4d01b76695d542981e21d77b2f786051a1388b609e245bd828ad567edb8af4bc

Analysis

max time kernel
152s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amidsfg.exe
Size

22.8MB
MD5

3cf3ee2eb8f0e74cafca2a41f80decc6
SHA1

f1f26c28f6b03f824470afebc65c2bd725c210ff
SHA256

4d01b76695d542981e21d77b2f786051a1388b609e245bd828ad567edb8af4bc
SHA512

fae8d0604061df5750aa80b438c6d8032a60ca1a09bfc912b527d0c35807150d790a8b6325fd2ca4b8891a7ae1726bc13f47fdc86d975cdf9c3c16467b6f7950
SSDEEP

393216:U7L3sNAAW4U29yInXaP5zuN3Jc8ZTvRbFJ22qmRMglCHuY0Cdab6DVArWcQXA3:k7sNAAdUlIXNss42qeCECdaYVASch

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
560	amidsfg.exe
560	amidsfg.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4612	sc.exe
364	sc.exe
392	sc.exe
3356	sc.exe
744	sc.exe
4160	sc.exe
3760	sc.exe
3604	sc.exe
2380	sc.exe
2440	sc.exe
3744	sc.exe
3888	sc.exe
4552	sc.exe
2728	sc.exe
3024	sc.exe
4680	sc.exe
8	sc.exe
4240	sc.exe
2400	sc.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
868	taskkill.exe
4368	taskkill.exe
4880	taskkill.exe
5056	taskkill.exe
1676	taskkill.exe
4132	taskkill.exe
456	taskkill.exe
1776	taskkill.exe
2184	taskkill.exe
3144	taskkill.exe
5104	taskkill.exe
3208	taskkill.exe
4072	taskkill.exe
4764	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe
560	amidsfg.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	456	taskkill.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	5104	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3520	560	amidsfg.exe	92
PID 560 wrote to memory of 3520	560	amidsfg.exe	92
PID 3520 wrote to memory of 1972	3520	cmd.exe	93
PID 3520 wrote to memory of 1972	3520	cmd.exe	93
PID 1972 wrote to memory of 3704	1972	net.exe	94
PID 1972 wrote to memory of 3704	1972	net.exe	94
PID 560 wrote to memory of 3540	560	amidsfg.exe	95
PID 560 wrote to memory of 3540	560	amidsfg.exe	95
PID 3540 wrote to memory of 4880	3540	cmd.exe	96
PID 3540 wrote to memory of 4880	3540	cmd.exe	96
PID 4880 wrote to memory of 3780	4880	net.exe	98
PID 4880 wrote to memory of 3780	4880	net.exe	98
PID 560 wrote to memory of 1792	560	amidsfg.exe	99
PID 560 wrote to memory of 1792	560	amidsfg.exe	99
PID 1792 wrote to memory of 392	1792	cmd.exe	100
PID 1792 wrote to memory of 392	1792	cmd.exe	100
PID 560 wrote to memory of 1052	560	amidsfg.exe	102
PID 560 wrote to memory of 1052	560	amidsfg.exe	102
PID 1052 wrote to memory of 8	1052	cmd.exe	103
PID 1052 wrote to memory of 8	1052	cmd.exe	103
PID 560 wrote to memory of 3160	560	amidsfg.exe	104
PID 560 wrote to memory of 3160	560	amidsfg.exe	104
PID 3160 wrote to memory of 3604	3160	cmd.exe	105
PID 3160 wrote to memory of 3604	3160	cmd.exe	105
PID 560 wrote to memory of 212	560	amidsfg.exe	106
PID 560 wrote to memory of 212	560	amidsfg.exe	106
PID 212 wrote to memory of 3888	212	cmd.exe	107
PID 212 wrote to memory of 3888	212	cmd.exe	107
PID 560 wrote to memory of 4308	560	amidsfg.exe	164
PID 560 wrote to memory of 4308	560	amidsfg.exe	164
PID 4308 wrote to memory of 3356	4308	cmd.exe	109
PID 4308 wrote to memory of 3356	4308	cmd.exe	109
PID 560 wrote to memory of 3000	560	amidsfg.exe	166
PID 560 wrote to memory of 3000	560	amidsfg.exe	166
PID 3000 wrote to memory of 744	3000	cmd.exe	111
PID 3000 wrote to memory of 744	3000	cmd.exe	111
PID 560 wrote to memory of 884	560	amidsfg.exe	112
PID 560 wrote to memory of 884	560	amidsfg.exe	112
PID 884 wrote to memory of 1228	884	cmd.exe	113
PID 884 wrote to memory of 1228	884	cmd.exe	113
PID 1228 wrote to memory of 2440	1228	net.exe	167
PID 1228 wrote to memory of 2440	1228	net.exe	167
PID 560 wrote to memory of 1680	560	amidsfg.exe	117
PID 560 wrote to memory of 1680	560	amidsfg.exe	117
PID 1680 wrote to memory of 4220	1680	cmd.exe	115
PID 1680 wrote to memory of 4220	1680	cmd.exe	115
PID 4220 wrote to memory of 4616	4220	net.exe	116
