmp

Filesize
320KB

Download
memory/2816-154-0x00000000090B0000-0x0000000009654000-memory.dmp

Filesize
5.6MB

Download
memory/2816-155-0x0000000008BE0000-0x0000000008C72000-memory.dmp

Filesize
584KB

Download
memory/3108-256-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/3700-223-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/3700-208-0x0000000002350000-0x0000000002385000-memory.dmp

Filesize
212KB

Download
memory/4288-179-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-183-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-195-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-197-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-198-0x0000000000400000-0x00000000006F6000-memory.dmp

Filesize
3.0MB

Download
memory/4288-199-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4288-200-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4288-201-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4288-203-0x0000000000400000-0x00000000006F6000-memory.dmp

Filesize
3.0MB

Download
memory/4288-191-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-189-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-187-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-185-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-193-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-181-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-177-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-166-0x0000000000980000-0x00000000009AD000-memory.dmp

Filesize
180KB

Download
memory/4288-168-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-175-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-173-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-172-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4288-170-0x00000000026F0000-0x0000000002702000-memory.dmp

Filesize
72KB

Download
memory/4288-169-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4288-167-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/4992-251-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download
memory/4992-224-0x0000000000400000-0x00000000006EF000-memory.dmp

Filesize
2.9MB

Download