Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 19:05
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win10v2004-20241007-en
General
-
Target
setup_installer.exe
-
Size
4.8MB
-
MD5
ec02f21e9609989b9dc71c981be1b38d
-
SHA1
b06e15ef538626113b9a5cfbe70cb31480f2ca65
-
SHA256
ffb56fbf4fcddd75123912dc66dab62c57bb790bb3f66fbff5f247760755fd06
-
SHA512
20d8b49e3b770c92d084b319c6c1f0e4e643b42f0e9cb8b5d117344abce63607b30cbcdfb391ce7a82cf03aa0f4c20c419129d5394ecea4f40ed495bd3dbbd46
-
SSDEEP
98304:xyCvLUBsgTFOLElweJs9kAo4K25044DU6GxctGSswIm5W8Nneh:xDLUCgROol6kU0TGW3Leh
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
nullmixer
http://sornx.xyz/
Extracted
redline
pub1
viacetequn.site:80
Signatures
-
CryptBot payload 3 IoCs
resource yara_rule behavioral4/memory/5032-190-0x0000000006060000-0x0000000006103000-memory.dmp family_cryptbot behavioral4/memory/5032-191-0x0000000006060000-0x0000000006103000-memory.dmp family_cryptbot behavioral4/memory/5032-192-0x0000000006060000-0x0000000006103000-memory.dmp family_cryptbot -
Cryptbot family
-
Nullmixer family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral4/memory/1384-158-0x0000000004B10000-0x0000000004B32000-memory.dmp family_redline behavioral4/memory/1384-161-0x0000000004B60000-0x0000000004B80000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 2 IoCs
resource yara_rule behavioral4/memory/1384-158-0x0000000004B10000-0x0000000004B32000-memory.dmp family_sectoprat behavioral4/memory/1384-161-0x0000000004B60000-0x0000000004B80000-memory.dmp family_sectoprat -
Sectoprat family
-
Vidar family
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral4/memory/3000-178-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1768 powershell.exe -
resource yara_rule behavioral4/files/0x0007000000023c97-42.dat aspack_v212_v242 behavioral4/files/0x0007000000023c9a-49.dat aspack_v212_v242 behavioral4/files/0x0007000000023c98-44.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Mon14585024febb5.exe -
Executes dropped EXE 13 IoCs
pid Process 4040 setup_install.exe 2136 Mon1469355885.exe 3000 Mon14f40f9f7773345d.exe 2644 Mon14541c639b30ce5.exe 1552 Mon1467890ab07c10e.exe 1384 Mon14095335954ba1f.exe 2516 Mon141f1ef356ba1.exe 1388 Mon14365bf6c89d2abf.exe 3608 Mon14b0530bbd5cb.exe 1912 Mon14585024febb5.exe 3616 Mon14585024febb5.exe 3084 Prendero.exe.com 5032 Prendero.exe.com -
Loads dropped DLL 6 IoCs
pid Process 4040 setup_install.exe 4040 setup_install.exe 4040 setup_install.exe 4040 setup_install.exe 4040 setup_install.exe 4040 setup_install.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Mon14b0530bbd5cb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3680 2136 WerFault.exe 101 2976 3000 WerFault.exe 102 -
System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14365bf6c89d2abf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14b0530bbd5cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon1469355885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14f40f9f7773345d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14095335954ba1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5060 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Prendero.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Prendero.exe.com -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5060 PING.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1768 powershell.exe 1768 powershell.exe 1768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2644 Mon14541c639b30ce5.exe Token: SeDebugPrivilege 1768 powershell.exe Token: SeDebugPrivilege 2516 Mon141f1ef356ba1.exe Token: SeDebugPrivilege 1384 Mon14095335954ba1f.