amadey | e660be79de0932d6c5c0f1b65dc5d842ed790962625d5dd8731c30f46ae264a2

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe
Size

573KB
MD5

0c7a698755d3a0db87584d0d86523f1c
SHA1

947927f32c7cb1d2a9d7fd43740d648a549b16ad
SHA256

41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45
SHA512

2ac6520c11a105ca384285531c7667c042a37e856b568f2e4be758ec96cf4941450bd3a33877fecd7a9bc3ef20e16fc0c10b98badedcab7fbdcbdeceb79f4d28
SSDEEP

12288:sMr6y90K4gJ+5yAyRaogaODZ6ELUn4UPljBancq:2ywyiaU3LI5Pzacq

Score

10^/10

amadey healer 32c858 dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.69

Botnet

32c858

http://77.91.124.242

Attributes

install_dir
550693dc87
install_file
oneetx.exe
strings_key
148c8260bc34f461da3708ace57fdffd
url_paths
/games/category/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral10/files/0x0008000000023253-12.dat	healer
behavioral10/memory/3272-15-0x0000000000FA0000-0x0000000000FAA000-memory.dmp	healer
behavioral10/memory/1212-38-0x0000000002310000-0x000000000232A000-memory.dmp	healer
behavioral10/memory/1212-40-0x00000000024F0000-0x0000000002508000-memory.dmp	healer
behavioral10/memory/1212-66-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-65-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-62-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-61-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-58-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-57-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-54-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-52-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-51-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-48-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-47-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-44-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-42-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-41-0x00000000024F0000-0x0000000002502000-memory.dmp	healer
behavioral10/memory/1212-68-0x00000000024F0000-0x0000000002502000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az853684.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az853684.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az853684.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az853684.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor5500.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az853684.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az853684.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor5500.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	bu386736.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 6 IoCs

pid	Process
3108	kina6349.exe
3272	az853684.exe
4604	bu386736.exe
740	oneetx.exe
1212	cor5500.exe
2912	oneetx.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor5500.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az853684.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina6349.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
3956	4604	WerFault.exe	92
1300	4604	WerFault.exe	92
4080	4604	WerFault.exe	92
1252	4604	WerFault.exe	92
3896	4604	WerFault.exe	92
4364	4604	WerFault.exe	92
4180	4604	WerFault.exe	92
4368	4604	WerFault.exe	92
4420	4604	WerFault.exe	92
4528	4604	WerFault.exe	92
348	4604	WerFault.exe	92
4144	740	WerFault.exe	115
1604	740	WerFault.exe	115
912	740	WerFault.exe	115
4332	740	WerFault.exe	115
384	740	WerFault.exe	115
3112	740	WerFault.exe	115
2336	740	WerFault.exe	115
3588	740	WerFault.exe	115
3628	740	WerFault.exe	115
2724	740	WerFault.exe	115
4860	740	WerFault.exe	115
3376	740	WerFault.exe	115
3560	740	WerFault.exe	115
3644	740	WerFault.exe	115
4312	1212	WerFault.exe	121
2352	740	WerFault.exe	115
2556	2912	WerFault.exe	162

