Analysis
-
max time kernel
37s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2025, 13:08
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Extracted
lumma
https://fancywaxxers.shop/api
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 560 set thread context of 2124 560 Script.exe 118 PID 2600 set thread context of 2764 2600 Script.exe 125 PID 388 set thread context of 4540 388 Script.exe 131 PID 3448 set thread context of 4356 3448 Script.exe 138 PID 4880 set thread context of 1012 4880 Script.exe 144 PID 1184 set thread context of 1716 1184 Script.exe 149 PID 4612 set thread context of 3696 4612 Script.exe 154 -
Program crash 7 IoCs
pid pid_target Process procid_target 264 560 WerFault.exe 114 4692 2600 WerFault.exe 123 4464 388 WerFault.exe 129 4500 3448 WerFault.exe 135 4776 4880 WerFault.exe 142 1816 1184 WerFault.exe 147 4776 4612 WerFault.exe 152 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Script.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133805561029986671" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe Token: SeShutdownPrivilege 4872 chrome.exe Token: SeCreatePagefilePrivilege 4872 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4848 4872 chrome.exe 83 PID 4872 wrote to memory of 4848 4872 chrome.exe 83 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 4380 4872 chrome.exe 84 PID 4872 wrote to memory of 5080 4872 chrome.exe 85 PID 4872 wrote to memory of 5080 4872 chrome.exe 85 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86 PID 4872 wrote to memory of 844 4872 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/bafym21/Seliware-Executor/releases/download/Download/script.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffd576ecc40,0x7ffd576ecc4c,0x7ffd576ecc582⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1876 /prefetch:22⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4800 /prefetch:82⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4512,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4344,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:1572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5424,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5580,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:22⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5380,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:3572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5416,i,278232112188196014,7381310312468253825,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4348 /prefetch:12⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2700
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2284
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 7962⤵
- Program crash
PID:264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 560 -ip 5601⤵PID:4284
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 7842⤵
- Program crash
PID:4692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2600 -ip 26001⤵PID:2852
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:388 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 7642⤵
- Program crash
PID:4464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 388 -ip 3881⤵PID:4500
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵PID:3696
-
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 7722⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3448 -ip 34481⤵PID:3464
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 7802⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4880 -ip 48801⤵PID:4328
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1184 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 1562⤵
- Program crash
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1184 -ip 11841⤵PID:1148
-
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Users\Admin\Downloads\script\Script.exe"C:\Users\Admin\Downloads\script\Script.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 1562⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4612 -ip 46121⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5ac15105a9b307004461f5e081d150e3a
SHA1268146b4ded31dc13184be599e89da05d34fb4f2
SHA2561c6212459b68d8de3b69b799964ccf96e32666633ca8f96dffb39cb2de0ff0ae
SHA51242212ceb2324efa13b438c01d7f432ab93670b763159b83e2465cbd8b35804a4362ecea62fe2fa36ee330ce46ec94337351aa60f56ecc70fe28ec275f478f9d4
-
Filesize
432B
MD5b142bb8fe8472d56f0c877a330a8a4dc
SHA1617deb7390026301eefc14b71e23aa59cd32a6aa
SHA256ee76725cb2889845ee9b95b6074cfc202e7b32bf03a61609ee8afa5cd2e9f214
SHA5129d0254838b968e537fa1549e5d177acabdb85d0e717b242623ae8bf7e4fa9eb2961655274ba71222481a0b92420341589370ef24d0ad032e21cf16021f238250
-
Filesize
2KB
MD5b7ebd129ac4db24312d4940287a7eb39
SHA1e72ddf9fe28257254286ce6b960d971c86f1f16a
SHA256198ea38b04091ee691fd73b1c00295ec72009a986d88666230b499580600c7fd
SHA512f0f61878cb1a00140cb1227e22ab48132e9091d3c201d239298aa01063024a8d7c28cf913a330bb0a9444b1d8cac86e6ccc3bf6666b270feb6d003101476f3f5
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD535d2a75256b57e50cd3decfec0dd116a
SHA1c63de5a649883f489dee447f11034d1370d80b94
SHA2566a7f60a5b2cad29e3de7fced8cbc1cc19042a86320362e62c3b4c35de1720e60
SHA512d26c67ef41e8e2c293723bca2d25deded8d7603b27ab309d00cd49021b0c911c209afeb4e4b200b966a45a208145920c34cd3fd26e140a399be5b29730fc138d
-
Filesize
9KB
MD5509971435b6e6f8b83f49830e8c231f9
SHA1fcbbffa095cf1cb223a64dc74c00c85239f75359
SHA25617e514e575aaf9094f50cd3c292dd3c356d15525d7f20f593531f6fb3e3d6ac7
SHA5124133abd10ae089889d18cb003cf325650d8341a475c52ab3b868ea02cdcfe86c53887296db343718dab362a50e58f654c23b3d5303c880e3faadabb2a5532eb3
-
Filesize
9KB
MD54b65055e5753319799536517bba934f5
SHA144ffdfcb2b96263e2bfad3611aeff2ed717c35fa
SHA256c1d75f49e28366930d9bb13f109551980e1b18b79c1f4d2c29aba18f20046667
SHA512cd234c3c195d058cfeea5be4233145849a3468e7451ab4e10943b1e9ef523f89c8f7c8cedb6d241b2e26dad1ea00396dbee0ca282091f0bbf294dde887532013
-
Filesize
116KB
MD5b41a549aac8a2e716165451b1b149ff0
SHA124ea83eba3b630f1566fa446cbf70144bb5a80dd
SHA256e036cc3864ea81b6709bae779631dad8c9b5e36da0da4827fe36e10886a47ccd
SHA512013931493ac54f536e98316710bb1caa86554853df6199b79d339bc5c4bacdf110fc0a64ac8e7fb9cfbb7baed90eb8d3615b220f3a5202236751aae352b1ebb0
-
Filesize
5.4MB
MD5a8f18d05ee349962e2f6c4ec12c31adc
SHA1decabb22b693adde8b9a50561705750d36063506
SHA25660881fb0340f0104136d089421f819b3f42bbd5b42a095b6a66cfb756ec0d09a
SHA5123303f2ac273617cf74579235984c6e60836a87b46726f9a96eb876af53b0a84adc7aef3b3f3462264218befbf39e673c9799a657cfbb670488971a9eaf2ceec1