description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1xj66Nf3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1xj66Nf3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1xj66Nf3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1xj66Nf3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1xj66Nf3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1xj66Nf3.exe

pid	Process
1248	vS1ou41.exe
3016	zo1Sd18.exe
2616	xO6fZ09.exe
2664	1xj66Nf3.exe
2560	2TK9147.exe

pid	Process
2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe
1248	vS1ou41.exe
1248	vS1ou41.exe
3016	zo1Sd18.exe
3016	zo1Sd18.exe
2616	xO6fZ09.exe
2616	xO6fZ09.exe
2664	1xj66Nf3.exe
2616	xO6fZ09.exe
2616	xO6fZ09.exe
2560	2TK9147.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe
1948	WerFault.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	1xj66Nf3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1xj66Nf3.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vS1ou41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zo1Sd18.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xO6fZ09.exe

description	pid	Process	procid_target
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 2244 wrote to memory of 1248	2244	f92501ffd4feea52666cbf60a5fe88c6583c1264680cf53950739370686fd776.exe	28
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 1248 wrote to memory of 3016	1248	vS1ou41.exe	29
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 3016 wrote to memory of 2616	3016	zo1Sd18.exe	30
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2664	2616	xO6fZ09.exe	31
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2616 wrote to memory of 2560	2616	xO6fZ09.exe	32
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 2164	2560	2TK9147.exe	33
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2560 wrote to memory of 1948	2560	2TK9147.exe	34
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35
PID 2164 wrote to memory of 2712	2164	AppLaunch.exe	35

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads