Analysis
-
max time kernel
52s -
max time network
116s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 05:37
Static task
static1
Behavioral task
behavioral1
Sample
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe
Resource
win10-20220414-en
General
-
Target
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe
-
Size
772KB
-
MD5
cf579f83ee3d0ff6526baacb20642d0d
-
SHA1
c720caec7c07bab7f107ff11bdf99f137227651c
-
SHA256
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320
-
SHA512
649b918c2a73b7a9407789e546747e5ed6f60fd43c0ead2e52908ab867843f1666a1df4ebbbb486692eb31c95d14c6e3ef3ef323ce4408ef74709e4f0b92deab
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe Set value (str) \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2184 2388 WerFault.exe 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4984 schtasks.exe 5028 schtasks.exe 4976 schtasks.exe 4744 schtasks.exe 4456 schtasks.exe 4460 schtasks.exe 5092 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exepid process 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exedescription pid process Token: SeDebugPrivilege 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2388 wrote to memory of 2984 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2984 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2984 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2140 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2140 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2140 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2068 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2068 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2068 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4300 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4300 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4300 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4328 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4328 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4328 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4536 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4536 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4536 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4616 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4616 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4616 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4684 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4684 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4684 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4420 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4420 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4420 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2956 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2956 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 2956 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4700 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4700 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4700 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4828 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4828 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 2388 wrote to memory of 4828 2388 018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe cmd.exe PID 4300 wrote to memory of 4976 4300 cmd.exe schtasks.exe PID 4300 wrote to memory of 4976 4300 cmd.exe schtasks.exe PID 2956 wrote to memory of 4456 2956 cmd.exe schtasks.exe PID 4300 wrote to memory of 4976 4300 cmd.exe schtasks.exe PID 2956 wrote to memory of 4456 2956 cmd.exe schtasks.exe PID 2956 wrote to memory of 4456 2956 cmd.exe schtasks.exe PID 4420 wrote to memory of 4744 4420 cmd.exe schtasks.exe PID 4420 wrote to memory of 4744 4420 cmd.exe schtasks.exe PID 4420 wrote to memory of 4744 4420 cmd.exe schtasks.exe PID 2068 wrote to memory of 4984 2068 cmd.exe schtasks.exe PID 2068 wrote to memory of 4984 2068 cmd.exe schtasks.exe PID 2068 wrote to memory of 4984 2068 cmd.exe schtasks.exe PID 4616 wrote to memory of 4460 4616 cmd.exe schtasks.exe PID 4616 wrote to memory of 4460 4616 cmd.exe schtasks.exe PID 4616 wrote to memory of 4460 4616 cmd.exe schtasks.exe PID 4536 wrote to memory of 5028 4536 cmd.exe schtasks.exe PID 4536 wrote to memory of 5028 4536 cmd.exe schtasks.exe PID 4536 wrote to memory of 5028 4536 cmd.exe schtasks.exe PID 2984 wrote to memory of 5092 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 5092 2984 cmd.exe schtasks.exe PID 2984 wrote to memory of 5092 2984 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8603" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8603" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9400" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6184" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk810" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk810" /TR "C:\Users\Admin\AppData\Local\Temp\018d4aca424ae676c6975db1be52c3404c6e5cb6d4d51ec97a2a8d91f4149320.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 13202⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2068-188-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2068-180-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2068-183-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2068-176-0x0000000000000000-mapping.dmp
-
memory/2140-174-0x0000000000000000-mapping.dmp
-
memory/2140-190-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2140-185-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2140-181-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2140-178-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-160-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-119-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-129-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-130-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-131-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-132-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-133-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-134-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-135-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-136-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-137-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-138-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-139-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-140-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-141-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-142-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-143-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-144-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-145-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-146-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-147-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-148-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-149-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-150-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-151-0x0000000000D10000-0x0000000000DC0000-memory.dmpFilesize
704KB
-
memory/2388-152-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-153-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-154-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-155-0x0000000005BC0000-0x00000000060BE000-memory.dmpFilesize
5.0MB
-
memory/2388-165-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-157-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-158-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-159-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-118-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-167-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-162-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-163-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-164-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-156-0x00000000056C0000-0x0000000005752000-memory.dmpFilesize
584KB
-
memory/2388-128-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-161-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-168-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-169-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-170-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-171-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-172-0x00000000056A0000-0x00000000056AA000-memory.dmpFilesize
40KB
-
memory/2388-166-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-120-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-127-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-126-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-125-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-124-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-123-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-121-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2388-122-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2956-208-0x0000000000000000-mapping.dmp
-
memory/2984-175-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2984-177-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2984-186-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2984-182-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2984-173-0x0000000000000000-mapping.dmp
-
memory/4300-191-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4300-187-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4300-179-0x0000000000000000-mapping.dmp
-
memory/4328-184-0x0000000000000000-mapping.dmp
-
memory/4420-203-0x0000000000000000-mapping.dmp
-
memory/4456-244-0x0000000000000000-mapping.dmp
-
memory/4460-247-0x0000000000000000-mapping.dmp
-
memory/4536-189-0x0000000000000000-mapping.dmp
-
memory/4616-194-0x0000000000000000-mapping.dmp
-
memory/4684-198-0x0000000000000000-mapping.dmp
-
memory/4700-213-0x0000000000000000-mapping.dmp
-
memory/4744-245-0x0000000000000000-mapping.dmp
-
memory/4828-220-0x0000000000000000-mapping.dmp
-
memory/4976-243-0x0000000000000000-mapping.dmp
-
memory/4984-246-0x0000000000000000-mapping.dmp
-
memory/5028-254-0x0000000000000000-mapping.dmp
-
memory/5092-259-0x0000000000000000-mapping.dmp