description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz2311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	w98pd88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz2311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz2311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz2311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz2311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	w98pd88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	w98pd88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	w98pd88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	w98pd88.exe

pid	Process
4660	za658222.exe
5108	za800321.exe
1568	za191149.exe
4040	tz2311.exe
2836	v4640xb.exe
4276	w98pd88.exe
4040	xrqqf48.exe
404	y88cC56.exe
3984	oneetx.exe
2440	oneetx.exe
5108	oneetx.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz2311.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	w98pd88.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	w98pd88.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za658222.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	za658222.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za800321.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	za800321.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	za191149.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	za191149.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe

description	pid	Process
Token: SeDebugPrivilege	4040	tz2311.exe
Token: SeDebugPrivilege	2836	v4640xb.exe
Token: SeDebugPrivilege	4276	w98pd88.exe
Token: SeDebugPrivilege	4040	xrqqf48.exe

description	pid	Process	procid_target
PID 4268 wrote to memory of 4660	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	66
PID 4268 wrote to memory of 4660	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	66
PID 4268 wrote to memory of 4660	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	66
PID 4660 wrote to memory of 5108	4660	za658222.exe	67
PID 4660 wrote to memory of 5108	4660	za658222.exe	67
PID 4660 wrote to memory of 5108	4660	za658222.exe	67
PID 5108 wrote to memory of 1568	5108	za800321.exe	68
PID 5108 wrote to memory of 1568	5108	za800321.exe	68
PID 5108 wrote to memory of 1568	5108	za800321.exe	68
PID 1568 wrote to memory of 4040	1568	za191149.exe	69
PID 1568 wrote to memory of 4040	1568	za191149.exe	69
PID 1568 wrote to memory of 2836	1568	za191149.exe	70
PID 1568 wrote to memory of 2836	1568	za191149.exe	70
PID 1568 wrote to memory of 2836	1568	za191149.exe	70
PID 5108 wrote to memory of 4276	5108	za800321.exe	72
PID 5108 wrote to memory of 4276	5108	za800321.exe	72
PID 5108 wrote to memory of 4276	5108	za800321.exe	72
PID 4660 wrote to memory of 4040	4660	za658222.exe	73
PID 4660 wrote to memory of 4040	4660	za658222.exe	73
PID 4660 wrote to memory of 4040	4660	za658222.exe	73
PID 4268 wrote to memory of 404	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	74
PID 4268 wrote to memory of 404	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	74
PID 4268 wrote to memory of 404	4268	b61cdc8a5a907871f98a8df02778399a5d39bb5061b3fd2d498380432bd1232e.exe	74
PID 404 wrote to memory of 3984	404	y88cC56.exe	75
PID 404 wrote to memory of 3984	404	y88cC56.exe	75
PID 404 wrote to memory of 3984	404	y88cC56.exe	75
PID 3984 wrote to memory of 4736	3984	oneetx.exe	76
PID 3984 wrote to memory of 4736	3984	oneetx.exe	76
PID 3984 wrote to memory of 4736	3984	oneetx.exe	76
PID 3984 wrote to memory of 4016	3984	oneetx.exe	79
PID 3984 wrote to memory of 4016	3984	oneetx.exe	79
PID 3984 wrote to memory of 4016	3984	oneetx.exe	79

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.