description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1cf20nR0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1cf20nR0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1cf20nR0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1cf20nR0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1cf20nR0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1cf20nR0.exe

pid	Process
3040	RL5vd22.exe
2652	Dj5CR09.exe
2560	fP4on48.exe
2596	1cf20nR0.exe
2920	2NU4677.exe

pid	Process
1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe
3040	RL5vd22.exe
3040	RL5vd22.exe
2652	Dj5CR09.exe
2652	Dj5CR09.exe
2560	fP4on48.exe
2560	fP4on48.exe
2596	1cf20nR0.exe
2560	fP4on48.exe
2560	fP4on48.exe
2920	2NU4677.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	1cf20nR0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1cf20nR0.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	RL5vd22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Dj5CR09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	fP4on48.exe

description	pid	Process	procid_target
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 1660 wrote to memory of 3040	1660	fc82f1f187a911727bd8bac3ab3c8aeba9eec12c9b9445547cf7c56b2097b954.exe	28
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 3040 wrote to memory of 2652	3040	RL5vd22.exe	29
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2652 wrote to memory of 2560	2652	Dj5CR09.exe	30
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2596	2560	fP4on48.exe	31
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2560 wrote to memory of 2920	2560	fP4on48.exe	32
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 2920 wrote to memory of 268	2920	2NU4677.exe	33
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 2920 wrote to memory of 1472	2920	2NU4677.exe	34
PID 268 wrote to memory of 1196	268	AppLaunch.exe	35

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads