Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10013e80dc8e...a8.exe
windows10-2004-x64
7040677c072...cc.exe
windows10-2004-x64
10ba3a15c5f...6a.exe
windows10-2004-x64
1019d029dd80...b2.dll
windows10-2004-x64
101ac4f94c2d...83.exe
windows10-2004-x64
71efeb07862...bb.dll
windows10-2004-x64
327861dacdd...03.exe
windows10-2004-x64
1031860041f6...ff.exe
windows10-2004-x64
33c49ffd8bf...86.dll
windows10-2004-x64
141edb742c1...45.exe
windows10-2004-x64
74ad4c837ce...e1.exe
windows10-2004-x64
150682871a2...53.exe
windows10-2004-x64
65f3bfe76bb...b6.exe
windows10-2004-x64
10784f3902fd...12.exe
windows10-2004-x64
10816c0e4deb...6c.exe
windows10-2004-x64
781b49d3c61...a9.exe
windows10-2004-x64
1082d1e979d2...67.exe
windows10-2004-x64
78ba3f20419...4f.exe
windows10-2004-x64
108d8576432c...fe.exe
windows10-2004-x64
7962bbb1929...e2.exe
windows10-2004-x64
1096f295d08c...d1.exe
windows10-2004-x64
796f2bcea04...28.exe
windows10-2004-x64
109972304b5c...64.exe
windows10-2004-x64
109ff988d7ea...09.exe
windows10-2004-x64
7bfddb59433...b0.exe
windows10-2004-x64
3c0ca77690a...a5.dll
windows10-2004-x64
1cb0f8c9180...69.exe
windows10-2004-x64
10cfbcc54f36...29.exe
windows10-2004-x64
7dd0f55e997...a3.exe
windows10-2004-x64
8ded033da36...58.exe
windows10-2004-x64
7ea55e146fe...59.exe
windows10-2004-x64
10fffd0cdd49...d6.exe
windows10-2004-x64
10Resubmissions
14/11/2023, 17:31
231114-v3qg7acf42 1014/11/2023, 17:21
231114-vxdw7sdg61 1028/10/2023, 19:29
231028-x7cs1age56 1024/10/2023, 13:29
231024-qrn3rsdb6z 1018/10/2023, 12:04
231018-n8ybnaeb31 1007/09/2023, 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
81s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
24/10/2023, 13:29
Behavioral task
behavioral1
Sample
013e80dc8e53bd7d98dd94915f05563499b6a323df343bb765a1d3f188753aa8.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
040677c072d3f39edc3d3ec5f95573c1532875c1d57ddc1b62ce396afae016cc.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
19d029dd80a0823d4abe2dfea87b17935844142cb0921eb35a390f70d5f522b2.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
1ac4f94c2d34dbf38aaf1b7b7103349479fbe5b427e45fd213d4f31845958b83.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
3c49ffd8bfdcc42aee16d8679893aa28f3ed5e433dcf0900ed32f7a88da3f386.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
4ad4c837ce02e146680abb4f673fbca2d5f8588f4ae2c766b393c2b4141a9ee1.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
50682871a2a335d7c5f89cfc1ed16bec99abfa7856a05f54477ee639bbbfd453.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
5f3bfe76bbd22dd8fd936b3833220ba03964b08e28ecf13dafdbbae24a620cb6.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
816c0e4debc58580e62e0698d31111436c8f99bd895ad2b4d0c9b7c2798dd96c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral18
Sample
8ba3f20419e36946e978e69ae892805569a3b8e5ae702038065296aae8dc414f.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral20
Sample
962bbb1929620dc69e35d52ce7e9684412e16e8ad2727222dbe3e47e9220f8e2.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral22
Sample
96f2bcea04abecb6ba4e87bb6cd62beb439882a9bb013fa12def110ea3335528.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
9972304b5cf97f0369e5b287583931d87dfe984aa698c9123b7061379db68e64.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral24
Sample
9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
c0ca77690ad65d797c3c9a662229046b0cc28e89ca54e0e39c70f656201280a5.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
cb0f8c9180b92b75f130ecdd9fd42fa9c687796313cc968179d1c9b217c65e69.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral28
Sample
cfbcc54f36dbdfc8d78d2be3a6b565f4e25b4d52f51de10ad7e4ca14c7f55d29.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
dd0f55e997999bfddd040f676fd616b99afe386daf1a69c3a02a8324274baba3.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
ea55e146fed653416bd40c92ce89cd61b46035c7bc6f55a33c71a9872e2c9659.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral32
Sample
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Resource
win10v2004-20231023-en
General
-
Target
81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
-
Size
1.1MB
-
MD5
5b3c8242aab49db13a10b3454bf14ac8
-
SHA1
9667f4b95635d6e464963b47a2b559ca8a6add94
-
SHA256
81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9
-
SHA512
4aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32
-
SSDEEP
24576:mABwP/lOtVi7TlVvmgwdaeiQAAJLqnVd:5W4q5wg6HZJG
Malware Config
Extracted
djvu
http://dell1.ug/Asjd74ywuhodfgdfgpenelop5/45y87hzjdfg/get.php
-
extension
.boot
-
offline_id
zZyLTRlsJ8hv1HPF6BPmiyHxTSON3B8vILboott1
-
payload_url
http://dell1.ug/files/penelop/updatewin1.exe
http://dell1.ug/files/penelop/updatewin2.exe
http://dell1.ug/files/penelop/updatewin.exe
http://dell1.ug/files/penelop/3.exe
http://dell1.ug/files/penelop/4.exe
http://dell1.ug/files/penelop/5.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-JeLOm18e5g Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0167A73uHsdfs89
Signatures
-
Detected Djvu ransomware 13 IoCs
