ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78

Analysis

max time kernel
30s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BadwareFree.exe
Size

7.2MB
MD5

6ec04fa24f0695f286801366108942f3
SHA1

309ee6a08c8ab0159dc3137865b6cfeb9f3e4e04
SHA256

ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78
SHA512

d835f387bb19b353f58eb72a94c2b32857826f3f1322c7b5be253a6dc3b2c6a9cf4cd0340ab001df74092899346bd0e4d1dfa8c5c8d77a2893b418311103a6b5
SSDEEP

98304:cMYzS+CQQ4vBmVK0Psj6+qU483Aj9urJBSzrAhzZVT6e3JKPfjV4ZTNy6oeZ2gCc:KS4qKsW80FIryV4fZo0/

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2304	BadwareFree.exe
2304	BadwareFree.exe

Kills process with taskkill 37 IoCs

evasion

pid	Process
2948	taskkill.exe
1156	taskkill.exe
904	taskkill.exe
1576	taskkill.exe
2416	taskkill.exe
2220	taskkill.exe
1096	taskkill.exe
2172	taskkill.exe
1956	taskkill.exe
2804	taskkill.exe
2620	taskkill.exe
1324	taskkill.exe
876	taskkill.exe
2144	taskkill.exe
2632	taskkill.exe
2452	taskkill.exe
2344	taskkill.exe
2560	taskkill.exe
1316	taskkill.exe
1892	taskkill.exe
2216	taskkill.exe
2444	taskkill.exe
2672	taskkill.exe
1656	taskkill.exe
612	taskkill.exe
2052	taskkill.exe
3008	taskkill.exe
2124	taskkill.exe
2780	taskkill.exe
1720	taskkill.exe
1072	taskkill.exe
1664	taskkill.exe
1148	taskkill.exe
2960	taskkill.exe
360	taskkill.exe
2808	taskkill.exe
2368	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe
2304	BadwareFree.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	612	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	2560	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	2948	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	360	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	876	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	904	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2740	2304	BadwareFree.exe	30
PID 2304 wrote to memory of 2740	2304	BadwareFree.exe	30
PID 2304 wrote to memory of 2740	2304	BadwareFree.exe	30
PID 2304 wrote to memory of 2760	2304	BadwareFree.exe	31
PID 2304 wrote to memory of 2760	2304	BadwareFree.exe	31
PID 2304 wrote to memory of 2760	2304	BadwareFree.exe	31
PID 2760 wrote to memory of 2780	2760	cmd.exe	32
PID 2760 wrote to memory of 2780	2760	cmd.exe	32
PID 2760 wrote to memory of 2780	2760	cmd.exe	32
PID 2304 wrote to memory of 2640	2304	BadwareFree.exe	34
PID 2304 wrote to memory of 2640	2304	BadwareFree.exe	34
PID 2304 wrote to memory of 2640	2304	BadwareFree.exe	34
PID 2304 wrote to memory of 2812	2304	BadwareFree.exe	35
PID 2304 wrote to memory of 2812	2304	BadwareFree.exe	35
PID 2304 wrote to memory of 2812	2304	BadwareFree.exe	35
PID 2304 wrote to memory of 2932	2304	BadwareFree.exe	36
PID 2304 wrote to memory of 2932	2304	BadwareFree.exe	36
PID 2304 wrote to memory of 2932	2304	BadwareFree.exe	36
PID 2304 wrote to memory of 2668	2304	BadwareFree.exe	37
PID 2304 wrote to memory of 2668	2304	BadwareFree.exe	37
PID 2304 wrote to memory of 2668	2304	BadwareFree.exe	37
PID 2668 wrote to memory of 2960	2668	cmd.exe	38
PID 2668 wrote to memory of 2960	2668	cmd.exe	38
PID 2668 wrote to memory of 2960	2668	cmd.exe	38
PID 2304 wrote to memory of 2104	2304	BadwareFree.exe	39
PID 2304 wrote to memory of 2104	2304	BadwareFree.exe	39
PID 2304 wrote to memory of 2104	2304	BadwareFree.exe	39
PID 2104 wrote to memory of 2804	2104	cmd.exe	40
PID 2104 wrote to memory of 2804	2104	cmd.exe	40
PID 2104 wrote to memory of 2804	2104	cmd.exe	40
PID 2304 wrote to memory of 2744	2304	BadwareFree.exe	41
PID 2304 wrote to memory of 2744	2304	BadwareFree.exe	41
PID 2304 wrote to memory of 2744	2304	BadwareFree.exe	41
PID 2744 wrote to memory of 2632	2744	cmd.exe	42
PID 2744 wrote to memory of 2632	2744	cmd.exe	42
PID 2744 wrote to memory of 2632	2744	cmd.exe	42
PID 2304 wrote to memory of 2684	2304	BadwareFree.exe	43
PID 2304 wrote to memory of 2684	2304	BadwareFree.exe	43
PID 2304 wrote to memory of 2684	2304	BadwareFree.exe	43
PID 2684 wrote to memory of 612	2684	cmd.exe	44
PID 2684 wrote to memory of 612	2684	cmd.exe	44
PID 2684 wrote to memory of 612	2684	cmd.exe	44
PID 2304 wrote to memory of 2020	2304	BadwareFree.exe	45
PID 2304 wrote to memory of 2020	2304	BadwareFree.exe	45
PID 2304 wrote to memory of 2020	2304	BadwareFree.exe	45
PID 2020 wrote to memory of 2452	2020	cmd.exe	46
PID 2020 wrote to memory of 2452	2020	cmd.exe	46
PID 2020 wrote to memory of 2452	2020	cmd.exe	46
PID 2304 wrote to memory of 2616	2304	BadwareFree.exe	47
PID 2304 wrote to memory of 2616	2304	BadwareFree.exe	47
PID 2304 wrote to memory of 2616	2304	BadwareFree.exe	47
