c11fe57c5de22e46da19be13e40f58725b824c6eabdc1ad5b9e733cd882e962c

General

Target

TAISNAYH.exe
Size

4.0MB
MD5

6197e468a842e2af45919fb19223baca
SHA1

f26d4642522bb3b260deda379e98b631d5b4534b
SHA256

c11fe57c5de22e46da19be13e40f58725b824c6eabdc1ad5b9e733cd882e962c
SHA512

69a657a00c15ca3e71d841717b36ead90fc9c5d2ba57155c638f5d136977537a77aebbe0778cd0bc8cb9fb58121b8d86c4a1ee6cc1dd71960da68a15c13c1d27
SSDEEP

98304:JBfYxlJMiUPTIrOJzUxSSw2IIgIytrlWu6GMLou0ZvglqLsVGQjdhMH:/AWiUkrOGzwUgIytrlWuFuyvgoY+

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

TAISNAYH.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ TAISNAYH.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TAISNAYH.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TAISNAYH.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TAISNAYH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TAISNAYH.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2948-0-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-2-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-3-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-4-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-5-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-7-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-6-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-8-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-9-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida
behavioral1/memory/2948-11-0x000000013FCA0000-0x0000000140702000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

TAISNAYH.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TAISNAYH.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

TAISNAYH.exe

pid process

2948 TAISNAYH.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TAISNAYH.exe

pid	process
2948	TAISNAYH.exe

Launches sc.exe 33 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
312	sc.exe
2968	sc.exe
2884	sc.exe
2996	sc.exe
1272	sc.exe
356	sc.exe
352	sc.exe
2564	sc.exe
632	sc.exe
2864	sc.exe
1652	sc.exe
2100	sc.exe
1868	sc.exe
2132	sc.exe
2452	sc.exe
2180	sc.exe
2824	sc.exe
496	sc.exe
2284	sc.exe
2352	sc.exe
1176	sc.exe
1500	sc.exe
2360	sc.exe
1656	sc.exe
2372	sc.exe
1676	sc.exe
2656	sc.exe
360	sc.exe
2488	sc.exe
2464	sc.exe
2496	sc.exe
3028	sc.exe
1660	sc.exe

Kills process with taskkill 39 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2540	taskkill.exe
2592	taskkill.exe
1700	taskkill.exe
1100	taskkill.exe
2960	taskkill.exe
2348	taskkill.exe
2820	taskkill.exe
3020	taskkill.exe
1320	taskkill.exe
2964	taskkill.exe
2232	taskkill.exe
1600	taskkill.exe
1464	taskkill.exe
1852	taskkill.exe
1752	taskkill.exe
1296	taskkill.exe
1032	taskkill.exe
676	taskkill.exe
968	taskkill.exe
2084	taskkill.exe
2492	taskkill.exe
2576	taskkill.exe
2476	taskkill.exe
2968	taskkill.exe
1820	taskkill.exe
564	taskkill.exe
1972	taskkill.exe
2884	taskkill.exe
2460	taskkill.exe
2392	taskkill.exe
2044	taskkill.exe
2916	taskkill.exe
632	taskkill.exe
2552	taskkill.exe
2108	taskkill.exe
1656	taskkill.exe
1864	taskkill.exe
2068	taskkill.exe
1012	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2540	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	1600	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

