Analysis

  • max time kernel
    115s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2023, 10:08

General

  • Target

    07424199.exe

  • Size

    904KB

  • MD5

    0315c3149c7dc1d865dc5a89043d870d

  • SHA1

    f74546dda99891ca688416b1a61c9637b3794108

  • SHA256

    90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

  • SHA512

    7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

  • SSDEEP

    24576:bnQv6Dyxn2Qx0KHizHWKxHuyCcZFyXR1tG:2OE2QtCzhh/7R

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 26 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 46 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07424199.exe
    "C:\Users\Admin\AppData\Local\Temp\07424199.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\07424199.exe
      C:\Users\Admin\AppData\Local\Temp\07424199.exe
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Program Files (x86)\Security Central\Security Central.exe
        "C:\Program Files (x86)\Security Central\Security Central.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:524
        • C:\Program Files (x86)\Security Central\Security Central.exe
          "C:\Program Files (x86)\Security Central\Security Central.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3660
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2544
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4428
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3296
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3276
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4840
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1440
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 424 -p 3212 -ip 3212
    1⤵
      PID:820
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3212 -s 4376
      1⤵
      • Program crash
      PID:1672
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2628
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2628 -s 2676
        2⤵
        • Program crash
        PID:5024
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 432 -p 2628 -ip 2628
      1⤵
        PID:3700
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1396
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1396 -s 2576
          2⤵
          • Program crash
          PID:2980
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 544 -p 1396 -ip 1396
        1⤵
          PID:4740
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4724
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4724 -s 2680
            2⤵
            • Program crash
            PID:4860
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 432 -p 4724 -ip 4724
          1⤵
            PID:2076
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies Installed Components in the registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1292
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1292 -s 2640
              2⤵
              • Program crash
              PID:2772
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 520 -p 1292 -ip 1292
            1⤵
              PID:4676
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2788
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2788 -s 2668
                2⤵
                • Program crash
                PID:3896
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 552 -p 2788 -ip 2788
              1⤵
                PID:2832
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:776
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 776 -s 2620
                  2⤵
                  • Program crash
                  PID:4548
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 580 -p 776 -ip 776
                1⤵
                  PID:4716
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1932
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 1932 -s 2612
                    2⤵
                    • Program crash
                    PID:3956
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 596 -p 1932 -ip 1932
                  1⤵
                    PID:2088
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Modifies registry class
                    PID:3256
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 3256 -s 2612
                      2⤵
                      • Program crash
                      PID:3756
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 600 -p 3256 -ip 3256
                    1⤵
                      PID:4664
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Modifies registry class
                      PID:3428
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 3428 -s 2644
                        2⤵
                        • Program crash
                        PID:4620
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 476 -p 3428 -ip 3428
                      1⤵
                        PID:4976
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        PID:4824
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 4824 -s 2624
                          2⤵
                          • Program crash
                          PID:2468
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 608 -p 4824 -ip 4824
                        1⤵
                          PID:5064
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Modifies registry class
                          PID:1408
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 1408 -s 2592
                            2⤵
                            • Program crash
                            PID:824
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 628 -p 1408 -ip 1408
                          1⤵
                            PID:3400
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Modifies registry class
                            PID:3780
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 3780 -s 2540
                              2⤵
                              • Program crash
                              PID:3460
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 628 -p 3780 -ip 3780
                            1⤵
                              PID:3288
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Modifies registry class
                              PID:3216
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 3216 -s 2600
                                2⤵
                                • Program crash
                                PID:5024
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 576 -p 3216 -ip 3216
                              1⤵
                                PID:5028
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Modifies registry class
                                PID:464
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 464 -s 2604
                                  2⤵
                                  • Program crash
                                  PID:4136
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -pss -s 616 -p 464 -ip 464
                                1⤵
                                  PID:1464
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:1276
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 1276 -s 2644
                                    2⤵
                                    • Program crash
                                    PID:1212
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -pss -s 624 -p 1276 -ip 1276
                                  1⤵
                                    PID:3532
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:1996
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 1996 -s 2648
                                      2⤵
                                      • Program crash
                                      PID:3856
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -pss -s 588 -p 1996 -ip 1996
                                    1⤵
                                      PID:3788
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      • Modifies registry class
                                      PID:4676
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -u -p 4676 -s 2624
                                        2⤵
                                        • Program crash
                                        PID:3832
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -pss -s 544 -p 4676 -ip 4676
                                      1⤵
                                        PID:5056
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Modifies registry class
                                        PID:3280
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 3280 -s 2564
                                          2⤵
                                          • Program crash
                                          PID:3104
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -pss -s 592 -p 3280 -ip 3280
                                        1⤵
                                          PID:3152
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          • Modifies registry class
                                          PID:788
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 788 -s 2596
                                            2⤵
                                            • Program crash
                                            PID:3680
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -pss -s 544 -p 788 -ip 788
                                          1⤵
                                            PID:4720
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Modifies Installed Components in the registry
                                            • Modifies registry class
                                            PID:776
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 776 -s 2664
                                              2⤵
                                              • Program crash
                                              PID:4752
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -pss -s 624 -p 776 -ip 776
                                            1⤵
                                              PID:3920
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                              • Modifies Installed Components in the registry
                                              • Modifies registry class
                                              PID:4240
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 4240 -s 2648
                                                2⤵
                                                • Program crash
                                                PID:3936
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -pss -s 584 -p 4240 -ip 4240
                                              1⤵
                                                PID:3292
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                • Modifies Installed Components in the registry
                                                • Modifies registry class
                                                PID:1148
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -u -p 1148 -s 2616
                                                  2⤵
                                                  • Program crash
                                                  PID:5100
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 648 -p 1148 -ip 1148
                                                1⤵
                                                  PID:3752
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Modifies registry class
                                                  PID:4544
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -u -p 4544 -s 2612
                                                    2⤵
                                                    • Program crash
                                                    PID:1248
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -pss -s 476 -p 4544 -ip 4544
                                                  1⤵
                                                    PID:408
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Modifies Installed Components in the registry
                                                    • Modifies registry class
                                                    PID:2892
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -u -p 2892 -s 2256
                                                      2⤵
                                                      • Program crash
                                                      PID:4216
                                                  • C:\Windows\system32\WerFault.exe
                                                    C:\Windows\system32\WerFault.exe -pss -s 608 -p 2892 -ip 2892
                                                    1⤵
                                                      PID:2744
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Modifies Installed Components in the registry
                                                      • Modifies registry class
                                                      PID:2864
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -u -p 2864 -s 2620
                                                        2⤵
