description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1.exe

pid	Process
2044	st983673.exe
844	81214228.exe
1252	1.exe
1260	kp143355.exe
1140	lr877551.exe

pid	Process
1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
2044	st983673.exe
2044	st983673.exe
844	81214228.exe
844	81214228.exe
2044	st983673.exe
2044	st983673.exe
1260	kp143355.exe
1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
1140	lr877551.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st983673.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st983673.exe

description	pid	Process
Token: SeDebugPrivilege	844	81214228.exe
Token: SeDebugPrivilege	1260	kp143355.exe
Token: SeDebugPrivilege	1252	1.exe

description	pid	Process	procid_target
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 1280 wrote to memory of 2044	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	28
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 2044 wrote to memory of 844	2044	st983673.exe	29
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 844 wrote to memory of 1252	844	81214228.exe	30
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 2044 wrote to memory of 1260	2044	st983673.exe	31
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32
PID 1280 wrote to memory of 1140	1280	ff942a6a39302124e8822579f265702cc50606edf0f09459e6265e38ef2e9cab.exe	32

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.