ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78

Analysis

max time kernel
7s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BadwareFree.exe
Size

7.2MB
MD5

6ec04fa24f0695f286801366108942f3
SHA1

309ee6a08c8ab0159dc3137865b6cfeb9f3e4e04
SHA256

ae27243a53f4c399aeb6bb39e67fa79f8378d51ef6b4fef9263791ec1acb6e78
SHA512

d835f387bb19b353f58eb72a94c2b32857826f3f1322c7b5be253a6dc3b2c6a9cf4cd0340ab001df74092899346bd0e4d1dfa8c5c8d77a2893b418311103a6b5
SSDEEP

98304:cMYzS+CQQ4vBmVK0Psj6+qU483Aj9urJBSzrAhzZVT6e3JKPfjV4ZTNy6oeZ2gCc:KS4qKsW80FIryV4fZo0/

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4760	BadwareFree.exe
4760	BadwareFree.exe

Kills process with taskkill 25 IoCs

evasion

pid	Process
3660	taskkill.exe
4308	taskkill.exe
1336	taskkill.exe
3520	taskkill.exe
528	taskkill.exe
2372	taskkill.exe
1232	taskkill.exe
3640	taskkill.exe
2732	taskkill.exe
2032	taskkill.exe
852	taskkill.exe
332	taskkill.exe
1296	taskkill.exe
4800	taskkill.exe
5092	taskkill.exe
1088	taskkill.exe
3400	taskkill.exe
1448	taskkill.exe
4480	taskkill.exe
2920	taskkill.exe
2544	taskkill.exe
1328	taskkill.exe
2984	taskkill.exe
3972	taskkill.exe
3892	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	BadwareFree.exe
4760	BadwareFree.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	852	taskkill.exe
Token: SeDebugPrivilege	2372	taskkill.exe
Token: SeDebugPrivilege	332	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	3660	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	3400	taskkill.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeDebugPrivilege	528	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4176	4760	BadwareFree.exe	88
PID 4760 wrote to memory of 4176	4760	BadwareFree.exe	88
PID 4760 wrote to memory of 2192	4760	BadwareFree.exe	89
PID 4760 wrote to memory of 2192	4760	BadwareFree.exe	89
PID 2192 wrote to memory of 852	2192	cmd.exe	90
PID 2192 wrote to memory of 852	2192	cmd.exe	90
PID 4760 wrote to memory of 2420	4760	BadwareFree.exe	92
PID 4760 wrote to memory of 2420	4760	BadwareFree.exe	92
PID 4760 wrote to memory of 4616	4760	BadwareFree.exe	93
PID 4760 wrote to memory of 4616	4760	BadwareFree.exe	93
PID 4760 wrote to memory of 2128	4760	BadwareFree.exe	94
PID 4760 wrote to memory of 2128	4760	BadwareFree.exe	94
PID 4760 wrote to memory of 4860	4760	BadwareFree.exe	95
PID 4760 wrote to memory of 4860	4760	BadwareFree.exe	95
PID 4860 wrote to memory of 2372	4860	cmd.exe	96
PID 4860 wrote to memory of 2372	4860	cmd.exe	96
PID 4760 wrote to memory of 2900	4760	BadwareFree.exe	97
PID 4760 wrote to memory of 2900	4760	BadwareFree.exe	97
PID 2900 wrote to memory of 332	2900	cmd.exe	98
PID 2900 wrote to memory of 332	2900	cmd.exe	98
PID 4760 wrote to memory of 1012	4760	BadwareFree.exe	99
PID 4760 wrote to memory of 1012	4760	BadwareFree.exe	99
PID 1012 wrote to memory of 2920	1012	cmd.exe	100
PID 1012 wrote to memory of 2920	1012	cmd.exe	100
PID 4760 wrote to memory of 2524	4760	BadwareFree.exe	101
PID 4760 wrote to memory of 2524	4760	BadwareFree.exe	101
PID 2524 wrote to memory of 4800	2524	cmd.exe	102
PID 2524 wrote to memory of 4800	2524	cmd.exe	102
PID 4760 wrote to memory of 3224	4760	BadwareFree.exe	103
PID 4760 wrote to memory of 3224	4760	BadwareFree.exe	103
PID 3224 wrote to memory of 3972	3224	cmd.exe	104
PID 3224 wrote to memory of 3972	3224	cmd.exe	104
PID 4760 wrote to memory of 4932	4760	BadwareFree.exe	105
PID 4760 wrote to memory of 4932	4760	BadwareFree.exe	105
PID 4932 wrote to memory of 1232	4932	cmd.exe	106
PID 4932 wrote to memory of 1232	4932	cmd.exe	106
PID 4760 wrote to memory of 1416	4760	BadwareFree.exe	107
PID 4760 wrote to memory of 1416	4760	BadwareFree.exe	107
PID 1416 wrote to memory of 5092	1416	cmd.exe	108
PID 1416 wrote to memory of 5092	1416	cmd.exe	108
