description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	296578853.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	296578853.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	296578853.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	296578853.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	296578853.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	187939042.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	369122206.exe

pid	Process
2652	Mg521563.exe
3696	WV283413.exe
4152	TJ448743.exe
804	187939042.exe
4136	296578853.exe
1584	369122206.exe
3672	oneetx.exe
4448	468850072.exe
4784	oneetx.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	187939042.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	296578853.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	WV283413.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	TJ448743.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	TJ448743.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	60a265179c75a31fae9bebd686c2221df5f82b571f26f6ebfb1a72bc354b6a40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	60a265179c75a31fae9bebd686c2221df5f82b571f26f6ebfb1a72bc354b6a40.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Mg521563.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Mg521563.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	WV283413.exe

description	pid	Process
Token: SeDebugPrivilege	804	187939042.exe
Token: SeDebugPrivilege	4136	296578853.exe
Token: SeDebugPrivilege	4448	468850072.exe

description	pid	Process	procid_target
PID 1040 wrote to memory of 2652	1040	60a265179c75a31fae9bebd686c2221df5f82b571f26f6ebfb1a72bc354b6a40.exe	83
PID 1040 wrote to memory of 2652	1040	60a265179c75a31fae9bebd686c2221df5f82b571f26f6ebfb1a72bc354b6a40.exe	83
PID 1040 wrote to memory of 2652	1040	60a265179c75a31fae9bebd686c2221df5f82b571f26f6ebfb1a72bc354b6a40.exe	83
PID 2652 wrote to memory of 3696	2652	Mg521563.exe	84
PID 2652 wrote to memory of 3696	2652	Mg521563.exe	84
PID 2652 wrote to memory of 3696	2652	Mg521563.exe	84
PID 3696 wrote to memory of 4152	3696	WV283413.exe	85
PID 3696 wrote to memory of 4152	3696	WV283413.exe	85
PID 3696 wrote to memory of 4152	3696	WV283413.exe	85
PID 4152 wrote to memory of 804	4152	TJ448743.exe	86
PID 4152 wrote to memory of 804	4152	TJ448743.exe	86
PID 4152 wrote to memory of 804	4152	TJ448743.exe	86
PID 4152 wrote to memory of 4136	4152	TJ448743.exe	89
PID 4152 wrote to memory of 4136	4152	TJ448743.exe	89
PID 4152 wrote to memory of 4136	4152	TJ448743.exe	89
PID 3696 wrote to memory of 1584	3696	WV283413.exe	92
PID 3696 wrote to memory of 1584	3696	WV283413.exe	92
PID 3696 wrote to memory of 1584	3696	WV283413.exe	92
PID 1584 wrote to memory of 3672	1584	369122206.exe	93
PID 1584 wrote to memory of 3672	1584	369122206.exe	93
PID 1584 wrote to memory of 3672	1584	369122206.exe	93
PID 2652 wrote to memory of 4448	2652	Mg521563.exe	94
PID 2652 wrote to memory of 4448	2652	Mg521563.exe	94
PID 2652 wrote to memory of 4448	2652	Mg521563.exe	94
PID 3672 wrote to memory of 1052	3672	oneetx.exe	95
PID 3672 wrote to memory of 1052	3672	oneetx.exe	95
PID 3672 wrote to memory of 1052	3672	oneetx.exe	95
PID 3672 wrote to memory of 2068	3672	oneetx.exe	97
PID 3672 wrote to memory of 2068	3672	oneetx.exe	97
PID 3672 wrote to memory of 2068	3672	oneetx.exe	97
PID 2068 wrote to memory of 1636	2068	cmd.exe	99
PID 2068 wrote to memory of 1636	2068	cmd.exe	99
PID 2068 wrote to memory of 1636	2068	cmd.exe	99
PID 2068 wrote to memory of 3872	2068	cmd.exe	100
PID 2068 wrote to memory of 3872	2068	cmd.exe	100
PID 2068 wrote to memory of 3872	2068	cmd.exe	100
PID 2068 wrote to memory of 1536	2068	cmd.exe	101
PID 2068 wrote to memory of 1536	2068	cmd.exe	101
PID 2068 wrote to memory of 1536	2068	cmd.exe	101
PID 2068 wrote to memory of 3796	2068	cmd.exe	102
PID 2068 wrote to memory of 3796	2068	cmd.exe	102
PID 2068 wrote to memory of 3796	2068	cmd.exe	102
PID 2068 wrote to memory of 3504	2068	cmd.exe	103
PID 2068 wrote to memory of 3504	2068	cmd.exe	103
PID 2068 wrote to memory of 3504	2068	cmd.exe	103
PID 2068 wrote to memory of 3772	2068	cmd.exe	104
PID 2068 wrote to memory of 3772	2068	cmd.exe	104
PID 2068 wrote to memory of 3772	2068	cmd.exe	104

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.