resource	yara_rule
behavioral1/memory/2928-97-0x0000000000020000-0x000000000002A000-memory.dmp	healer
behavioral1/files/0x0006000000014b99-102.dat	healer
behavioral1/files/0x0006000000014b99-104.dat	healer
behavioral1/files/0x0006000000014b99-105.dat	healer
behavioral1/memory/1348-106-0x0000000001050000-0x000000000105A000-memory.dmp	healer

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b5934250.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b5934250.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b5934250.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b5934250.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b5934250.exe

pid	Process
3060	v3665369.exe
656	v9691337.exe
2844	v4825974.exe
2928	a4278579.exe
1348	b5934250.exe
1804	c8416204.exe

pid	Process
3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe
3060	v3665369.exe
3060	v3665369.exe
656	v9691337.exe
656	v9691337.exe
2844	v4825974.exe
2844	v4825974.exe
2844	v4825974.exe
2928	a4278579.exe
2844	v4825974.exe
656	v9691337.exe
656	v9691337.exe
1804	c8416204.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	b5934250.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b5934250.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	a4278579.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	a4278579.exe

description	pid	Process
Token: SeDebugPrivilege	2928	a4278579.exe
Token: SeDebugPrivilege	1348	b5934250.exe

description	pid	Process	procid_target
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3004 wrote to memory of 3060	3004	edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706.exe	28
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 3060 wrote to memory of 656	3060	v3665369.exe	29
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 656 wrote to memory of 2844	656	v9691337.exe	30
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 2928	2844	v4825974.exe	31
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 2844 wrote to memory of 1348	2844	v4825974.exe	33
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34
PID 656 wrote to memory of 1804	656	v9691337.exe	34

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.