TAISNAYH.execmd.execmd.execmd.exenet.exenet.execmd.exenet.execmd.exenet.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2948 wrote to memory of 2960	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2960	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2960	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2992	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2992	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2992	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2108	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2108	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2108	2948	TAISNAYH.exe	cmd.exe
PID 2992 wrote to memory of 2592	2992	cmd.exe	taskkill.exe
PID 2992 wrote to memory of 2592	2992	cmd.exe	taskkill.exe
PID 2992 wrote to memory of 2592	2992	cmd.exe	taskkill.exe
PID 2108 wrote to memory of 2612	2108	cmd.exe	net.exe
PID 2108 wrote to memory of 2612	2108	cmd.exe	net.exe
PID 2108 wrote to memory of 2612	2108	cmd.exe	net.exe
PID 2960 wrote to memory of 2672	2960	cmd.exe	net.exe
PID 2960 wrote to memory of 2672	2960	cmd.exe	net.exe
PID 2960 wrote to memory of 2672	2960	cmd.exe	net.exe
PID 2672 wrote to memory of 2684	2672	net.exe	net1.exe
PID 2672 wrote to memory of 2684	2672	net.exe	net1.exe
PID 2672 wrote to memory of 2684	2672	net.exe	net1.exe
PID 2612 wrote to memory of 2708	2612	net.exe	net1.exe
PID 2612 wrote to memory of 2708	2612	net.exe	net1.exe
PID 2612 wrote to memory of 2708	2612	net.exe	net1.exe
PID 2948 wrote to memory of 2620	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2620	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2620	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2588	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2588	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2588	2948	TAISNAYH.exe	cmd.exe
PID 2588 wrote to memory of 2624	2588	cmd.exe	net.exe
PID 2588 wrote to memory of 2624	2588	cmd.exe	net.exe
PID 2588 wrote to memory of 2624	2588	cmd.exe	net.exe
PID 2624 wrote to memory of 1688	2624	net.exe	net1.exe
PID 2624 wrote to memory of 1688	2624	net.exe	net1.exe
PID 2624 wrote to memory of 1688	2624	net.exe	net1.exe
PID 2620 wrote to memory of 2660	2620	cmd.exe	net.exe
PID 2620 wrote to memory of 2660	2620	cmd.exe	net.exe
PID 2620 wrote to memory of 2660	2620	cmd.exe	net.exe
PID 2660 wrote to memory of 2492	2660	net.exe	taskkill.exe
PID 2660 wrote to memory of 2492	2660	net.exe	taskkill.exe
PID 2660 wrote to memory of 2492	2660	net.exe	taskkill.exe
PID 2948 wrote to memory of 2692	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2692	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2692	2948	TAISNAYH.exe	cmd.exe
PID 2692 wrote to memory of 2488	2692	cmd.exe	sc.exe
PID 2692 wrote to memory of 2488	2692	cmd.exe	sc.exe
PID 2692 wrote to memory of 2488	2692	cmd.exe	sc.exe
PID 2948 wrote to memory of 2512	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2512	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2512	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2576	2948	TAISNAYH.exe	taskkill.exe
PID 2948 wrote to memory of 2576	2948	TAISNAYH.exe	taskkill.exe
PID 2948 wrote to memory of 2576	2948	TAISNAYH.exe	taskkill.exe
PID 2948 wrote to memory of 2688	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2688	2948	TAISNAYH.exe	cmd.exe
PID 2948 wrote to memory of 2688	2948	TAISNAYH.exe	cmd.exe
PID 2512 wrote to memory of 2464	2512	cmd.exe	cmd.exe
PID 2512 wrote to memory of 2464	2512	cmd.exe	cmd.exe
PID 2512 wrote to memory of 2464	2512	cmd.exe	cmd.exe
PID 2688 wrote to memory of 2460	2688	cmd.exe	taskkill.exe
PID 2688 wrote to memory of 2460	2688	cmd.exe	taskkill.exe
PID 2688 wrote to memory of 2460	2688	cmd.exe	taskkill.exe
PID 2576 wrote to memory of 2496	2576	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\TAISNAYH.exe
"C:\Users\Admin\AppData\Local\Temp\TAISNAYH.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:2684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:2708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:1688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
2⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:2584

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:2864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2888

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:2876

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:2164

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:320

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:1800

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:1596

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:1708

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:2452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:1648

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:1868

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:1652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
2⤵
PID:1304

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:1892

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
2⤵
PID:1740

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:2564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
2⤵
PID:2388

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:2180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
2⤵
PID:924

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:800

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1960

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq HTTPDebuggerSvc*" /IM * /F /T >nul 2>&1
2⤵
PID:2776

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq HTTPDebuggerSvc*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1540

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:1344

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:1208

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:2088

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:2640

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq HTTPDebuggerUI*" /IM * /F /T >nul 2>&1
2⤵
PID:1712

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq HTTPDebuggerUI*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:2064

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:1956

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:1272

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:1500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
2⤵
PID:1664

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq KsDumperClient*" /IM * /F /T >nul 2>&1
2⤵
PID:1120

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq KsDumperClient*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:1840

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq FolderChangesView*" /IM * /F /T >nul 2>&1
2⤵
PID:1560

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq FolderChangesView*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
2⤵
PID:1848

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
2⤵
PID:112

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ProcessHacker*" /IM * /F /T >nul 2>&1
2⤵
PID:964

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ProcessHacker*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:2008

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:1680

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:1248

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq KsDumperClient*" /IM * /F /T >nul 2>&1
2⤵
PID:1764

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq KsDumperClient*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:880

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
2⤵
PID:1276

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq procmon*" /IM * /F /T >nul 2>&1
2⤵
PID:1728

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq procmon*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
2⤵
PID:2716

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:2680

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq idaq*" /IM * /F /T >nul 2>&1
2⤵
PID:2588

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq idaq*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:2600

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
2⤵
PID:2464

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq idaq64*" /IM * /F /T >nul 2>&1
2⤵
PID:1736

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq idaq64*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
2⤵
PID:2496

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:2888

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:2164

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:320

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
2⤵
PID:352

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1652

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:1868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2380

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:1964

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:2360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
2⤵
PID:2216

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:2188

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:1704

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:2180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:1544

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:1212

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
2⤵
PID:1976

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:2080

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:1952

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:2016

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:2760

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:2812

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:1348

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:536

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:1500

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\TAISNAYH.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
PID:704

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\TAISNAYH.exe" MD5
3⤵
PID:2068

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:1712

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-1-0x00000000777E0000-0x0000000077989000-memory.dmp

Filesize
1.7MB

Download
memory/2948-2-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-3-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-4-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-5-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-7-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-6-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-8-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-9-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-11-0x000000013FCA0000-0x0000000140702000-memory.dmp

Filesize
10.4MB

Download
memory/2948-12-0x00000000777E0000-0x0000000077989000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads