cd2f7b4e5d2b9d38a18c4a79050d010cb8ef0e5982235f0cece57f8f0c9ae185

Analysis

user interaction
yes
max time kernel
112s
max time network
96s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
w6bcg3.exe
Size 909KB
Sample260930-bb42qaztey
SHA256 cd2f7b4e5d2b9d38a18c4a79050d010cb8ef0e5982235f0cece57f8f0c9ae185
MD5 ce3bcaf3542bdaa93030c966fe2a4d07
SHA1 68d4bc02e631cf5902b20360c8e82397f76171cc
SHA512 7075f17943435efed6983b44694e765f876f93c9c285780d57b7472e7fc4ea751b752a65b90c4010c157b00c20c8f59745729a15fa626795d0f90b366c699713
SSDEEP 24576:9pftRqZLyW+9/M1BPQx9Sk0qP+O93l0fZ:n76yH90Yx9SlI+O93+x
TLSH
T148159D57A7A511FAD167C139C5438613F772B86A13209BDF03A09AB91F23AE42F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys"	sDQ0X.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000\Control Panel\International\Geo\Nation	w6bcg3.exe

Executes dropped EXE 1 IoCs

pid	Process
1944	sDQ0X.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\hOogK.sys	w6bcg3.exe
File created	C:\Windows\SoftwareDistribution\Download\sDQ0X.exe	w6bcg3.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3184	sc.exe
3540	sc.exe
1388	sc.exe
2624	sc.exe
4692	sc.exe
4644	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 40 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4696	cmd.exe
2288	cmd.exe
1488	cmd.exe
3752	cmd.exe
2176	cmd.exe
840	cmd.exe
2924	cmd.exe
2252	cmd.exe
2320	cmd.exe
1588	cmd.exe
5084	cmd.exe
4980	cmd.exe
4568	cmd.exe
2508	cmd.exe
1664	cmd.exe
4772	cmd.exe
2216	cmd.exe
3772	cmd.exe
3012	cmd.exe
3528	cmd.exe
4988	cmd.exe
2568	cmd.exe
1796	cmd.exe
4208	cmd.exe
2000	cmd.exe
4736	cmd.exe
4404	cmd.exe
3612	cmd.exe
2080	cmd.exe
1200	cmd.exe
3828	cmd.exe
3780	cmd.exe
4984	cmd.exe
2908	cmd.exe
1884	cmd.exe
1548	cmd.exe
4244	cmd.exe
3404	cmd.exe
2744	cmd.exe
2676	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	w6bcg3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	w6bcg3.exe