resource yara_rule behavioral16/memory/1168-3-0x0000000000D20000-0x0000000000E3A000-memory.dmp family_djvu behavioral16/memory/1168-4-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/1168-15-0x0000000000D20000-0x0000000000E3A000-memory.dmp family_djvu behavioral16/memory/1168-16-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/1168-17-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/2960-19-0x0000000000BC0000-0x0000000000C87000-memory.dmp family_djvu behavioral16/memory/2960-20-0x0000000000C90000-0x0000000000DAA000-memory.dmp family_djvu behavioral16/memory/2960-21-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/2960-22-0x0000000000BC0000-0x0000000000C87000-memory.dmp family_djvu behavioral16/memory/2960-28-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/2960-29-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/2960-32-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu behavioral16/memory/2960-33-0x0000000000400000-0x000000000053B000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe -
Executes dropped EXE 1 IoCs
pid Process 4264 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1800 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\28f6c368-2b79-4145-893b-9c42f07bbbaf\\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe\" --AutoStart" 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 api.2ip.ua 26 api.2ip.ua 31 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 33 IoCs
pid pid_target Process procid_target 2924 1168 WerFault.exe 85 1572 1168 WerFault.exe 85 5016 1168 WerFault.exe 85 3692 1168 WerFault.exe 85 4252 1168 WerFault.exe 85 3484 1168 WerFault.exe 85 4260 1168 WerFault.exe 85 3192 1168 WerFault.exe 85 2248 1168 WerFault.exe 85 4160 1168 WerFault.exe 85 676 1168 WerFault.exe 85 4208 1168 WerFault.exe 85 4768 1168 WerFault.exe 85 1712 1168 WerFault.exe 85 4320 1168 WerFault.exe 85 4396 1168 WerFault.exe 85 4880 2960 WerFault.exe 120 3668 2960 WerFault.exe 120 3804 2960 WerFault.exe 120 4236 2960 WerFault.exe 120 4080 2960 WerFault.exe 120 3992 2960 WerFault.exe 120 4944 2960 WerFault.exe 120 2204 2960 WerFault.exe 120 2092 2960 WerFault.exe 120 3732 2960 WerFault.exe 120 388 2960 WerFault.exe 120 1532 2960 WerFault.exe 120 4544 2960 WerFault.exe 120 496 2960 WerFault.exe 120 3004 2960 WerFault.exe 120 1640 2960 WerFault.exe 120 2644 2960 WerFault.exe 120 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 2960 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 2960 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1168 wrote to memory of 1800 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 115 PID 1168 wrote to memory of 1800 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 115 PID 1168 wrote to memory of 1800 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 115 PID 1168 wrote to memory of 2960 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 120 PID 1168 wrote to memory of 2960 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 120 PID 1168 wrote to memory of 2960 1168 81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe"C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8322⤵
- Program crash
PID:2924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8522⤵
- Program crash
PID:1572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8522⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 8882⤵
- Program crash
PID:3692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 9842⤵
- Program crash
PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 9922⤵
- Program crash
PID:3484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 15242⤵
- Program crash
PID:4260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 15282⤵
- Program crash
PID:3192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 18042⤵
- Program crash
PID:2248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 16602⤵
- Program crash
PID:4160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 15962⤵
- Program crash
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 16402⤵
- Program crash
PID:4208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 15322⤵
- Program crash
PID:4768
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\28f6c368-2b79-4145-893b-9c42f07bbbaf" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
PID:1800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 16002⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 21002⤵
- Program crash
PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe"C:\Users\Admin\AppData\Local\Temp\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 7923⤵
- Program crash
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 8323⤵
- Program crash
PID:3668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 8203⤵
- Program crash
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 8643⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 10363⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 11123⤵
- Program crash
PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 10403⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 13563⤵
- Program crash
PID:2204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 15843⤵
- Program crash
PID:2092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 16603⤵
- Program crash
PID:3732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 17043⤵
- Program crash
PID:388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 17163⤵
- Program crash
PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 16803⤵
- Program crash
PID:4544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 17323⤵
- Program crash
PID:496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 17563⤵
- Program crash
PID:3004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 15723⤵
- Program crash
PID:1640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 18003⤵
- Program crash
PID:2644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 21122⤵
- Program crash
PID:4396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1168 -ip 11681⤵PID:3992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1168 -ip 11681⤵PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1168 -ip 11681⤵PID:2584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1168 -ip 11681⤵PID:2080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1168 -ip 11681⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1168 -ip 11681⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1168 -ip 11681⤵PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1168 -ip 11681⤵PID:1940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1168 -ip 11681⤵PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1168 -ip 11681⤵PID:872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1168 -ip 11681⤵PID:3680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1168 -ip 11681⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1168 -ip 11681⤵PID:4512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1168 -ip 11681⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1168 -ip 11681⤵PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1168 -ip 11681⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2960 -ip 29601⤵PID:1488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2960 -ip 29601⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2960 -ip 29601⤵PID:1264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2960 -ip 29601⤵PID:552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2960 -ip 29601⤵PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2960 -ip 29601⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2960 -ip 29601⤵PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2960 -ip 29601⤵PID:3880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2960 -ip 29601⤵PID:4124
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2960 -ip 29601⤵PID:4136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2960 -ip 29601⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2960 -ip 29601⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2960 -ip 29601⤵PID:4228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2960 -ip 29601⤵PID:444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2960 -ip 29601⤵PID:900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2960 -ip 29601⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2960 -ip 29601⤵PID:60
-
C:\Users\Admin\AppData\Local\28f6c368-2b79-4145-893b-9c42f07bbbaf\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exeC:\Users\Admin\AppData\Local\28f6c368-2b79-4145-893b-9c42f07bbbaf\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe --Task1⤵
- Executes dropped EXE
PID:4264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5af6988dbc87cdc5156739e23211b4e3b
SHA1764e881de14df4ebd9da60c7115da12f746d3338
SHA2562eade990ea964a19eb75cc73578dabe4ccd7e43bd64b94d43d3c7fefcedd9361
SHA5124d2e2b88696bf6c1f6567677612d9e4fc0dc17a27f70808580c6c1918625941ab9cf3f6521e7b5d735956d37c920700044e8541655ba3ef6c31467dc69629262
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD50204d6c7a8052894123808928ef3a7b3
SHA1ed47516e93f31cecffda23425742f1b6a2e32f39
SHA25602b9ff79a74648f376161bb6804b8f7e4acf52f9a35666d4be4b558e78db9c01
SHA5126a956133e733e7ad5a50570c35e1d0eecf2fb12bfc8ef27a995a7eac09200d170420abd8505f1143e6219261fd6b32db5c9f26039a9f5f0f3efe9ca9876a29e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD523fdf789f165128c9cd3ffd55b2e0382
SHA1ebb6ed0505e7ba5adc546378f562c31f32f07f66
SHA2560ac336d636ef44d0588735d779e77686581719e28f37186898858da190867365
SHA5128d5b38655cae4099713272c8ffed66282339cb14c6e54989db994f088a177f69e4faccd08d45b3abe9be26c8c29983f314caf9abf175f1d176cde64196479c9a
-
C:\Users\Admin\AppData\Local\28f6c368-2b79-4145-893b-9c42f07bbbaf\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
Filesize1.1MB
MD55b3c8242aab49db13a10b3454bf14ac8
SHA19667f4b95635d6e464963b47a2b559ca8a6add94
SHA25681b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9
SHA5124aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32
-
C:\Users\Admin\AppData\Local\28f6c368-2b79-4145-893b-9c42f07bbbaf\81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
Filesize1.1MB
MD55b3c8242aab49db13a10b3454bf14ac8
SHA19667f4b95635d6e464963b47a2b559ca8a6add94
SHA25681b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9
SHA5124aa7493a8a978e67b3e7a6f2f6008b74ca92e7a2bf34846bec189180ffce1022c38b80af39d52713c36e026ff20c9e660c6f80157fc05de4c25b502f35a2be32