PID 4220 wrote to memory of 4616	4220	net.exe	116
PID 560 wrote to memory of 60	560	amidsfg.exe	118
PID 560 wrote to memory of 60	560	amidsfg.exe	118
PID 60 wrote to memory of 4160	60	cmd.exe	119
PID 60 wrote to memory of 4160	60	cmd.exe	119
PID 560 wrote to memory of 1912	560	amidsfg.exe	175
PID 560 wrote to memory of 1912	560	amidsfg.exe	175
PID 1912 wrote to memory of 3760	1912	cmd.exe	121
PID 1912 wrote to memory of 3760	1912	cmd.exe	121
PID 560 wrote to memory of 1112	560	amidsfg.exe	122
PID 560 wrote to memory of 1112	560	amidsfg.exe	122
PID 1112 wrote to memory of 4552	1112	cmd.exe	123
PID 1112 wrote to memory of 4552	1112	cmd.exe	123
PID 560 wrote to memory of 2840	560	amidsfg.exe	124
PID 560 wrote to memory of 2840	560	amidsfg.exe	124
PID 2840 wrote to memory of 2380	2840	cmd.exe	125
PID 2840 wrote to memory of 2380	2840	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\amidsfg.exe
"C:\Users\Admin\AppData\Local\Temp\amidsfg.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\net.exe
    net stop FACEIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop FACEIT
      4⤵
      PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\system32\net.exe
    net stop ESEADriver2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop ESEADriver2
      4⤵
      PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:4308
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:3000
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\net.exe
    net stop FACEIT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop FACEIT
      4⤵
      PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:1912
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:1536
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:3312
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:4468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:2352
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2448
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:376
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2964
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:3252
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1964
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:4900
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1936
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1356
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:4260
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2820
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:3212
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:1320
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\amidsfg.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:2112
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\amidsfg.exe" MD5
    3⤵
    PID:1056
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1796
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM Taskmgr.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=12
  2⤵
  PID:5100
- - C:\Windows\system32\mode.com
    MODE CON COLS=55 LINES=12
    3⤵
    PID:3592

C:\Windows\system32\net.exe
net stop ESEADriver2
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop ESEADriver2
  2⤵
  PID:4616

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
1⤵
- Launches sc.exe
PID:3024

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-0-0x00007FF8F35D0000-0x00007FF8F35D2000-memory.dmp

Filesize
8KB

Download
memory/560-1-0x00007FF8F35E0000-0x00007FF8F35E2000-memory.dmp

Filesize
8KB

Download
memory/560-3-0x00007FF768F50000-0x00007FF76BB51000-memory.dmp

Filesize
44.0MB

Download
memory/560-2-0x00007FF768F50000-0x00007FF76BB51000-memory.dmp

Filesize
44.0MB

Download
memory/560-7-0x00007FF768F50000-0x00007FF76BB51000-memory.dmp

Filesize
44.0MB

Download