                                                        • Program crash
                                                        PID:3260
                                                    • C:\Windows\system32\WerFault.exe
                                                      C:\Windows\system32\WerFault.exe -pss -s 472 -p 2864 -ip 2864
                                                      1⤵
                                                        PID:3772
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                        • Modifies Installed Components in the registry
                                                        PID:4124
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 4124 -s 2620
                                                          2⤵
                                                          • Program crash
                                                          PID:3348
                                                      • C:\Windows\system32\WerFault.exe
                                                        C:\Windows\system32\WerFault.exe -pss -s 552 -p 4124 -ip 4124
                                                        1⤵
                                                          PID:4984
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3396
                                                            • C:\Windows\system32\WerFault.exe
                                                              C:\Windows\system32\WerFault.exe -u -p 3396 -s 2648
                                                              2⤵
                                                              • Program crash
                                                              PID:4968
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -pss -s 520 -p 3396 -ip 3396
                                                            1⤵
                                                              PID:404
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4740
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -u -p 4740 -s 2588
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:1680
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -pss -s 484 -p 4740 -ip 4740
                                                                1⤵
                                                                  PID:4440
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4412
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 4412 -s 2040
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:2520
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -pss -s 560 -p 4412 -ip 4412
                                                                    1⤵
                                                                      PID:3008
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:1536
                                                                        • C:\Windows\system32\WerFault.exe
                                                                          C:\Windows\system32\WerFault.exe -u -p 1536 -s 2628
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:2448
                                                                      • C:\Windows\system32\WerFault.exe
                                                                        C:\Windows\system32\WerFault.exe -pss -s 544 -p 1536 -ip 1536
                                                                        1⤵
                                                                          PID:1716
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2808
                                                                            • C:\Windows\system32\WerFault.exe
                                                                              C:\Windows\system32\WerFault.exe -u -p 2808 -s 2560
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:4700
                                                                          • C:\Windows\system32\WerFault.exe
                                                                            C:\Windows\system32\WerFault.exe -pss -s 520 -p 2808 -ip 2808
                                                                            1⤵
                                                                              PID:4888
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3044
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 3044 -s 2516
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:428
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -pss -s 544 -p 3044 -ip 3044
                                                                                1⤵
                                                                                  PID:3132
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4800
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 4800 -s 2576
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:2088
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -pss -s 528 -p 4800 -ip 4800
                                                                                    1⤵
                                                                                      PID:3872
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3808
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -u -p 3808 -s 2684
                                                                                          2⤵
                                                                                          • Program crash
                                                                                          PID:2156
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -pss -s 608 -p 3808 -ip 3808
                                                                                        1⤵
                                                                                          PID:224
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4048
                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                              C:\Windows\system32\WerFault.exe -u -p 4048 -s 2608
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:4900
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -pss -s 596 -p 4048 -ip 4048
                                                                                            1⤵
                                                                                              PID:548
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:644
                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                  C:\Windows\system32\WerFault.exe -u -p 644 -s 2556
                                                                                                  2⤵
                                                                                                  • Program crash
                                                                                                  PID:3428
                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                C:\Windows\system32\WerFault.exe -pss -s 624 -p 644 -ip 644
                                                                                                1⤵
                                                                                                  PID:3900
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1752
                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                      C:\Windows\system32\WerFault.exe -u -p 1752 -s 2564
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:4064
                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 528 -p 1752 -ip 1752
                                                                                                    1⤵
                                                                                                      PID:2948
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3732
                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                          C:\Windows\system32\WerFault.exe -u -p 3732 -s 2520
                                                                                                          2⤵
                                                                                                          • Program crash
                                                                                                          PID:3516
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 564 -p 3732 -ip 3732
                                                                                                        1⤵
                                                                                                          PID:2184
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:1852
                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                              C:\Windows\system32\WerFault.exe -u -p 1852 -s 2544
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:3548
                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 544 -p 1852 -ip 1852
                                                                                                            1⤵
                                                                                                              PID:2896
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:3476
                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3476 -s 2612
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:2556
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 472 -p 3476 -ip 3476
                                                                                                                1⤵
                                                                                                                  PID:4172
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4464
                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 4464 -s 2668
                                                                                                                      2⤵
                                                                                                                      • Program crash
                                                                                                                      PID:980
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 484 -p 4464 -ip 4464
                                                                                                                    1⤵
                                                                                                                      PID:2180
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:2428
                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 2428 -s 2572
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:3740
                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 472 -p 2428 -ip 2428
                                                                                                                        1⤵
                                                                                                                          PID:4608
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:2072
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 2072 -s 2540
                                                                                                                              2⤵
                                                                                                                              • Program crash
                                                                                                                              PID:3832
                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 564 -p 2072 -ip 2072
                                                                                                                            1⤵
                                                                                                                              PID:1716
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:2264
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2264 -s 2500
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:2832
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 556 -p 2264 -ip 2264
                                                                                                                                1⤵
                                                                                                                                  PID:5088
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4972
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 4972 -s 2676
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:1240
                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 488 -p 4972 -ip 4972
                                                                                                                                    1⤵
                                                                                                                                      PID:3132
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1040

