fbe5d3a5abec6f6960f5611ab2c76332da86e3f259609e35aa2f20d2bca21a91

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orbit_MWIII.exe
Size 10.5MB
Sample260910-2gv9waxamd
SHA256 fbe5d3a5abec6f6960f5611ab2c76332da86e3f259609e35aa2f20d2bca21a91
MD5 091b7f96665cbcd6e67dc99f797da14b
SHA1 205e19a572b1399866e0fb416803689dfbae65d3
SHA512 6ea6c1ab599b98a82ada578402b3e73153fd92feaacbb7c4a14578a08f2924c0ea84f91b91939ab35e169ba2ac709924c889d2a27734b6e7a415a60727c8b2aa
SSDEEP 196608:q+hcb4CYyAuYh//Tr44vWFTE9On6W35y6y1Fl4:Svk3PcTEw6l6s
TLSH
T1FFB623DE71543768C01A84389137BD05F1B5461E16EAC8AE72CB7ED03B7B425EA82F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Orbit_MWIII.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5500	cmd.exe
5612	powercfg.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5672	sc.exe
6092	sc.exe
4172	sc.exe
4784	sc.exe
5984	sc.exe
5440	sc.exe
2140	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 44 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5892	cmd.exe
3912	cmd.exe
2072	cmd.exe
1760	cmd.exe
5712	cmd.exe
5888	cmd.exe
4832	cmd.exe
3848	cmd.exe
4708	cmd.exe
2492	cmd.exe
4824	cmd.exe
2268	cmd.exe
4656	cmd.exe
4264	cmd.exe
2852	cmd.exe
5852	cmd.exe
3004	cmd.exe
1320	cmd.exe
2408	cmd.exe
5744	cmd.exe
3684	cmd.exe
3392	cmd.exe
1464	cmd.exe
1772	cmd.exe
5296	cmd.exe
4300	cmd.exe
4320	cmd.exe
5900	cmd.exe
5020	cmd.exe
1440	cmd.exe
3576	cmd.exe
5232	cmd.exe
4584	cmd.exe
740	cmd.exe
4704	cmd.exe
5864	cmd.exe
3904	cmd.exe
1860	cmd.exe
2240	cmd.exe
4364	cmd.exe
4676	cmd.exe
3236	cmd.exe
5072	cmd.exe
3076	cmd.exe

