32101f091499086753d1f94ddf0e3d87503da533f15f4e3c3bfd20d72662aa2d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hyper.exe
Size 1.5MB
Sample260722-z2c8pacd79
SHA256 32101f091499086753d1f94ddf0e3d87503da533f15f4e3c3bfd20d72662aa2d
MD5 09870d615d1dbf61446200054e74b3a1
SHA1 1ccc3a0644dc4e4c1ff495811eabf9fbe83b7007
SHA512 ffe2f3f568ea3a492791301483b3fb6b423226089fee9b48bf9ce762dcf1904490226153db6723b4280c21873e124401d45460cfceee99dadf0769f2dcf75d2b
SSDEEP 24576:IEpg0Dg+aNvkAYnPOv1eE72LZnBvaUi8nhDFj0pVm4Gie+O93l0fZa:lpBTAYnPiVqhxah8nh5jR+O93+x
TLSH
T1B675AE47A2B910F9D0ABC178C6429617E7B2785913209BDF03E08A792F737E16E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4064	sc.exe
2268	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6020	cmd.exe
3856	cmd.exe
4820	cmd.exe
4864	cmd.exe
3896	cmd.exe
5648	cmd.exe
204	cmd.exe
4460	cmd.exe
3884	cmd.exe
5548	cmd.exe
3540	cmd.exe
3340	cmd.exe
2820	cmd.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
3004	taskkill.exe
1216	taskkill.exe
2656	taskkill.exe
4616	taskkill.exe
1540	taskkill.exe
2924	taskkill.exe
5840	taskkill.exe
4708	taskkill.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe
1188	Hyper.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	3004	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4864	1188	Hyper.exe	89
PID 1188 wrote to memory of 3884	1188	Hyper.exe	90
PID 1188 wrote to memory of 4460	1188	Hyper.exe	91
PID 1188 wrote to memory of 4820	1188	Hyper.exe	92
PID 1188 wrote to memory of 2820	1188	Hyper.exe	93
PID 1188 wrote to memory of 3856	1188	Hyper.exe	94
PID 1188 wrote to memory of 6020	1188	Hyper.exe	96
PID 6020 wrote to memory of 1656	6020	cmd.exe	104
PID 4460 wrote to memory of 1216	4460	cmd.exe	106
PID 2820 wrote to memory of 2656	2820	cmd.exe	107
PID 3884 wrote to memory of 4616	3884	cmd.exe	108
PID 1188 wrote to memory of 204	1188	Hyper.exe	110
PID 1188 wrote to memory of 3340	1188	Hyper.exe	111
PID 1188 wrote to memory of 3540	1188	Hyper.exe	112
PID 1188 wrote to memory of 5648	1188	Hyper.exe	113
PID 1188 wrote to memory of 3896	1188	Hyper.exe	114
PID 1188 wrote to memory of 5548	1188	Hyper.exe	115
PID 4820 wrote to memory of 4064	4820	cmd.exe	122
PID 4864 wrote to memory of 1540	4864	cmd.exe	123
PID 5648 wrote to memory of 2268	5648	cmd.exe	125
PID 3540 wrote to memory of 2924	3540	cmd.exe	126
PID 3896 wrote to memory of 5840	3896	cmd.exe	127
PID 204 wrote to memory of 4708	204	cmd.exe	128
PID 3340 wrote to memory of 3004	3340	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\Hyper.exe
"C:\Users\Admin\AppData\Local\Temp\Hyper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Hyper.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Hyper.exe" MD5
    3⤵
    PID:1656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5548