description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1sp90lD6.exe

pid	Process
2020	FI9jr13.exe
2420	dZ0ex92.exe
2756	lT7Md65.exe
2760	1sp90lD6.exe
2988	2Pw1401.exe

pid	Process
2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe
2020	FI9jr13.exe
2020	FI9jr13.exe
2420	dZ0ex92.exe
2420	dZ0ex92.exe
2756	lT7Md65.exe
2756	lT7Md65.exe
2760	1sp90lD6.exe
2756	lT7Md65.exe
2756	lT7Md65.exe
2988	2Pw1401.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	1sp90lD6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1sp90lD6.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	dZ0ex92.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	lT7Md65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	FI9jr13.exe

description	pid	Process	procid_target
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2080 wrote to memory of 2020	2080	f33535fb2813fbfee8e03ea80d11b1a9007db801ec8b6261277377c35d233ba7.exe	27
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2020 wrote to memory of 2420	2020	FI9jr13.exe	28
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2420 wrote to memory of 2756	2420	dZ0ex92.exe	29
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2760	2756	lT7Md65.exe	30
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2756 wrote to memory of 2988	2756	lT7Md65.exe	31
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2804	2988	2Pw1401.exe	34
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2988 wrote to memory of 2836	2988	2Pw1401.exe	35
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36
PID 2804 wrote to memory of 2844	2804	AppLaunch.exe	36

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads