resource	yara_rule
behavioral16/memory/2460-82-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral16/memory/2460-83-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral16/memory/2460-84-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral16/memory/2460-86-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral16/memory/2460-88-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral16/memory/2460-90-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1xr29Lp5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1xr29Lp5.exe

pid	Process
2584	Xm8nn94.exe
2148	aN9yW71.exe
2696	rs1OO36.exe
2660	1xr29Lp5.exe
2528	2ti1092.exe

pid	Process
2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
2584	Xm8nn94.exe
2584	Xm8nn94.exe
2148	aN9yW71.exe
2148	aN9yW71.exe
2696	rs1OO36.exe
2696	rs1OO36.exe
2660	1xr29Lp5.exe
2696	rs1OO36.exe
2696	rs1OO36.exe
2528	2ti1092.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe
2808	WerFault.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1xr29Lp5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	1xr29Lp5.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	aN9yW71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	rs1OO36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Xm8nn94.exe

description	pid	Process	procid_target
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2432 wrote to memory of 2584	2432	913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe	28
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2584 wrote to memory of 2148	2584	Xm8nn94.exe	29
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2148 wrote to memory of 2696	2148	aN9yW71.exe	30
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2660	2696	rs1OO36.exe	31
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2696 wrote to memory of 2528	2696	rs1OO36.exe	32
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2460	2528	2ti1092.exe	34
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2528 wrote to memory of 2808	2528	2ti1092.exe	35
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36
PID 2460 wrote to memory of 2920	2460	AppLaunch.exe	36

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads