description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	39918282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	39918282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	39918282.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	39918282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	39918282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	39918282.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	39918282.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	39918282.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st293748.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st293748.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe

description	pid	Process
Token: SeDebugPrivilege	1484	39918282.exe
Token: SeDebugPrivilege	1008	kp811705.exe

description	pid	Process	procid_target
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1156 wrote to memory of 1928	1156	064f64f786dca12c052b72854095d23ae28a5a0fff32f2458158a7c8ad386171.exe	27
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1484	1928	st293748.exe	28
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29
PID 1928 wrote to memory of 1008	1928	st293748.exe	29

Analysis

Sharing