Analysis
-
max time kernel
11s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2024, 02:49
General
-
Target
Nezur.exe
-
Size
4.6MB
-
MD5
483bc175a855a89d93cb00577bbb7920
-
SHA1
55b1ca916684328da9b004083189bf92ccd29138
-
SHA256
42317a2bf653554d75fee360889868dca0d1fa4cd8db24dac5e616e4ea6208c3
-
SHA512
3b186a5f644711634a331d7bf771cb7247a889fe65c3fc138de20cbb45f2f83bf060e6257444812d681015b8fddf1af03282a941ebd3019c5673a79cc1cc4ea7
-
SSDEEP
98304:URkvYI8Xa9jB6TKw/h4z+sLDuOl/+ooXE9jwzb6G:USvUa9jwk+sew/+ooXE4
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Nezur.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Nezur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Nezur.exe -
resource yara_rule behavioral1/memory/3076-0-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-2-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-3-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-4-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-5-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-7-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-6-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-149-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida behavioral1/memory/3076-173-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nezur.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3076 Nezur.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3728 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 5 IoCs
pid Process 4824 taskkill.exe 1612 taskkill.exe 4948 taskkill.exe 2972 taskkill.exe 4660 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe 3076 Nezur.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4824 taskkill.exe Token: SeDebugPrivilege 1612 taskkill.exe Token: SeDebugPrivilege 4948 taskkill.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 4748 3076 Nezur.exe 87 PID 3076 wrote to memory of 4748 3076 Nezur.exe 87 PID 4748 wrote to memory of 2540 4748 cmd.exe 88 PID 4748 wrote to memory of 2540 4748 cmd.exe 88 PID 4748 wrote to memory of 1380 4748 cmd.exe 89 PID 4748 wrote to memory of 1380 4748 cmd.exe 89 PID 4748 wrote to memory of 1492 4748 cmd.exe 90 PID 4748 wrote to memory of 1492 4748 cmd.exe 90 PID 3076 wrote to memory of 2688 3076 Nezur.exe 91 PID 3076 wrote to memory of 2688 3076 Nezur.exe 91 PID 2688 wrote to memory of 4824 2688 cmd.exe 92 PID 2688 wrote to memory of 4824 2688 cmd.exe 92 PID 3076 wrote to memory of 1016 3076 Nezur.exe 94 PID 3076 wrote to memory of 1016 3076 Nezur.exe 94 PID 1016 wrote to memory of 5024 1016 msedge.exe 95 PID 1016 wrote to memory of 5024 1016 msedge.exe 95 PID 3076 wrote to memory of 896 3076 Nezur.exe 96 PID 3076 wrote to memory of 896 3076 Nezur.exe 96 PID 896 wrote to memory of 4808 896 msedge.exe 97 PID 896 wrote to memory of 4808 896 msedge.exe 97 PID 3076 wrote to memory of 1868 3076 Nezur.exe 98 PID 3076 wrote to memory of 1868 3076 Nezur.exe 98 PID 1868 wrote to memory of 1612 1868 cmd.exe 99 PID 1868 wrote to memory of 1612 1868 cmd.exe 99 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100 PID 1016 wrote to memory of 4100 1016 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nezur.exe"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nezur.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nezur.exe" MD53⤵PID:2540
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:1380
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:1492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://key.nezur.io/2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd148346f8,0x7ffd14834708,0x7ffd148347183⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:23⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:33⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:13⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:13⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:83⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:13⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:13⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:13⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:13⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:13⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:13⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:13⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:13⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:13⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:13⤵PID:4332
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://1cheats.com/store/product/41-nezur-key-bypass-lifetime-license/2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd148346f8,0x7ffd14834708,0x7ffd148347183⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,17282308249568827119,14019861754216221938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:33⤵PID:3116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerSvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&12⤵PID:2964
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:3728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&12⤵PID:1700
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&12⤵PID:1180
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2972
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&12⤵PID:1700
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
PID:4660
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
6KB
MD51807cdfea20022a28fd62ee8ce12a177
SHA16f505b0df6696c6d0ce4b524d2d05f78bc5e0c6c
SHA256750d4affccbc1b344cd3a7bbf963011286586989969352250df078ea0e84856c
SHA512f801cbcdfd0710df47c22a270b85ca002d484ed551bde7e41e68489e6de69fbde0163c61c33bbf96869375812e8251d1c2644e4303b4e7e21bcb283f35464fe8
-
Filesize
7KB
MD5d40c5d9ba7a05a4bcc793f67d9cded87
SHA1c5c3cc077edf0ff7dc6a38dd6d0def45f13eefea
SHA256d527e97fcfa016d7d518c754941661a0f65f65406a4aa95498c6a14cf9eca8a9
SHA5128bf1ad653af4251edc357461d1638b3a209ccbcc8d32d05a39c5922894838e82b9a47c91f89e350e7cf9abd9418229d64583e8f70d394a50b4f2d136d23c3c21
-
Filesize
8KB
MD5cbfd5a2561f685b95176a301e0ba4c12
SHA1ef8575d41170047b4ddddb28958b2cdfd51e5560
SHA256c26df6e44f329ea8e8e0712a09efe05637ba1231d7e77b49c97015beeda98bd4
SHA512bce31da787e48a3c7cbf3f7c6f43aa24fa37cd8831fd088c45769e680540123fd60227f4eaa92d0a399ff901773671afb5b69b00d8f64d52443e75bf61518a0d
-
Filesize
11KB
MD555d28c5aff50c6deac6206a20a211010
SHA1eb861d1618cb5ac0528106c20393ad736c8121f9
SHA256dff1e0081be1ed9a3b9431cb603f75e9894d92eb52fd435a587bac13d24a185a
SHA512983f2e28182efb7bb9ed8b5b0fea409d08e31eb5d2132b2490671e62a41793b0a60bd1a3f02acd31e5b20e41c60e0ff301836fadb5b284313df77f349e30db05