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3084 Prendero.exe.com 3084 Prendero.exe.com 3084 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 3084 Prendero.exe.com 3084 Prendero.exe.com 3084 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com 5032 Prendero.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4040 2604 setup_installer.exe 87 PID 2604 wrote to memory of 4040 2604 setup_installer.exe 87 PID 2604 wrote to memory of 4040 2604 setup_installer.exe 87 PID 4040 wrote to memory of 4676 4040 setup_install.exe 90 PID 4040 wrote to memory of 4676 4040 setup_install.exe 90 PID 4040 wrote to memory of 4676 4040 setup_install.exe 90 PID 4040 wrote to memory of 3636 4040 setup_install.exe 91 PID 4040 wrote to memory of 3636 4040 setup_install.exe 91 PID 4040 wrote to memory of 3636 4040 setup_install.exe 91 PID 4040 wrote to memory of 4152 4040 setup_install.exe 92 PID 4040 wrote to memory of 4152 4040 setup_install.exe 92 PID 4040 wrote to memory of 4152 4040 setup_install.exe 92 PID 4040 wrote to memory of 3096 4040 setup_install.exe 93 PID 4040 wrote to memory of 3096 4040 setup_install.exe 93 PID 4040 wrote to memory of 3096 4040 setup_install.exe 93 PID 4040 wrote to memory of 2224 4040 setup_install.exe 94 PID 4040 wrote to memory of 2224 4040 setup_install.exe 94 PID 4040 wrote to memory of 2224 4040 setup_install.exe 94 PID 4040 wrote to memory of 2312 4040 setup_install.exe 95 PID 4040 wrote to memory of 2312 4040 setup_install.exe 95 PID 4040 wrote to memory of 2312 4040 setup_install.exe 95 PID 4040 wrote to memory of 3660 4040 setup_install.exe 96 PID 4040 wrote to memory of 3660 4040 setup_install.exe 96 PID 4040 wrote to memory of 3660 4040 setup_install.exe 96 PID 4040 wrote to memory of 3900 4040 setup_install.exe 97 PID 4040 wrote to memory of 3900 4040 setup_install.exe 97 PID 4040 wrote to memory of 3900 4040 setup_install.exe 97 PID 4040 wrote to memory of 948 4040 setup_install.exe 98 PID 4040 wrote to memory of 948 4040 setup_install.exe 98 PID 4040 wrote to memory of 948 4040 setup_install.exe 98 PID 4040 wrote to memory of 2724 4040 setup_install.exe 99 PID 4040 wrote to memory of 2724 4040 setup_install.exe 99 PID 4040 wrote to memory of 2724 4040 setup_install.exe 99 PID 4676 wrote to memory of 1768 4676 cmd.exe 100 PID 4676 wrote to memory of 1768 4676 cmd.exe 100 PID 4676 wrote to memory of 1768 4676 cmd.exe 100 PID 4152 wrote to memory of 2136 4152 cmd.exe 101 PID 4152 wrote to memory of 2136 4152 cmd.exe 101 PID 4152 wrote to memory of 2136 4152 cmd.exe 101 PID 2224 wrote to memory of 3000 2224 cmd.exe 102 PID 2224 wrote to memory of 3000 2224 cmd.exe 102 PID 2224 wrote to memory of 3000 2224 cmd.exe 102 PID 2724 wrote to memory of 2644 2724 cmd.exe 103 PID 2724 wrote to memory of 2644 2724 cmd.exe 103 PID 3096 wrote to memory of 1552 3096 cmd.exe 104 PID 3096 wrote to memory of 1552 3096 cmd.exe 104 PID 2312 wrote to memory of 1384 2312 cmd.exe 105 PID 2312 wrote to memory of 1384 2312 cmd.exe 105 PID 2312 wrote to memory of 1384 2312 cmd.exe 105 PID 3636 wrote to memory of 1912 3636 cmd.exe 106 PID 3636 wrote to memory of 1912 3636 cmd.exe 106 PID 3636 wrote to memory of 1912 3636 cmd.exe 106 PID 3900 wrote to memory of 2516 3900 cmd.exe 107 PID 3900 wrote to memory of 2516 3900 cmd.exe 107 PID 3660 wrote to memory of 1388 3660 cmd.exe 108 PID 3660 wrote to memory of 1388 3660 cmd.exe 108 PID 3660 wrote to memory of 1388 3660 cmd.exe 108 PID 948 wrote to memory of 3608 948 cmd.exe 109 PID 948 wrote to memory of 3608 948 cmd.exe 109 PID 948 wrote to memory of 3608 948 cmd.exe 109 PID 3608 wrote to memory of 4300 3608 Mon14b0530bbd5cb.exe 110 PID 3608 wrote to memory of 4300 3608 Mon14b0530bbd5cb.exe 110 PID 3608 wrote to memory of 4300 3608 Mon14b0530bbd5cb.exe 110 PID 3608 wrote to memory of 2256 3608 Mon14b0530bbd5cb.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14585024febb5.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exeMon14585024febb5.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe"C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe" -a5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3616
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1469355885.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1469355885.exeMon1469355885.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 3605⤵
- Program crash
PID:3680
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1467890ab07c10e.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1467890ab07c10e.exeMon1467890ab07c10e.exe4⤵
- Executes dropped EXE
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14f40f9f7773345d.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14f40f9f7773345d.exeMon14f40f9f7773345d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 10285⤵
- Program crash
PID:2976
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14095335954ba1f.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14095335954ba1f.exeMon14095335954ba1f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14365bf6c89d2abf.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14365bf6c89d2abf.exeMon14365bf6c89d2abf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon141f1ef356ba1.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon141f1ef356ba1.exeMon141f1ef356ba1.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14b0530bbd5cb.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14b0530bbd5cb.exeMon14b0530bbd5cb.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵PID:4300
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Mummia.wmz5⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd6⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz7⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comPrendero.exe.com z7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5032
-
-
-
C:\Windows\SysWOW64\PING.EXEping SPDEBJWH -n 307⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5060
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14541c639b30ce5.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14541c639b30ce5.exeMon14541c639b30ce5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2136 -ip 21361⤵PID:2388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3000 -ip 30001⤵PID:3652
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57ca9b067d8b892ad53c2b6cff0f44b5d
SHA182b90d1dd02d7cf599766415bd2e1a71f7c7b476
SHA256140bea1de9cb936d55de4f41e37b89e71610935a1382621f46701e2b83674c8f
SHA5122b1d02d0db9bdf2e8b1317c5b8698959d4b10bc175c588a08e4d20a74bd711399a1fd9939c809f459272f01371974ad77098c4022e804006893ac1c8c39cdf2f
-
Filesize
1KB
MD56764fe365abbe88217d1f55605a577ab
SHA1eaa2e7ab4ad1fab10389b0550ceafd08ec66f12b
SHA256e69dc1daf50c3a83f8f8158f5ada238fc84bf8eb56c741303349cc529058533a
SHA512fbdf5af6dbdc59c3f95e50360cf8b6f71043933074b5ab9de16ee529c6eb27b5218c7aef097fa24b9a7632b4af32baed02fd5c234b89fc4a76c3f1d6ce5f43f6
-
Filesize
5KB
MD5bb11ba5aae14a28c7983133a03693b6a
SHA1fe19203a47398b38b8cb17ae64c007c843d9f3b2
SHA2564b2071bfeaf9103f5d355e3aaf60ad1829b68311b05a7d7ff048eadb06869413
SHA512de8ebae8bb877f3d1832211df385dd8af93a771b9d7f23d3338b60cc63cdf73603d42cca25d7cb9d2ed787f8e799dcb7bc03744a69bc5dd1eb7a6d77def3dfc6
-
Filesize
47KB
MD5ba9eacbb3630e0a7e208503c84302bcf
SHA1e69df423ee32ce4fdcf986d737aebbc5cd914466
SHA256d4dc4f7f3d14c110d0206c7c2d2dc0ed12820a28cc7cd03292102d615d5a989f
SHA5129810763133178c09a1ab8f72656529714f6beba2d9345b734b20351dbcc99dd306ca9ffd5b3e656f2894c00771a1766471a9c47d6e9818a1bd817aded132290c
-
Filesize
7KB
MD5e2439cb9c891af911fb24b3f888537c0
SHA145a5feac3c6271d9651ae26d40e08f97d1968d3f
SHA25620ad2647ac86ec8178845531686aaf01a13a72bf6347b22975d1982caec6001b
SHA5129406ad088df175e7556d39b7a53bf9a2c8bac00e0585fbb99c6a419f0f1b6709372a9ab4507fd8f152f9a77344db18ff3c34fd16e6750e188d3866b02e4e28f7
-
Filesize
41KB
MD56896c2de3ea6ebd9d67bc9696a721d05
SHA1ce42c274a5eb2e8fabc5a154ea577931c6ac2e83
SHA2560f80867cb6b14147f47706318c0bc16a245a3b4c8cdca9b902c52f4074d338ec
SHA5129a2e3a0f8f69649edfaef6070f58e407d7e1afc9ec042f2d32b02f046ef06d2906e906510c6329d12c1844a99d597a067231de5f9ca317432e5cf3d3630f8420
-
Filesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
Filesize
192KB
MD5ea5d2a70de26a3f2ce92d1b02b2f3052
SHA166045b40d6aebc6a2930c76c6d492fb5fc81426f
SHA2567abf7953b1532eec5dd50fb9098269a8cd7b65e9afc9d84031039ff9da63f909
SHA5121437877ea36bf59eb74eef0415f820507fa55bb07b17b59679454e02a99bf48884bfdd0706175a168a005ce9a672b0fbdc904da7a35242402567f06bf22d322b
-
Filesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
Filesize
8KB
MD5408f2c9252ad66429a8d5401f1833db3
SHA13829d2d03a728ecd59b38cc189525220a60c05db
SHA256890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664
SHA512d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
900KB
MD50a0d22f1c9179a67d04166de0db02dbb
SHA1106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA256a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
SHA5128abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
-
Filesize
272KB
MD5fa37623638231d4c2b671b04a021a984
SHA17a446ffddc37e4a6dafd3f45d3d7c34c26885ce6
SHA25626a9fde966bc459d278a1ce94d59cb95b1a152efb217164ca62fc15a15c68fbe
SHA512730ba1cc1d9febba94572669a424695c06f03ac478255a61202f68eab45d8cdc60b0c341c005fc0b48b9f2048c7ebdfeaec8e28cf8b040be345790c930f6588b
-
Filesize
1.3MB
MD512b8842dded9134ad0cae031c4f06530
SHA1c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e
SHA256abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17
SHA512967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825
-
Filesize
609KB
MD53b2ca1aae0f3a277efde19ed66785e07
SHA1edfd0bb11c0baec2475149259c8a88a61a669de9
SHA256c65369fd8f5f8a6bcee8325879e912f7f5e5f37e40281077a4902668458887b1
SHA512191aa807ec2c9a663eef6439084fcc68cdba245d9924773d65f42286af1df31238931425de1c18a4b643c7cd9ac4e98e638994630af440b7a1556c1497c8bb25
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD5febbfc26db3b9b63c26a253d83685c61
SHA196efbac726821400049db0a1508566e0bce7ce1a
SHA25676b67dbf3cdf622e3266419e7acbbf9d7e3e22c1a3ef5eceec90ebda296b65ff
SHA512f14bf151bf40064f3ef9bee9671c7f5f3689a17bbfaa9319394f8b7178c82fdb29a133f48c8d0ad3ae89b63733667ff695d762dc031659a01714d823320b556c
-
Filesize
4.3MB
MD5a1ac3489d2401d26e3aea9bcb0a85b10
SHA16a4c4004ef746ed16d25c3fe425a6c78fcefe9b4
SHA2561cb9452373f7b755b1c64b41bd7ffcfe4fe0ab92fd08c61c283c5deccfd89146
SHA512293a84faadb89219945fde5836786cbcf4bdcaf36638603a5e95e80df4f5daf0b180d1f768deecee77b828ef736a337925479c37ae1e1f7126934f80be7b5e2e
-
Filesize
576B
MD56f6fe96279c933c2170e75f49cf43718
SHA1bbe211eaebbeb120b9ca3cd204aacbbeef20cb7e
SHA256e6919da4e2658c82ebbcca670053d77e1231a5a600bf5aeaba71e5852e09022f
SHA51276160b79d3cbe2fca6d95b096043641a96b13007f287f8e55b94eab16cbb98691a8e8fa8d035da434e84f689bb8d36478f632976481b56c7170889553a629748
-
Filesize
872KB
MD53928f9cc043cfb53823761dac703fd04
SHA1c825e75ae21b995996763487de07176230c2535e
SHA256c2d4ebb0b7be8eb8683cc1fdcd0b95c834888c56d555e6d23497ae211835f412
SHA5128739619195c9d1409819822ae3c53415ac57a1c485b6947022d81981c9a0c7811ea5a30af0ef32e0a34aacf589f74366866dc1e7e03cd4addf56b71b6b25d9c5
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82