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	az853684.exe
3272	az853684.exe
1212	cor5500.exe
1212	cor5500.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	az853684.exe
Token: SeDebugPrivilege	1212	cor5500.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4604	bu386736.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3108	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	90
PID 648 wrote to memory of 3108	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	90
PID 648 wrote to memory of 3108	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	90
PID 3108 wrote to memory of 3272	3108	kina6349.exe	91
PID 3108 wrote to memory of 3272	3108	kina6349.exe	91
PID 3108 wrote to memory of 4604	3108	kina6349.exe	92
PID 3108 wrote to memory of 4604	3108	kina6349.exe	92
PID 3108 wrote to memory of 4604	3108	kina6349.exe	92
PID 4604 wrote to memory of 740	4604	bu386736.exe	115
PID 4604 wrote to memory of 740	4604	bu386736.exe	115
PID 4604 wrote to memory of 740	4604	bu386736.exe	115
PID 648 wrote to memory of 1212	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	121
PID 648 wrote to memory of 1212	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	121
PID 648 wrote to memory of 1212	648	41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe	121
PID 740 wrote to memory of 4748	740	oneetx.exe	134
PID 740 wrote to memory of 4748	740	oneetx.exe	134
PID 740 wrote to memory of 4748	740	oneetx.exe	134
PID 740 wrote to memory of 1928	740	oneetx.exe	140
PID 740 wrote to memory of 1928	740	oneetx.exe	140
PID 740 wrote to memory of 1928	740	oneetx.exe	140
PID 1928 wrote to memory of 1240	1928	cmd.exe	144
PID 1928 wrote to memory of 1240	1928	cmd.exe	144
PID 1928 wrote to memory of 1240	1928	cmd.exe	144
PID 1928 wrote to memory of 3672	1928	cmd.exe	145
PID 1928 wrote to memory of 3672	1928	cmd.exe	145
PID 1928 wrote to memory of 3672	1928	cmd.exe	145
PID 1928 wrote to memory of 2440	1928	cmd.exe	146
PID 1928 wrote to memory of 2440	1928	cmd.exe	146
PID 1928 wrote to memory of 2440	1928	cmd.exe	146
PID 1928 wrote to memory of 636	1928	cmd.exe	147
PID 1928 wrote to memory of 636	1928	cmd.exe	147
PID 1928 wrote to memory of 636	1928	cmd.exe	147
PID 1928 wrote to memory of 4276	1928	cmd.exe	148
PID 1928 wrote to memory of 4276	1928	cmd.exe	148
PID 1928 wrote to memory of 4276	1928	cmd.exe	148
PID 1928 wrote to memory of 3460	1928	cmd.exe	149
PID 1928 wrote to memory of 3460	1928	cmd.exe	149
PID 1928 wrote to memory of 3460	1928	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe
"C:\Users\Admin\AppData\Local\Temp\41914bb3aa2d5a67292b5d348f81c71672076d674269fd9bfcbdb103aebf3d45.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6349.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6349.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az853684.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az853684.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu386736.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu386736.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 696
      4⤵
      Program crash
      PID:3956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 780
      4⤵
      Program crash
      PID:1300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 856
      4⤵
      Program crash
      PID:4080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 952
      4⤵
      Program crash
      PID:1252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 964
      4⤵
      Program crash
      PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1004
      4⤵
      Program crash
      PID:4364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1248
      4⤵
      Program crash
      PID:4180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1308
      4⤵
      Program crash
      PID:4368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1332
      4⤵
      Program crash
      PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1248
      4⤵
      Program crash
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\550693dc87\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\550693dc87\oneetx.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 692
        5⤵
        Program crash
        
        PID:4144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 852
        5⤵
        Program crash
        
        PID:1604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1012
        5⤵
        Program crash
        
        PID:912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1020
        5⤵
        Program crash
        
        PID:4332
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1080
        5⤵
        Program crash
        
        PID:384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1080
        5⤵
        Program crash
        
        PID:3112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1028
        5⤵
        Program crash
        
        PID:2336
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\550693dc87\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1000
        5⤵
        Program crash
        
        PID:3588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 728
        5⤵
        Program crash
        
        PID:3628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\550693dc87" /P "Admin:N"&&CACLS "..\550693dc87" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1240
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        6⤵
        
        PID:3672
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        6⤵
        
        PID:2440
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:636
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\550693dc87" /P "Admin:N"
        6⤵
        
        PID:4276
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\550693dc87" /P "Admin:R" /E
        6⤵
        
        PID:3460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1316
        5⤵
        Program crash
        
        PID:2724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1304
        5⤵
        Program crash
        
        PID:4860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1312
        5⤵
        Program crash
        
        PID:3376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 772
        5⤵
        Program crash
        
        PID:3560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1480
        5⤵
        Program crash
        
        PID:3644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 1096
        5⤵
        Program crash
        
        PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 1432
      4⤵
      Program crash
      PID:348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cor5500.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cor5500.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1084
    3⤵
    - Program crash
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4604 -ip 4604
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4604 -ip 4604
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4604 -ip 4604
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4604 -ip 4604
1⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4604 -ip 4604
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4604 -ip 4604
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4604 -ip 4604
1⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4604 -ip 4604
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4604 -ip 4604
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4604 -ip 4604
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4604 -ip 4604
1⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 740 -ip 740
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 740 -ip 740
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 740 -ip 740
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 740 -ip 740
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 740 -ip 740
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 740 -ip 740
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 740 -ip 740
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 740 -ip 740
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 740 -ip 740
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 740 -ip 740
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 740 -ip 740
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 740 -ip 740
1⤵
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 740 -ip 740
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 740 -ip 740
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1212 -ip 1212
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 740 -ip 740
1⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\550693dc87\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\550693dc87\oneetx.exe
1⤵
- Executes dropped EXE
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 312
  2⤵
  - Program crash
  PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2912 -ip 2912
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cor5500.exe

Filesize
233KB

MD5
23d3d221c8cf60bd9a81f8bedb04ff2a

SHA1
870edeeda592845c59276b8c44ec68096485f695

SHA256
10173ad9ac20ce47aea0f33e00949ab6973e909345e40d3e7ae7770450ea3390

SHA512
d8370629822e1647dd1e12e5e55af7e20f14e501e75b4a5f5a325b27c8d310e62b056157bd5377f94e360e1e02b2be89d2fd3265f3dfb8617a8c58824edb0339

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6349.exe

Filesize
309KB

MD5
03d1f1be079162c3323fbc8de0a632f5

SHA1
93f38d888883b0578ba99cda68b44a1987cb3a35

SHA256
0fa20357f2305002f79067838b7e288a7a14584d2a3dafc15fddf584d5965891

SHA512
94712b0bd77046eb840f79d7cf8421ba4687281e74e7d874b6190f90a43def5455a3587f4f7bab57e6b35dcc91811d9988ab1344ab5101002df7da9856dd5d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az853684.exe

Filesize
12KB

MD5
56bae4f60aabd5b07be9fdc97340f929

SHA1
1b39209e5b799fd74e40dd1ab656eae3a9051e94

SHA256
64b08b9eb38d3cd0bf360def44875485daeb4ab61a787102473741d72ea7a227

SHA512
1ed8376c9338c46aaf82e4b64d5df72533cd676325b6375abb86a4bcf3e00f686df9517620defdea7abebf2431ec3ffd6dc38f09d0024692c19e323532288b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu386736.exe

Filesize
227KB

MD5
0bd66d5530bfc96ec01f12cfbb5a7fac

SHA1
7b2044d306797c60d29c80ed3677b9771082847b

SHA256
6f5e0a2a8892e734e00269f36fcd2c00b15874f986ee1867fa8ac98fb0f3cf24

SHA512
c0507dde71b642790ed815794995a34cc9379fc7f1e7c807658f87f12dfbad28632464e05194d36e89691a933c55a035365e3675713230322961e0907404bd0e

Download Submit
memory/740-82-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/740-80-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/740-69-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1212-57-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-48-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-39-0x0000000004C50000-0x00000000051F4000-memory.dmp

Filesize
5.6MB

Download
memory/1212-40-0x00000000024F0000-0x0000000002508000-memory.dmp

Filesize
96KB

Download
memory/1212-66-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-65-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-62-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-61-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-58-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-72-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1212-54-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-52-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-51-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-38-0x0000000002310000-0x000000000232A000-memory.dmp

Filesize
104KB

Download
memory/1212-47-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-44-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-42-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-41-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-68-0x00000000024F0000-0x0000000002502000-memory.dmp

Filesize
72KB

Download
memory/1212-70-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2912-79-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3272-15-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

Filesize
40KB

Download
memory/3272-14-0x00007FF9EA473000-0x00007FF9EA475000-memory.dmp

Filesize
8KB

Download
memory/4604-21-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/4604-33-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download