description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr784687.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si702512.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

pid	Process
4212	un182856.exe
1640	un662817.exe
3876	pr784687.exe
4228	qu591528.exe
1852	rk676848.exe
1396	si702512.exe
2344	oneetx.exe
1204	oneetx.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr784687.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr784687.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un182856.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un662817.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un662817.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un182856.exe

pid	pid_target	Process	procid_target
4188	3876	WerFault.exe	79
3720	4228	WerFault.exe	84
1916	1396	WerFault.exe	89
3176	1396	WerFault.exe	89
3152	1396	WerFault.exe	89
2188	1396	WerFault.exe	89
2876	1396	WerFault.exe	89
804	1396	WerFault.exe	89
4280	1396	WerFault.exe	89
5068	1396	WerFault.exe	89
3824	1396	WerFault.exe	89
4776	1396	WerFault.exe	89
868	2344	WerFault.exe	109
3204	2344	WerFault.exe	109
1836	2344	WerFault.exe	109
2372	2344	WerFault.exe	109
3568	2344	WerFault.exe	109
4128	2344	WerFault.exe	109
1032	2344	WerFault.exe	109
3992	2344	WerFault.exe	109
4308	2344	WerFault.exe	109
3832	2344	WerFault.exe	109
1180	2344	WerFault.exe	109
4660	2344	WerFault.exe	109
316	2344	WerFault.exe	109
880	2344	WerFault.exe	109
4112	1204	WerFault.exe	143
1828	2344	WerFault.exe	109

description	pid	Process
Token: SeDebugPrivilege	3876	pr784687.exe
Token: SeDebugPrivilege	4228	qu591528.exe
Token: SeDebugPrivilege	1852	rk676848.exe

description	pid	Process	procid_target
PID 1220 wrote to memory of 4212	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	77
PID 1220 wrote to memory of 4212	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	77
PID 1220 wrote to memory of 4212	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	77
PID 4212 wrote to memory of 1640	4212	un182856.exe	78
PID 4212 wrote to memory of 1640	4212	un182856.exe	78
PID 4212 wrote to memory of 1640	4212	un182856.exe	78
PID 1640 wrote to memory of 3876	1640	un662817.exe	79
PID 1640 wrote to memory of 3876	1640	un662817.exe	79
PID 1640 wrote to memory of 3876	1640	un662817.exe	79
PID 1640 wrote to memory of 4228	1640	un662817.exe	84
PID 1640 wrote to memory of 4228	1640	un662817.exe	84
PID 1640 wrote to memory of 4228	1640	un662817.exe	84
PID 4212 wrote to memory of 1852	4212	un182856.exe	88
PID 4212 wrote to memory of 1852	4212	un182856.exe	88
PID 4212 wrote to memory of 1852	4212	un182856.exe	88
PID 1220 wrote to memory of 1396	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	89
PID 1220 wrote to memory of 1396	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	89
PID 1220 wrote to memory of 1396	1220	d917c622954a75b0972adcf0354c130d6dbb03c3cc1118d17c8170aa6d426276.exe	89
PID 1396 wrote to memory of 2344	1396	si702512.exe	109
PID 1396 wrote to memory of 2344	1396	si702512.exe	109
PID 1396 wrote to memory of 2344	1396	si702512.exe	109
PID 2344 wrote to memory of 100	2344	oneetx.exe	126
PID 2344 wrote to memory of 100	2344	oneetx.exe	126
PID 2344 wrote to memory of 100	2344	oneetx.exe	126
PID 2344 wrote to memory of 540	2344	oneetx.exe	140
PID 2344 wrote to memory of 540	2344	oneetx.exe	140
PID 2344 wrote to memory of 540	2344	oneetx.exe	140

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.