Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 11:59
Behavioral task
behavioral1
Sample
eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe
Resource
win10v2004-20241007-en
General
-
Target
eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe
-
Size
1.1MB
-
MD5
98aa995281d54e290bf817c069e6822e
-
SHA1
7fba034a4bd7dc491bba49d39c1ce497b05af981
-
SHA256
eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac
-
SHA512
a5416dc55ce0010cfddbb607e1e42b94f3153f04f9d5accd9c3ae33dcf85fe9e7482ea1186cee72cce4f21c9c3769e8340397e4c77302190c7b9da7bdf859da5
-
SSDEEP
24576:qOwPit8f/ust6uHU9QBz4cbvsJ72Zu5vhNUp741cv/HA:qN6Mfh4PJYuhUpmcng
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 34 IoCs
resource yara_rule behavioral2/memory/5012-2-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/5012-3-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/5012-1-0x0000000000401000-0x000000000043F000-memory.dmp modiloader_stage2 behavioral2/memory/5012-4-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/5012-14-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/5012-16-0x0000000000401000-0x000000000043F000-memory.dmp modiloader_stage2 behavioral2/memory/3056-17-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-18-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-25-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-26-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-27-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-28-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-29-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-30-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-31-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-32-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-33-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-34-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-36-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-37-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-38-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-39-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-41-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-43-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-45-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-47-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-49-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-51-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-53-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-55-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-57-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-59-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-61-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 behavioral2/memory/3056-63-0x0000000000400000-0x0000000000513000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe -
Executes dropped EXE 1 IoCs
pid Process 3056 mstwain32.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine mstwain32.exe -
Loads dropped DLL 2 IoCs
pid Process 3056 mstwain32.exe 3056 mstwain32.exe -
resource yara_rule behavioral2/memory/5012-0-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/5012-2-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/5012-3-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/5012-4-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/files/0x006e000000023ba7-9.dat themida behavioral2/memory/5012-14-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-13-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-17-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-18-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-25-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-26-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-27-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-28-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-29-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-30-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-31-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-32-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-33-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-34-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-36-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-37-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-38-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-39-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-41-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-43-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-45-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-47-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-49-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-51-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-53-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-55-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-57-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-59-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-61-0x0000000000400000-0x0000000000513000-memory.dmp themida behavioral2/memory/3056-63-0x0000000000400000-0x0000000000513000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 3056 mstwain32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\mstwain32.exe eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe File opened for modification C:\Windows\mstwain32.exe eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 50 IoCs
pid pid_target Process procid_target 4172 5012 WerFault.exe 82 4616 5012 WerFault.exe 82 2276 5012 WerFault.exe 82 1292 5012 WerFault.exe 82 4800 5012 WerFault.exe 82 3764 5012 WerFault.exe 82 1424 5012 WerFault.exe 82 4124 5012 WerFault.exe 82 3524 5012 WerFault.exe 82 4824 5012 WerFault.exe 82 2904 5012 WerFault.exe 82 5016 5012 WerFault.exe 82 3272 5012 WerFault.exe 82 556 5012 WerFault.exe 82 844 5012 WerFault.exe 82 4176 5012 WerFault.exe 82 2696 5012 WerFault.exe 82 2052 5012 WerFault.exe 82 3648 5012 WerFault.exe 82 3168 5012 WerFault.exe 82 692 5012 WerFault.exe 82 1108 5012 WerFault.exe 82 2100 5012 WerFault.exe 82 2212 5012 WerFault.exe 82 1740 5012 WerFault.exe 82 4528 3056 WerFault.exe 135 4976 3056 WerFault.exe 135 4908 3056 WerFault.exe 135 2308 3056 WerFault.exe 135 4812 3056 WerFault.exe 135 3244 3056 WerFault.exe 135 460 3056 WerFault.exe 135 3036 3056 WerFault.exe 135 4196 3056 WerFault.exe 135 5016 3056 WerFault.exe 135 1432 3056 WerFault.exe 135 4832 3056 WerFault.exe 135 4596 3056 WerFault.exe 135 2516 3056 WerFault.exe 135 3368 3056 WerFault.exe 135 2724 3056 WerFault.exe 135 4736 3056 WerFault.exe 135 4324 3056 WerFault.exe 135 2872 3056 WerFault.exe 135 1616 3056 WerFault.exe 135 4552 3056 WerFault.exe 135 3488 3056 WerFault.exe 135 1512 3056 WerFault.exe 135 4756 3056 WerFault.exe 135 4192 3056 WerFault.exe 135 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstwain32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 3056 mstwain32.exe 3056 mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe Token: SeDebugPrivilege 3056 mstwain32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3056 mstwain32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5012 wrote to memory of 3056 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 135 PID 5012 wrote to memory of 3056 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 135 PID 5012 wrote to memory of 3056 5012 eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe 135 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe"C:\Users\Admin\AppData\Local\Temp\eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac.exe"1⤵
- Checks computer location settings
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 2922⤵
- Program crash
