cbe89146c2b5c01173a1faa442841ffd1d8209b2774975b8835dea678f1af84b

Resubmissions

10/03/2025, 16:32

250310-t1813s1xcy 8

10/03/2025, 16:28

250310-tyrzsa1ly8 10

Analysis

max time kernel
39s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
10/03/2025, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

frog/Frog Spoofer (1).exe
Size

2.7MB
MD5

e001605fa695282a2d3170d8d9e956c9
SHA1

4544155daae0335ada1d05a509e43b8c0434ffc8
SHA256

003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e
SHA512

11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6
SSDEEP

49152:wy8J1anDS2TFQTnQT2QT9QT1QTXCbAAKrqgvWAtY3o41MBXcOz5dD:CxYw1aCkX23o41MBXc4D

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1868	sc.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
1456	taskkill.exe
32	taskkill.exe
2028	taskkill.exe
3560	taskkill.exe
796	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe
3196	Frog Spoofer (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3196	Frog Spoofer (1).exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	taskkill.exe
Token: SeDebugPrivilege	32	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1712	3196	Frog Spoofer (1).exe	82
PID 3196 wrote to memory of 1712	3196	Frog Spoofer (1).exe	82
PID 1712 wrote to memory of 1456	1712	cmd.exe	83
PID 1712 wrote to memory of 1456	1712	cmd.exe	83
PID 3196 wrote to memory of 1044	3196	Frog Spoofer (1).exe	85
PID 3196 wrote to memory of 1044	3196	Frog Spoofer (1).exe	85
PID 1044 wrote to memory of 32	1044	cmd.exe	86
PID 1044 wrote to memory of 32	1044	cmd.exe	86
PID 3196 wrote to memory of 4636	3196	Frog Spoofer (1).exe	87
PID 3196 wrote to memory of 4636	3196	Frog Spoofer (1).exe	87
PID 4636 wrote to memory of 1868	4636	cmd.exe	88
PID 4636 wrote to memory of 1868	4636	cmd.exe	88
PID 3196 wrote to memory of 3444	3196	Frog Spoofer (1).exe	89
PID 3196 wrote to memory of 3444	3196	Frog Spoofer (1).exe	89
PID 3444 wrote to memory of 2028	3444	cmd.exe	90
PID 3444 wrote to memory of 2028	3444	cmd.exe	90
PID 3196 wrote to memory of 1168	3196	Frog Spoofer (1).exe	91
PID 3196 wrote to memory of 1168	3196	Frog Spoofer (1).exe	91
PID 1168 wrote to memory of 3560	1168	cmd.exe	92
PID 1168 wrote to memory of 3560	1168	cmd.exe	92
PID 3196 wrote to memory of 2332	3196	Frog Spoofer (1).exe	93
PID 3196 wrote to memory of 2332	3196	Frog Spoofer (1).exe	93
PID 2332 wrote to memory of 796	2332	cmd.exe	94
PID 2332 wrote to memory of 796	2332	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\frog\Frog Spoofer (1).exe
"C:\Users\Admin\AppData\Local\Temp\frog\Frog Spoofer (1).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:32
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:796