PID 4760 wrote to memory of 4780	4760	BadwareFree.exe	109
PID 4760 wrote to memory of 4780	4760	BadwareFree.exe	109
PID 4780 wrote to memory of 1448	4780	cmd.exe	110
PID 4780 wrote to memory of 1448	4780	cmd.exe	110
PID 4760 wrote to memory of 2768	4760	BadwareFree.exe	111
PID 4760 wrote to memory of 2768	4760	BadwareFree.exe	111
PID 2768 wrote to memory of 3640	2768	cmd.exe	112
PID 2768 wrote to memory of 3640	2768	cmd.exe	112
PID 4760 wrote to memory of 3984	4760	BadwareFree.exe	113
PID 4760 wrote to memory of 3984	4760	BadwareFree.exe	113
PID 3984 wrote to memory of 4480	3984	cmd.exe	114
PID 3984 wrote to memory of 4480	3984	cmd.exe	114
PID 4760 wrote to memory of 3428	4760	BadwareFree.exe	115
PID 4760 wrote to memory of 3428	4760	BadwareFree.exe	115
PID 3428 wrote to memory of 1296	3428	cmd.exe	116
PID 3428 wrote to memory of 1296	3428	cmd.exe	116
PID 4760 wrote to memory of 2964	4760	BadwareFree.exe	117
PID 4760 wrote to memory of 2964	4760	BadwareFree.exe	117
PID 2964 wrote to memory of 2544	2964	cmd.exe	118
PID 2964 wrote to memory of 2544	2964	cmd.exe	118
PID 4760 wrote to memory of 4680	4760	BadwareFree.exe	119
PID 4760 wrote to memory of 4680	4760	BadwareFree.exe	119
PID 4680 wrote to memory of 2732	4680	cmd.exe	120
PID 4680 wrote to memory of 2732	4680	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe
"C:\Users\Admin\AppData\Local\Temp\BadwareFree.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 04
  2⤵
  PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epicgameslauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumperClient.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumper.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im ProcessHacker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im idaq.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im idaq64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Wireshark.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Fiddler.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FiddlerEverywhere.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Xenos32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
  2⤵
  PID:1372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im de4dot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
  2⤵
  PID:4144
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Cheat Engine.exe
    3⤵
    - Kills process with taskkill
    PID:1328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
  2⤵
  PID:3248
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
  2⤵
  PID:1920
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
  2⤵
  PID:3320
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
  2⤵
  PID:4652
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MugenJinFuu-i386.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
  2⤵
  PID:2812
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-x86_64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
  2⤵
  PID:3484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im cheatengine-i386.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
  2⤵
  PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
    3⤵
    - Kills process with taskkill
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
  2⤵
  PID:1056
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im KsDumper.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
  2⤵
  PID:4124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im OllyDbg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4760-0-0x00007FFCE8910000-0x00007FFCE8912000-memory.dmp

Filesize
8KB

Download
memory/4760-3-0x000000014041E000-0x0000000140865000-memory.dmp

Filesize
4.3MB

Download
memory/4760-4-0x0000000140000000-0x0000000140F9C000-memory.dmp

Filesize
15.6MB

Download