PID:4172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 3162⤵
- Program crash
PID:4616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4882⤵
- Program crash
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5082⤵
- Program crash
PID:1292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5242⤵
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5162⤵
- Program crash
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5322⤵
- Program crash
PID:1424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5242⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5882⤵
- Program crash
PID:3524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5962⤵
- Program crash
PID:4824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 6082⤵
- Program crash
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 6242⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5802⤵
- Program crash
PID:3272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5322⤵
- Program crash
PID:556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5842⤵
- Program crash
PID:844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4962⤵
- Program crash
PID:4176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 2802⤵
- Program crash
PID:2696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5802⤵
- Program crash
PID:2052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4842⤵
- Program crash
PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 3122⤵
- Program crash
PID:3168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4922⤵
- Program crash
PID:692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5442⤵
- Program crash
PID:1108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4842⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5802⤵
- Program crash
PID:2212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 4962⤵
- Program crash
PID:1740
-
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 2843⤵
- Program crash
PID:4528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 3323⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5083⤵
- Program crash
PID:4908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5283⤵
- Program crash
PID:2308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5483⤵
- Program crash
PID:4812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5563⤵
- Program crash
PID:3244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5803⤵
- Program crash
PID:460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6043⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6403⤵
- Program crash
PID:4196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6483⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6603⤵
- Program crash
PID:1432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5203⤵
- Program crash
PID:4832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6683⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6483⤵
- Program crash
PID:2516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7003⤵
- Program crash
PID:3368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 7283⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6483⤵
- Program crash
PID:4736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6123⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6843⤵
- Program crash
PID:2872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6523⤵
- Program crash
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5563⤵
- Program crash
PID:4552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5483⤵
- Program crash
PID:3488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 6443⤵
- Program crash
PID:1512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5603⤵
- Program crash
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 5683⤵
- Program crash
PID:4192
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 50121⤵PID:4068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5012 -ip 50121⤵PID:2760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5012 -ip 50121⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5012 -ip 50121⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5012 -ip 50121⤵PID:4180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5012 -ip 50121⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5012 -ip 50121⤵PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5012 -ip 50121⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5012 -ip 50121⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5012 -ip 50121⤵PID:752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5012 -ip 50121⤵PID:2460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5012 -ip 50121⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5012 -ip 50121⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5012 -ip 50121⤵PID:472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5012 -ip 50121⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5012 -ip 50121⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5012 -ip 50121⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5012 -ip 50121⤵PID:4776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5012 -ip 50121⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5012 -ip 50121⤵PID:60
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5012 -ip 50121⤵PID:3280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5012 -ip 50121⤵PID:3772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5012 -ip 50121⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5012 -ip 50121⤵PID:3048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5012 -ip 50121⤵PID:2536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3056 -ip 30561⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3056 -ip 30561⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3056 -ip 30561⤵PID:1372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3056 -ip 30561⤵PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3056 -ip 30561⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3056 -ip 30561⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3056 -ip 30561⤵PID:4988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3056 -ip 30561⤵PID:684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3056 -ip 30561⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3056 -ip 30561⤵PID:4848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 30561⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3056 -ip 30561⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3056 -ip 30561⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3056 -ip 30561⤵PID:60
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3056 -ip 30561⤵PID:3620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3056 -ip 30561⤵PID:3264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3056 -ip 30561⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3056 -ip 30561⤵PID:2100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 30561⤵PID:2212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3056 -ip 30561⤵PID:1740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3056 -ip 30561⤵PID:3404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3056 -ip 30561⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 30561⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 30561⤵PID:4484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 30561⤵PID:4112
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD598aa995281d54e290bf817c069e6822e
SHA17fba034a4bd7dc491bba49d39c1ce497b05af981
SHA256eccf78053d8501aca661dbb1c4ef2b1ef96e903f21db5e9a377aed6771e6cfac
SHA512a5416dc55ce0010cfddbb607e1e42b94f3153f04f9d5accd9c3ae33dcf85fe9e7482ea1186cee72cce4f21c9c3769e8340397e4c77302190c7b9da7bdf859da5
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350