4d01b76695d542981e21d77b2f786051a1388b609e245bd828ad567edb8af4bc

Analysis

max time kernel
151s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amidsfg.exe
Size

22.8MB
MD5

3cf3ee2eb8f0e74cafca2a41f80decc6
SHA1

f1f26c28f6b03f824470afebc65c2bd725c210ff
SHA256

4d01b76695d542981e21d77b2f786051a1388b609e245bd828ad567edb8af4bc
SHA512

fae8d0604061df5750aa80b438c6d8032a60ca1a09bfc912b527d0c35807150d790a8b6325fd2ca4b8891a7ae1726bc13f47fdc86d975cdf9c3c16467b6f7950
SSDEEP

393216:U7L3sNAAW4U29yInXaP5zuN3Jc8ZTvRbFJ22qmRMglCHuY0Cdab6DVArWcQXA3:k7sNAAdUlIXNss42qeCECdaYVASch

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1396	amidsfg.exe
1396	amidsfg.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2700	sc.exe
2544	sc.exe
2956	sc.exe
768	sc.exe
2276	sc.exe
2792	sc.exe
2240	sc.exe
2620	sc.exe
2488	sc.exe
1704	sc.exe
2720	sc.exe
1956	sc.exe
2564	sc.exe
1748	sc.exe
2628	sc.exe
2724	sc.exe
2468	sc.exe
1048	sc.exe
2876	sc.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
2968	taskkill.exe
1892	taskkill.exe
2236	taskkill.exe
2384	taskkill.exe
1376	taskkill.exe
1340	taskkill.exe
592	taskkill.exe
1060	taskkill.exe
2844	taskkill.exe
2972	taskkill.exe
1632	taskkill.exe
2808	taskkill.exe
1664	taskkill.exe
2416	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe
1396	amidsfg.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	2236	taskkill.exe
Token: SeDebugPrivilege	1060	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2972	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2208	1396	amidsfg.exe	29
PID 1396 wrote to memory of 2208	1396	amidsfg.exe	29
PID 1396 wrote to memory of 2208	1396	amidsfg.exe	29
PID 2208 wrote to memory of 2060	2208	cmd.exe	30
PID 2208 wrote to memory of 2060	2208	cmd.exe	30
PID 2208 wrote to memory of 2060	2208	cmd.exe	30
PID 2060 wrote to memory of 2652	2060	net.exe	31
PID 2060 wrote to memory of 2652	2060	net.exe	31
PID 2060 wrote to memory of 2652	2060	net.exe	31
PID 1396 wrote to memory of 3028	1396	amidsfg.exe	32
PID 1396 wrote to memory of 3028	1396	amidsfg.exe	32
PID 1396 wrote to memory of 3028	1396	amidsfg.exe	32
PID 3028 wrote to memory of 2560	3028	cmd.exe	33
PID 3028 wrote to memory of 2560	3028	cmd.exe	33
PID 3028 wrote to memory of 2560	3028	cmd.exe	33
PID 2560 wrote to memory of 2068	2560	net.exe	34
PID 2560 wrote to memory of 2068	2560	net.exe	34
PID 2560 wrote to memory of 2068	2560	net.exe	34
PID 1396 wrote to memory of 2092	1396	amidsfg.exe	35
PID 1396 wrote to memory of 2092	1396	amidsfg.exe	35
PID 1396 wrote to memory of 2092	1396	amidsfg.exe	35
PID 2092 wrote to memory of 2240	2092	cmd.exe	36
PID 2092 wrote to memory of 2240	2092	cmd.exe	36
PID 2092 wrote to memory of 2240	2092	cmd.exe	36
PID 1396 wrote to memory of 2616	1396	amidsfg.exe	37
PID 1396 wrote to memory of 2616	1396	amidsfg.exe	37
PID 1396 wrote to memory of 2616	1396	amidsfg.exe	37
PID 2616 wrote to memory of 2700	2616	cmd.exe	38
PID 2616 wrote to memory of 2700	2616	cmd.exe	38
PID 2616 wrote to memory of 2700	2616	cmd.exe	38
PID 1396 wrote to memory of 2712	1396	amidsfg.exe	39
PID 1396 wrote to memory of 2712	1396	amidsfg.exe	39
PID 1396 wrote to memory of 2712	1396	amidsfg.exe	39
PID 2712 wrote to memory of 2720	2712	cmd.exe	40
PID 2712 wrote to memory of 2720	2712	cmd.exe	40
PID 2712 wrote to memory of 2720	2712	cmd.exe	40
PID 1396 wrote to memory of 2892	1396	amidsfg.exe	41
PID 1396 wrote to memory of 2892	1396	amidsfg.exe	41
PID 1396 wrote to memory of 2892	1396	amidsfg.exe	41
PID 2892 wrote to memory of 2620	2892	cmd.exe	42
PID 2892 wrote to memory of 2620	2892	cmd.exe	42
PID 2892 wrote to memory of 2620	2892	cmd.exe	42
PID 1396 wrote to memory of 3032	1396	amidsfg.exe	43
PID 1396 wrote to memory of 3032	1396	amidsfg.exe	43
PID 1396 wrote to memory of 3032	1396	amidsfg.exe	43
PID 3032 wrote to memory of 2876	3032	cmd.exe	44
PID 3032 wrote to memory of 2876	3032	cmd.exe	44
PID 3032 wrote to memory of 2876	3032	cmd.exe	44
PID 1396 wrote to memory of 2584	1396	amidsfg.exe	45
PID 1396 wrote to memory of 2584	1396	amidsfg.exe	45
PID 1396 wrote to memory of 2584	1396	amidsfg.exe	45
PID 2584 wrote to memory of 2628	2584	cmd.exe	46
PID 2584 wrote to memory of 2628	2584	cmd.exe	46
PID 2584 wrote to memory of 2628	2584	cmd.exe	46
PID 1396 wrote to memory of 2504	1396	amidsfg.exe	47
PID 1396 wrote to memory of 2504	1396	amidsfg.exe	47
PID 1396 wrote to memory of 2504	1396	amidsfg.exe	47
PID 2504 wrote to memory of 2496	2504	cmd.exe	48
PID 2504 wrote to memory of 2496	2504	cmd.exe	48
PID 2504 wrote to memory of 2496	2504	cmd.exe	48
PID 2496 wrote to memory of 2840	2496	net.exe	49
PID 2496 wrote to memory of 2840	2496	net.exe	49
PID 2496 wrote to memory of 2840	2496	net.exe	49
PID 1396 wrote to memory of 2856	1396	amidsfg.exe	50

C:\Users\Admin\AppData\Local\Temp\amidsfg.exe
"C:\Users\Admin\AppData\Local\Temp\amidsfg.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\net.exe
    net stop FACEIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop FACEIT
      4⤵
      PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\net.exe
    net stop ESEADriver2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ESEADriver2
      4⤵
      PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\net.exe
    net stop FACEIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop FACEIT
      4⤵
      PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
  2⤵
  PID:2856
- - C:\Windows\system32\net.exe
    net stop ESEADriver2
    3⤵
    PID:1728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ESEADriver2
      4⤵
      PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:2640
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2412
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:2480
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:2952
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:2728
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:1708
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:444
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:844
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1596
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1904
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1924
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1324
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1128
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2860
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2824
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:1976
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2296
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:2180
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:824
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:2656
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\amidsfg.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:2300
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3020
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:440
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\amidsfg.exe" MD5
    3⤵
    PID:484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM Taskmgr.exe
  2⤵
  PID:2024
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=12
  2⤵
  PID:976
- - C:\Windows\system32\mode.com
    MODE CON COLS=55 LINES=12
    3⤵
    PID:2056

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
1⤵
- Launches sc.exe
PID:2544

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
1⤵
- Launches sc.exe
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-0-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

Filesize
8KB

Download
memory/1396-2-0x000000013F130000-0x0000000141D31000-memory.dmp

Filesize
44.0MB

Download
memory/1396-3-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

Filesize
8KB

Download
memory/1396-5-0x0000000076EA0000-0x0000000076EA2000-memory.dmp

Filesize
8KB

Download
memory/1396-6-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

Filesize
8KB

Download
memory/1396-8-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

Filesize
8KB

Download
memory/1396-11-0x000000013F130000-0x0000000141D31000-memory.dmp

Filesize
44.0MB

Download
memory/1396-10-0x0000000076ED0000-0x0000000076ED2000-memory.dmp

Filesize
8KB

Download
memory/1396-13-0x0000000076CF0000-0x0000000076E99000-memory.dmp

Filesize
1.7MB

Download
memory/1396-17-0x000000013F130000-0x0000000141D31000-memory.dmp

Filesize
44.0MB

Download
memory/1396-18-0x000000013F130000-0x0000000141D31000-memory.dmp

Filesize
44.0MB

Download
memory/1396-19-0x0000000076CF0000-0x0000000076E99000-memory.dmp

Filesize
1.7MB

Download