description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	51593139.exe

pid	Process
960	un255172.exe
1180	51593139.exe
1916	rk575995.exe
1492	rk575995.exe
1556	si157445.exe

pid	Process
1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe
960	un255172.exe
960	un255172.exe
960	un255172.exe
1180	51593139.exe
960	un255172.exe
960	un255172.exe
1916	rk575995.exe
1916	rk575995.exe
1492	rk575995.exe
1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe
1556	si157445.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	51593139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	51593139.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un255172.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un255172.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe

description	pid	Process
Token: SeDebugPrivilege	1180	51593139.exe
Token: SeDebugPrivilege	1492	rk575995.exe

description	pid	Process	procid_target
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 1284 wrote to memory of 960	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	28
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1180	960	un255172.exe	29
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 960 wrote to memory of 1916	960	un255172.exe	30
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1916 wrote to memory of 1492	1916	rk575995.exe	31
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32
PID 1284 wrote to memory of 1556	1284	fb2fea52147f2fae6ab0be4b0a48887ba924826547858f65fa870fe490e442c1.exe	32

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.