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\Security Central\Security Central.exe

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                              MD5

                                                                                                                                              0315c3149c7dc1d865dc5a89043d870d

                                                                                                                                              SHA1

                                                                                                                                              f74546dda99891ca688416b1a61c9637b3794108

                                                                                                                                              SHA256

                                                                                                                                              90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

                                                                                                                                              SHA512

                                                                                                                                              7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

                                                                                                                                            • C:\Program Files (x86)\Security Central\Security Central.exe

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                              MD5

                                                                                                                                              0315c3149c7dc1d865dc5a89043d870d

                                                                                                                                              SHA1

                                                                                                                                              f74546dda99891ca688416b1a61c9637b3794108

                                                                                                                                              SHA256

                                                                                                                                              90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

                                                                                                                                              SHA512

                                                                                                                                              7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

                                                                                                                                            • C:\Program Files (x86)\Security Central\Security Central.exe

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                              MD5

                                                                                                                                              0315c3149c7dc1d865dc5a89043d870d

                                                                                                                                              SHA1

                                                                                                                                              f74546dda99891ca688416b1a61c9637b3794108

                                                                                                                                              SHA256

                                                                                                                                              90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

                                                                                                                                              SHA512

                                                                                                                                              7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

                                                                                                                                            • memory/3660-156-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-164-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-179-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-178-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-177-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-176-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-154-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/3660-155-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-157-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-158-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-159-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-175-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-163-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-174-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-165-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/3660-166-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-167-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-168-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-169-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-170-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-172-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3660-173-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/4728-140-0x0000000000D60000-0x0000000000D61000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/4728-135-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/4728-151-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/4728-137-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/4728-138-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/4728-139-0x0000000000400000-0x0000000000A35000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB