Malware Analysis Report

2024-09-09 20:19

Sample ID 240613-1q9m7avgnp
Target 3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4
SHA256 3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4
Tags
evasion execution
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4

Threat Level: Likely malicious

The file 3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4 was found to be: Likely malicious.

Malicious Activity Summary

evasion execution

Stops running service(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Launches sc.exe

Unsigned PE

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-13 21:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 21:52

Reported

2024-06-13 21:55

Platform

win7-20240611-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe"

Signatures

Stops running service(s)

evasion execution

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2744 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2744 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2744 wrote to memory of 2736 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2740 wrote to memory of 2764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2740 wrote to memory of 2764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2740 wrote to memory of 2764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 2740 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2740 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2740 wrote to memory of 2676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2740 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2740 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 2740 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 1700 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2588 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2588 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2588 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1700 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2556 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2556 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 2556 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 1700 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2616 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2616 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2616 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1700 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1092 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1092 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1092 wrote to memory of 2296 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1700 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2436 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2436 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1700 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 1700 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe

"C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe" MD5

C:\Windows\system32\taskkill.exe

taskkill /f /im HTTPDebuggerUI.exe

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im HTTPDebuggerSvc.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

Network

Country Destination Domain Proto
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
US 8.8.8.8:53 apps.identrust.com udp
BE 104.117.77.184:80 apps.identrust.com tcp
N/A 127.0.0.1:3000 tcp
N/A 127.0.0.1:49240 tcp
N/A 127.0.0.1:49242 tcp
N/A 127.0.0.1:3000 tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 104.90.25.32:80 x2.c.lencr.org tcp

Files

memory/1700-0-0x000000013F4AB000-0x000000013F798000-memory.dmp

memory/1700-3-0x0000000077570000-0x0000000077572000-memory.dmp

memory/1700-1-0x0000000077570000-0x0000000077572000-memory.dmp

memory/1700-5-0x0000000077570000-0x0000000077572000-memory.dmp

memory/1700-6-0x00000000775A0000-0x00000000775A2000-memory.dmp

memory/1700-8-0x00000000775A0000-0x00000000775A2000-memory.dmp

memory/1700-10-0x00000000775A0000-0x00000000775A2000-memory.dmp

memory/1700-11-0x000000013F2B0000-0x000000013FCBB000-memory.dmp

memory/1700-15-0x000000013F2B0000-0x000000013FCBB000-memory.dmp

memory/1700-16-0x000000013F4AB000-0x000000013F798000-memory.dmp

memory/1700-17-0x000000013F2B0000-0x000000013FCBB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:52

Reported

2024-06-13 21:55

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe"

Signatures

Stops running service(s)

evasion execution

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3792 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 4176 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4176 wrote to memory of 2100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4408 wrote to memory of 1652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 4408 wrote to memory of 1652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 4408 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4408 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4408 wrote to memory of 2276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4408 wrote to memory of 2276 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3792 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 2336 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2336 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3792 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 4436 wrote to memory of 4676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 4436 wrote to memory of 4676 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\sc.exe
PID 3792 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3780 wrote to memory of 1956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3780 wrote to memory of 1956 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3792 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3564 wrote to memory of 4840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3564 wrote to memory of 4840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3792 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 4380 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4380 wrote to memory of 996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3792 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe

"C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im HTTPDebuggerUI.exe

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\3b86527b1f49d776b9ec0d2ab87be2bd23069c5c4ada6c2fb46abf62f42262a4.exe" MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /f /im HTTPDebuggerSvc.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1

C:\Windows\system32\sc.exe

sc stop HTTPDebuggerPro

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1

C:\Windows\system32\taskkill.exe

taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
N/A 127.0.0.1:3000 tcp
N/A 127.0.0.1:62843 tcp
N/A 127.0.0.1:62845 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 104.90.25.32:80 x2.c.lencr.org tcp
US 8.8.8.8:53 57.72.67.172.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 32.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3792-0-0x00007FF619FDB000-0x00007FF61A2C8000-memory.dmp

memory/3792-1-0x00007FFC575B0000-0x00007FFC575B2000-memory.dmp

memory/3792-7-0x00007FF619DE0000-0x00007FF61A7EB000-memory.dmp

memory/3792-2-0x00007FFC575C0000-0x00007FFC575C2000-memory.dmp

memory/3792-8-0x00007FF619FDB000-0x00007FF61A2C8000-memory.dmp

memory/3792-9-0x00007FF619DE0000-0x00007FF61A7EB000-memory.dmp