Analysis
-
max time kernel
55s -
max time network
119s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 06:40
Static task
static1
Behavioral task
behavioral1
Sample
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe
Resource
win10-20220722-en
General
-
Target
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe
-
Size
772KB
-
MD5
59c1e514349a81f81e05ecbada47ab80
-
SHA1
bda816a5c49b91b347d7be89a0d6d422495227f5
-
SHA256
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4
-
SHA512
d54ffb16b774a399bed9c73d1fb17c2a85ff537be868ede9861e788624ee128942151fbe1c4c7aec32a2cb55a36fa809e286c38b8849f450ec411fcfcfa8be2b
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 252 2488 WerFault.exe 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3844 schtasks.exe 4404 schtasks.exe 4400 schtasks.exe 2292 schtasks.exe 4280 schtasks.exe 4376 schtasks.exe 4368 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exepid process 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exedescription pid process Token: SeDebugPrivilege 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2488 wrote to memory of 4256 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 4256 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 4256 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3088 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3088 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3088 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3312 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3312 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3312 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3612 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3612 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3612 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3508 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3508 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3508 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3036 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3036 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3036 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 4524 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 4524 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 4524 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 5092 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 5092 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 5092 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3276 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3276 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 3276 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 1308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 1308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 1308 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2264 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2264 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2488 wrote to memory of 2264 2488 68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe cmd.exe PID 2264 wrote to memory of 2292 2264 cmd.exe schtasks.exe PID 2264 wrote to memory of 2292 2264 cmd.exe schtasks.exe PID 2264 wrote to memory of 2292 2264 cmd.exe schtasks.exe PID 1308 wrote to memory of 3844 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 3844 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 3844 1308 cmd.exe schtasks.exe PID 3612 wrote to memory of 4368 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 4368 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 4368 3612 cmd.exe schtasks.exe PID 5092 wrote to memory of 4404 5092 cmd.exe schtasks.exe PID 5092 wrote to memory of 4404 5092 cmd.exe schtasks.exe PID 5092 wrote to memory of 4404 5092 cmd.exe schtasks.exe PID 2308 wrote to memory of 4400 2308 cmd.exe schtasks.exe PID 2308 wrote to memory of 4400 2308 cmd.exe schtasks.exe PID 2308 wrote to memory of 4400 2308 cmd.exe schtasks.exe PID 4256 wrote to memory of 4376 4256 cmd.exe schtasks.exe PID 4256 wrote to memory of 4376 4256 cmd.exe schtasks.exe PID 4256 wrote to memory of 4376 4256 cmd.exe schtasks.exe PID 3036 wrote to memory of 4280 3036 cmd.exe schtasks.exe PID 3036 wrote to memory of 4280 3036 cmd.exe schtasks.exe PID 3036 wrote to memory of 4280 3036 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5576" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5576" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9914" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1979" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1979" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6669" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6669" /TR "C:\Users\Admin\AppData\Local\Temp\68ba8dda1800316c07eb7186c721570d801750756887cbcccb029ee470d5a0f4.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 13202⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-218-0x0000000000000000-mapping.dmp
-
memory/2264-223-0x0000000000000000-mapping.dmp
-
memory/2292-250-0x0000000000000000-mapping.dmp
-
memory/2308-203-0x0000000000000000-mapping.dmp
-
memory/2488-166-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-133-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-130-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-131-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-132-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-170-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-134-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-135-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-136-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-137-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-138-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-139-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-140-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-141-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-142-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-143-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-144-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-145-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-146-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-147-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-148-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-149-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-150-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-151-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-152-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-153-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-154-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-155-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-156-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-157-0x0000000000F20000-0x0000000000FD0000-memory.dmpFilesize
704KB
-
memory/2488-169-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-159-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-160-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-161-0x0000000005D50000-0x000000000624E000-memory.dmpFilesize
5.0MB
-
memory/2488-162-0x0000000005850000-0x00000000058E2000-memory.dmpFilesize
584KB
-
memory/2488-163-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-164-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-165-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-124-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-167-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-125-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-158-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-129-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-171-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-172-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-173-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-174-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-175-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-176-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-177-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-178-0x00000000057F0000-0x00000000057FA000-memory.dmpFilesize
40KB
-
memory/2488-126-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-127-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-128-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/2488-168-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3036-192-0x0000000000000000-mapping.dmp
-
memory/3088-184-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3088-194-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3088-180-0x0000000000000000-mapping.dmp
-
memory/3088-189-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3276-213-0x0000000000000000-mapping.dmp
-
memory/3312-182-0x0000000000000000-mapping.dmp
-
memory/3312-198-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3312-187-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3312-193-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3508-188-0x0000000000000000-mapping.dmp
-
memory/3508-196-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3612-191-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3612-195-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/3612-185-0x0000000000000000-mapping.dmp
-
memory/3844-251-0x0000000000000000-mapping.dmp
-
memory/4256-190-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/4256-179-0x0000000000000000-mapping.dmp
-
memory/4256-181-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/4256-186-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/4256-183-0x0000000077D70000-0x0000000077EFE000-memory.dmpFilesize
1.6MB
-
memory/4280-256-0x0000000000000000-mapping.dmp
-
memory/4368-252-0x0000000000000000-mapping.dmp
-
memory/4376-255-0x0000000000000000-mapping.dmp
-
memory/4400-254-0x0000000000000000-mapping.dmp
-
memory/4404-253-0x0000000000000000-mapping.dmp
-
memory/4524-197-0x0000000000000000-mapping.dmp
-
memory/5092-208-0x0000000000000000-mapping.dmp