Kills process with taskkill 24 IoCs

defense_evasion

pid	Process
4780	taskkill.exe
2892	taskkill.exe
4328	taskkill.exe
4924	taskkill.exe
2960	taskkill.exe
4836	taskkill.exe
2120	taskkill.exe
468	taskkill.exe
1484	taskkill.exe
2384	taskkill.exe
2624	taskkill.exe
1320	taskkill.exe
2260	taskkill.exe
3192	taskkill.exe
3640	taskkill.exe
4256	taskkill.exe
4148	taskkill.exe
3264	taskkill.exe
1352	taskkill.exe
2888	taskkill.exe
5044	taskkill.exe
2552	taskkill.exe
2728	taskkill.exe
448	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
900	w6bcg3.exe
900	w6bcg3.exe
900	w6bcg3.exe
900	w6bcg3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1944	sDQ0X.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	448	taskkill.exe
Token: SeDebugPrivilege	2892	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	4836	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	2728	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	3640	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeSystemEnvironmentPrivilege	1944	sDQ0X.exe
Token: SeDebugPrivilege	1944	sDQ0X.exe
Token: SeLoadDriverPrivilege	1944	sDQ0X.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2744	900	w6bcg3.exe	85
PID 900 wrote to memory of 3404	900	w6bcg3.exe	86
PID 900 wrote to memory of 4984	900	w6bcg3.exe	87
PID 900 wrote to memory of 2676	900	w6bcg3.exe	88
PID 900 wrote to memory of 1664	900	w6bcg3.exe	89
PID 900 wrote to memory of 4980	900	w6bcg3.exe	90
PID 900 wrote to memory of 5084	900	w6bcg3.exe	91
PID 5084 wrote to memory of 4788	5084	cmd.exe	93
PID 3404 wrote to memory of 448	3404	cmd.exe	94
PID 2744 wrote to memory of 4780	2744	cmd.exe	92
PID 2676 wrote to memory of 4692	2676	cmd.exe	95
PID 4984 wrote to memory of 2892	4984	cmd.exe	96
PID 1664 wrote to memory of 2624	1664	cmd.exe	97
PID 900 wrote to memory of 4568	900	w6bcg3.exe	99
PID 900 wrote to memory of 4696	900	w6bcg3.exe	100
PID 900 wrote to memory of 2216	900	w6bcg3.exe	101
PID 900 wrote to memory of 2568	900	w6bcg3.exe	102
PID 900 wrote to memory of 4988	900	w6bcg3.exe	103
PID 900 wrote to memory of 4772	900	w6bcg3.exe	104
PID 4696 wrote to memory of 4836	4696	cmd.exe	105
PID 2568 wrote to memory of 4644	2568	cmd.exe	106
PID 4988 wrote to memory of 1320	4988	cmd.exe	107
PID 4568 wrote to memory of 2120	4568	cmd.exe	108
PID 2216 wrote to memory of 4328	2216	cmd.exe	109
PID 900 wrote to memory of 4404	900	w6bcg3.exe	110
PID 900 wrote to memory of 3772	900	w6bcg3.exe	111
PID 900 wrote to memory of 2288	900	w6bcg3.exe	112
PID 900 wrote to memory of 1796	900	w6bcg3.exe	113
PID 900 wrote to memory of 2908	900	w6bcg3.exe	114
PID 900 wrote to memory of 3612	900	w6bcg3.exe	115
PID 1796 wrote to memory of 3184	1796	cmd.exe	116
PID 2908 wrote to memory of 468	2908	cmd.exe	117
PID 4404 wrote to memory of 4924	4404	cmd.exe	118
PID 3772 wrote to memory of 2260	3772	cmd.exe	119
PID 2288 wrote to memory of 2728	2288	cmd.exe	120
PID 900 wrote to memory of 1884	900	w6bcg3.exe	123
PID 900 wrote to memory of 4208	900	w6bcg3.exe	126
PID 900 wrote to memory of 2000	900	w6bcg3.exe	127
PID 900 wrote to memory of 1488	900	w6bcg3.exe	128
PID 900 wrote to memory of 1548	900	w6bcg3.exe	129
PID 900 wrote to memory of 840	900	w6bcg3.exe	130
PID 900 wrote to memory of 4736	900	w6bcg3.exe	131
PID 900 wrote to memory of 3012	900	w6bcg3.exe	132
PID 900 wrote to memory of 2080	900	w6bcg3.exe	133
PID 900 wrote to memory of 2176	900	w6bcg3.exe	134
PID 900 wrote to memory of 3752	900	w6bcg3.exe	135
PID 900 wrote to memory of 1200	900	w6bcg3.exe	136
PID 900 wrote to memory of 2924	900	w6bcg3.exe	137
PID 2080 wrote to memory of 4148	2080	cmd.exe	138
PID 3752 wrote to memory of 1388	3752	cmd.exe	139
PID 3012 wrote to memory of 3640	3012	cmd.exe	140
PID 1548 wrote to memory of 3540	1548	cmd.exe	141
PID 2000 wrote to memory of 3192	2000	cmd.exe	142
PID 840 wrote to memory of 2384	840	cmd.exe	143
PID 1488 wrote to memory of 2960	1488	cmd.exe	144
PID 1200 wrote to memory of 2888	1200	cmd.exe	145
PID 2176 wrote to memory of 1352	2176	cmd.exe	146
PID 4208 wrote to memory of 3264	4208	cmd.exe	147
PID 900 wrote to memory of 2252	900	w6bcg3.exe	149
PID 900 wrote to memory of 3528	900	w6bcg3.exe	150
PID 900 wrote to memory of 3780	900	w6bcg3.exe	151
PID 900 wrote to memory of 1588	900	w6bcg3.exe	152
PID 900 wrote to memory of 3828	900	w6bcg3.exe	153
PID 900 wrote to memory of 2320	900	w6bcg3.exe	154

C:\Users\Admin\AppData\Local\Temp\w6bcg3.exe
"C:\Users\Admin\AppData\Local\Temp\w6bcg3.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\w6bcg3.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\w6bcg3.exe" MD5
    3⤵
    PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2924
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2252
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3528
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1588
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3828
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4244
- C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
  "C:\Windows\SoftwareDistribution\Download\sDQ0X.exe" -map C:\Windows\SoftwareDistribution\Download\hOogK.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start
  2⤵
  - Executes a command shell one-liner
  PID:2508
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

sDQ0X.exe

Path C:\Windows\SoftwareDistribution\Download\sDQ0X.exe
Size 260KB
SHA256 03aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
MD5 083c6c05ac5875d0b6e997e894ca07bc
SHA1 69d0116998e8a70db5852fccb86d45975ce88a9a
SHA512 fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf
SSDEEP 3072:EAhPo1O3uPxn1aN+NYzoJb61Xe+VUNQRHcpfqbqM8TwxAwcvTQ5pP3YNoNBWPWw4:xhPZEncAOEJb/WyIxAwt5pfYNoNoS
TLSH
T1A544AD5773A430F9E463C134C8928616E7B3BC3607658B6F1394767A5F33291AE2EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download