Kills process with taskkill 28 IoCs

defense_evasion

pid	Process
6052	taskkill.exe
3740	taskkill.exe
4156	taskkill.exe
5324	taskkill.exe
5388	taskkill.exe
3764	taskkill.exe
5680	taskkill.exe
5564	taskkill.exe
6012	taskkill.exe
3276	taskkill.exe
1612	taskkill.exe
3428	taskkill.exe
4328	taskkill.exe
228	taskkill.exe
5340	taskkill.exe
5460	taskkill.exe
2712	taskkill.exe
2900	taskkill.exe
1724	taskkill.exe
2572	taskkill.exe
5336	taskkill.exe
5248	taskkill.exe
4852	taskkill.exe
6068	taskkill.exe
3320	taskkill.exe
5184	taskkill.exe
224	taskkill.exe
4112	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
5596	powershell.exe
5596	powershell.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe
4992	Orbit_MWIII.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeShutdownPrivilege	5612	powercfg.exe
Token: SeCreatePagefilePrivilege	5612	powercfg.exe
Token: SeShutdownPrivilege	5612	powercfg.exe
Token: SeCreatePagefilePrivilege	5612	powercfg.exe
Token: SeSystemEnvironmentPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	6052	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	6012	taskkill.exe
Token: SeDebugPrivilege	3428	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	3276	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	4156	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	3320	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	5184	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeDebugPrivilege	5388	taskkill.exe
Token: SeDebugPrivilege	5340	taskkill.exe
Token: SeDebugPrivilege	5460	taskkill.exe
Token: SeDebugPrivilege	3764	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe
Token: SeDebugPrivilege	5680	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5500	4992	Orbit_MWIII.exe	87
PID 4992 wrote to memory of 2852	4992	Orbit_MWIII.exe	88
PID 2852 wrote to memory of 5596	2852	cmd.exe	90
PID 5500 wrote to memory of 5612	5500	cmd.exe	91
PID 4992 wrote to memory of 5744	4992	Orbit_MWIII.exe	93
PID 4992 wrote to memory of 5712	4992	Orbit_MWIII.exe	94
PID 4992 wrote to memory of 5852	4992	Orbit_MWIII.exe	95
PID 4992 wrote to memory of 5864	4992	Orbit_MWIII.exe	96
PID 4992 wrote to memory of 5888	4992	Orbit_MWIII.exe	97
PID 4992 wrote to memory of 5892	4992	Orbit_MWIII.exe	98
PID 4992 wrote to memory of 5900	4992	Orbit_MWIII.exe	99
PID 5744 wrote to memory of 6012	5744	cmd.exe	100
PID 5712 wrote to memory of 6052	5712	cmd.exe	101
PID 5852 wrote to memory of 6068	5852	cmd.exe	102
PID 5864 wrote to memory of 6092	5864	cmd.exe	103
PID 5888 wrote to memory of 2712	5888	cmd.exe	104
PID 5900 wrote to memory of 6000	5900	cmd.exe	105
PID 4992 wrote to memory of 3912	4992	Orbit_MWIII.exe	107
PID 4992 wrote to memory of 2492	4992	Orbit_MWIII.exe	108
PID 4992 wrote to memory of 3684	4992	Orbit_MWIII.exe	109
PID 4992 wrote to memory of 4824	4992	Orbit_MWIII.exe	110
PID 4992 wrote to memory of 3392	4992	Orbit_MWIII.exe	111
PID 4992 wrote to memory of 4832	4992	Orbit_MWIII.exe	112
PID 3392 wrote to memory of 3428	3392	cmd.exe	113
PID 2492 wrote to memory of 1612	2492	cmd.exe	114
PID 4824 wrote to memory of 4172	4824	cmd.exe	115
PID 3684 wrote to memory of 3276	3684	cmd.exe	116
PID 3912 wrote to memory of 2900	3912	cmd.exe	117
PID 4992 wrote to memory of 3848	4992	Orbit_MWIII.exe	120
PID 4992 wrote to memory of 2268	4992	Orbit_MWIII.exe	121
PID 4992 wrote to memory of 3236	4992	Orbit_MWIII.exe	122
PID 4992 wrote to memory of 5020	4992	Orbit_MWIII.exe	123
PID 4992 wrote to memory of 3904	4992	Orbit_MWIII.exe	124
PID 4992 wrote to memory of 1464	4992	Orbit_MWIII.exe	125
PID 4992 wrote to memory of 5072	4992	Orbit_MWIII.exe	126
PID 4992 wrote to memory of 1440	4992	Orbit_MWIII.exe	127
PID 4992 wrote to memory of 3004	4992	Orbit_MWIII.exe	128
PID 4992 wrote to memory of 1860	4992	Orbit_MWIII.exe	129
PID 4992 wrote to memory of 1320	4992	Orbit_MWIII.exe	130
PID 4992 wrote to memory of 4656	4992	Orbit_MWIII.exe	131
PID 3848 wrote to memory of 3320	3848	cmd.exe	132
PID 5020 wrote to memory of 5984	5020	cmd.exe	133
PID 3236 wrote to memory of 4156	3236	cmd.exe	134
PID 3904 wrote to memory of 1724	3904	cmd.exe	135
PID 3004 wrote to memory of 3740	3004	cmd.exe	136
PID 1860 wrote to memory of 4784	1860	cmd.exe	137
PID 1320 wrote to memory of 4328	1320	cmd.exe	138
PID 2268 wrote to memory of 5184	2268	cmd.exe	139
PID 1440 wrote to memory of 228	1440	cmd.exe	140
PID 5072 wrote to memory of 224	5072	cmd.exe	141
PID 4992 wrote to memory of 2072	4992	Orbit_MWIII.exe	147
PID 4992 wrote to memory of 1772	4992	Orbit_MWIII.exe	148
PID 4992 wrote to memory of 3576	4992	Orbit_MWIII.exe	149
PID 4992 wrote to memory of 2240	4992	Orbit_MWIII.exe	150
PID 4992 wrote to memory of 2408	4992	Orbit_MWIII.exe	151
PID 4992 wrote to memory of 5296	4992	Orbit_MWIII.exe	152
PID 4992 wrote to memory of 5232	4992	Orbit_MWIII.exe	153
PID 4992 wrote to memory of 4364	4992	Orbit_MWIII.exe	154
PID 4992 wrote to memory of 4264	4992	Orbit_MWIII.exe	155
PID 4992 wrote to memory of 4300	4992	Orbit_MWIII.exe	156
PID 4992 wrote to memory of 4320	4992	Orbit_MWIII.exe	157
PID 4992 wrote to memory of 4584	4992	Orbit_MWIII.exe	158
PID 4364 wrote to memory of 5324	4364	cmd.exe	159
PID 2408 wrote to memory of 2572	2408	cmd.exe	160

C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe
"C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C Powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\system32\powercfg.exe
    Powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell "Confirm-SecureBootUEFI" > C:\secureboot_status.txt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Confirm-SecureBootUEFI"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:6092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Orbit_MWIII.exe" MD5
    3⤵
    PID:6000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2240
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5232
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4264
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4676
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:740
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1760
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4708
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3076
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cn3xhijb.xtk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cn3xhijb.xtk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

secureboot_status.txt

Path C:\secureboot_status.txt
Size 420B
SHA256 a9aac8c0cfbbeefd52ba4cca1c99c6bd4e16d28792d695ce0271761701868e0a
MD5 6bb2c33bff35de3d3e6660cb183f7182
SHA1 b00ef727ef3df7a501caa49c5b4e458c6bd90eba
SHA512 3650c068da0c025611a2d3716a6017296329bfa49e68e03f8da4fdf1984ccef176679584b455156e1f46468cd5861804e06104db39cb26097ecd1e7addc79617
TLSH
T1FCE0D83E81B955435880E0C1154223AD2B43E2376C8586577A1E2F081F3E6F6F96E2EB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4992-6-0x00007FF75DDA0000-0x00007FF75F0B7000-memory.dmp

Download

memory/4992-2-0x00007FF75DE90000-0x00007FF75E641000-memory.dmp

Download

memory/4992-1-0x00007FF75DDA0000-0x00007FF75F0B7000-memory.dmp

Download

memory/4992-0-0x00007FFB3DA70000-0x00007FFB3DA72000-memory.dmp

Download

memory/4992-22-0x00007FF75DE90000-0x00007FF75E641000-memory.dmp

Download

memory/4992-23-0x00007FF75DDA0000-0x00007FF75F0B7000-memory.dmp

Download

memory/4992-24-0x00007FF75DDA0000-0x00007FF75F0B7000-memory.dmp

Download

memory/4992-25-0x00007FF75DE90000-0x00007FF75E641000-memory.dmp

Download

memory/5596-7-0x0000020B36100000-0x0000020B36110000-memory.dmp

Download

memory/5596-8-0x0000020B36100000-0x0000020B36110000-memory.dmp

Download

memory/5596-16-0x0000020B50FC0000-0x0000020B50FE2000-memory.dmp

Download