PID 2616 wrote to memory of 1316	2616	cmd.exe	48
PID 2616 wrote to memory of 1316	2616	cmd.exe	48
PID 2616 wrote to memory of 1316	2616	cmd.exe	48
PID 2304 wrote to memory of 1052	2304	BadwareFree.exe	49
PID 2304 wrote to memory of 1052	2304	BadwareFree.exe	49
PID 2304 wrote to memory of 1052	2304	BadwareFree.exe	49
PID 1052 wrote to memory of 2052	1052	cmd.exe	50
PID 1052 wrote to memory of 2052	1052	cmd.exe	50
PID 1052 wrote to memory of 2052	1052	cmd.exe	50
PID 2304 wrote to memory of 1344	2304	BadwareFree.exe	51
PID 2304 wrote to memory of 1344	2304	BadwareFree.exe	51
PID 2304 wrote to memory of 1344	2304	BadwareFree.exe	51
PID 1344 wrote to memory of 2344	1344	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe
"C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 04
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epicgameslauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumperClient.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumper.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im idaq.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im idaq64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Wireshark.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
  2⤵
  PID:2380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Fiddler.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
  2⤵
  PID:3012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FiddlerEverywhere.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
  2⤵
  PID:2944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
  2⤵
  PID:3016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
  2⤵
  PID:2692
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
  2⤵
  PID:956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im de4dot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
  2⤵
  PID:1060
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Cheat Engine.exe
    3⤵
    - Kills process with taskkill
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
  2⤵
  PID:1680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
  2⤵
  PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
  2⤵
  PID:1736
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
  2⤵
  PID:3052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MugenJinFuu-i386.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
  2⤵
  PID:784
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
  2⤵
  PID:2420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-i386.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
  2⤵
  PID:2188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
    3⤵
    - Kills process with taskkill
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
  2⤵
  PID:2424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumper.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
  2⤵
  PID:800
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OllyDbg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
  2⤵
  PID:1644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im x64dbg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
  2⤵
  PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im x32dbg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2176
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:1476
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:756
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
  2⤵
  PID:1376
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Ida64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
  2⤵
  PID:1116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OllyDbg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
  2⤵
  PID:2436
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Dbg64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
  2⤵
  PID:2508
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Dbg32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2228
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1968
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:856
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-4-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2304-2-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2304-0-0x0000000077A40000-0x0000000077A42000-memory.dmp

Filesize
8KB

Download
memory/2304-7-0x000000014041E000-0x0000000140865000-memory.dmp

Filesize
4.3MB

Download
memory/2304-6-0x0000000140000000-0x0000000140F9C000-memory.dmp

Filesize
15.6MB

Download
memory/2304-10-0x000000014041E000-0x0000000140865000-memory.dmp

Filesize
4.3MB

Download