c7615a9e8756bc7029cf2d291f2c97d3d9edd41e7fcfcda1c9f79fb6eac0b4ca

Analysis

user interaction
yes
max time kernel
26s
max time network
32s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/06/2026, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orbit Chair and Hyper MWIII.exe
Size 83.0MB
Sample260626-yqerpse18l
SHA256 c7615a9e8756bc7029cf2d291f2c97d3d9edd41e7fcfcda1c9f79fb6eac0b4ca
MD5 6457cb54f93debab544e096fe30d3fb1
SHA1 f9458f3d1efed7a2fa02da6fc616beea18db51d4
SHA512 433a33f3aaccf616c9cd41be8a25e8e11b8d919536827bb4326e2e49bd08dd1b3f5e9c31867e40eec4a493ee157bb84bfd6abcf8da183dd3f2abc38494b28f89
SSDEEP 1572864:vkeNR8XitPZpQOdw4qUF3EMJfpp3nedtHIdZ+g3Xmv+0JrWVxL0:sMPUO++3EMJfpReAc+0JrmxI
TLSH
T175183348E09A7CB8D0578FF809C3765E72CB57F80E369C5EAF8459233DF64A4AC60949
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4292	Orbit Chair and Hyper MWIII.exe
4292	Orbit Chair and Hyper MWIII.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3772	sc.exe
2244	sc.exe
5060	sc.exe
3824	sc.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
4944	taskkill.exe
4684	taskkill.exe
2472	taskkill.exe
2276	taskkill.exe
3356	taskkill.exe
1556	taskkill.exe
3884	taskkill.exe
4428	taskkill.exe
3568	taskkill.exe
480	taskkill.exe
4952	taskkill.exe
3508	taskkill.exe
4604	taskkill.exe
5028	taskkill.exe
4352	taskkill.exe
2020	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4292	Orbit Chair and Hyper MWIII.exe
4292	Orbit Chair and Hyper MWIII.exe
4292	Orbit Chair and Hyper MWIII.exe
4292	Orbit Chair and Hyper MWIII.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	taskkill.exe
Token: SeDebugPrivilege	4428	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	480	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	4604	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4120	4292	Orbit Chair and Hyper MWIII.exe	84
PID 4292 wrote to memory of 3044	4292	Orbit Chair and Hyper MWIII.exe	87
PID 4292 wrote to memory of 892	4292	Orbit Chair and Hyper MWIII.exe	88
PID 4292 wrote to memory of 2664	4292	Orbit Chair and Hyper MWIII.exe	89
PID 4292 wrote to memory of 2652	4292	Orbit Chair and Hyper MWIII.exe	90
PID 4292 wrote to memory of 4272	4292	Orbit Chair and Hyper MWIII.exe	91
PID 4292 wrote to memory of 2424	4292	Orbit Chair and Hyper MWIII.exe	92
PID 4292 wrote to memory of 3200	4292	Orbit Chair and Hyper MWIII.exe	93
PID 3044 wrote to memory of 4428	3044	cmd.exe	94
PID 3200 wrote to memory of 4068	3200	cmd.exe	95
PID 4272 wrote to memory of 3508	4272	cmd.exe	96
PID 2664 wrote to memory of 3568	2664	cmd.exe	97
PID 2652 wrote to memory of 3772	2652	cmd.exe	98
PID 892 wrote to memory of 4944	892	cmd.exe	99
PID 4292 wrote to memory of 2204	4292	Orbit Chair and Hyper MWIII.exe	101
PID 4292 wrote to memory of 2064	4292	Orbit Chair and Hyper MWIII.exe	102
PID 4292 wrote to memory of 4444	4292	Orbit Chair and Hyper MWIII.exe	103
PID 4292 wrote to memory of 1532	4292	Orbit Chair and Hyper MWIII.exe	104
PID 4292 wrote to memory of 2536	4292	Orbit Chair and Hyper MWIII.exe	105
PID 4292 wrote to memory of 2376	4292	Orbit Chair and Hyper MWIII.exe	106
PID 2204 wrote to memory of 1556	2204	cmd.exe	107
PID 4444 wrote to memory of 4684	4444	cmd.exe	108
PID 2536 wrote to memory of 480	2536	cmd.exe	109
PID 2064 wrote to memory of 4604	2064	cmd.exe	110
PID 1532 wrote to memory of 2244	1532	cmd.exe	111
PID 4292 wrote to memory of 232	4292	Orbit Chair and Hyper MWIII.exe	113
PID 4292 wrote to memory of 1968	4292	Orbit Chair and Hyper MWIII.exe	114
PID 4292 wrote to memory of 3004	4292	Orbit Chair and Hyper MWIII.exe	115
PID 4292 wrote to memory of 3844	4292	Orbit Chair and Hyper MWIII.exe	116
PID 4292 wrote to memory of 2636	4292	Orbit Chair and Hyper MWIII.exe	117
PID 4292 wrote to memory of 2028	4292	Orbit Chair and Hyper MWIII.exe	118
PID 4292 wrote to memory of 4920	4292	Orbit Chair and Hyper MWIII.exe	119
PID 4292 wrote to memory of 4336	4292	Orbit Chair and Hyper MWIII.exe	120
PID 4292 wrote to memory of 2612	4292	Orbit Chair and Hyper MWIII.exe	121
PID 4292 wrote to memory of 4972	4292	Orbit Chair and Hyper MWIII.exe	122
PID 4292 wrote to memory of 4252	4292	Orbit Chair and Hyper MWIII.exe	123
PID 4292 wrote to memory of 4720	4292	Orbit Chair and Hyper MWIII.exe	124
PID 2636 wrote to memory of 4952	2636	cmd.exe	125
PID 4252 wrote to memory of 2472	4252	cmd.exe	126
PID 4972 wrote to memory of 5060	4972	cmd.exe	127
PID 3844 wrote to memory of 3824	3844	cmd.exe	128
PID 4336 wrote to memory of 5028	4336	cmd.exe	129
PID 1968 wrote to memory of 4352	1968	cmd.exe	130
PID 232 wrote to memory of 3356	232	cmd.exe	131
PID 4920 wrote to memory of 2276	4920	cmd.exe	132
PID 3004 wrote to memory of 2020	3004	cmd.exe	133
PID 2612 wrote to memory of 3884	2612	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\Orbit Chair and Hyper MWIII.exe
"C:\Users\Admin\AppData\Local\Temp\Orbit Chair and Hyper MWIII.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:2424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit Chair and Hyper MWIII.exe" MD5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit Chair and Hyper MWIII.exe" MD5
    3⤵
    PID:4068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:2028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-0-0x000000014010D000-0x000000014039F000-memory.dmp

Download

memory/4292-2-0x00007FFDCBE60000-0x00007FFDCBE62000-memory.dmp

Download

memory/4292-1-0x00007FFDCBE50000-0x00007FFDCBE52000-memory.dmp

Download

memory/4292-7-0x0000000140000000-0x00000001407E3000-memory.dmp

Download

memory/4292-8-0x000000014010D000-0x000000014039F000-memory.dmp

Download

memory/4292-9-0x0000000140000000-0x00000001407E3000-memory.dmp

Download