97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12

Analysis

max time kernel
53s
max time network
140s
platform
windows10-1703_x64
resource
win10-20220718-en
resource tags

arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system
submitted
06-08-2022 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Size

772KB
MD5

3249803cd71c3c94514fe8c4dc7b1e75
SHA1

0761a71d9ffea81658a893a95be9859a678c525b
SHA256

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12
SHA512

828c2d24ef3a05a26b7e6e31ec8c6654a331fc2f664f4b6b48b1a324254ac1a47d9f81a7504d16b1fc85295cb26ed09e990edc5a76b1ce9b82783125d8b06579

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3916 3160 WerFault.exe 97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1164 schtasks.exe
3408 schtasks.exe
696 schtasks.exe
592 schtasks.exe
416 schtasks.exe

pid	pid_target	process	target process
3916	3160	WerFault.exe	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

pid	process
1164	schtasks.exe
3408	schtasks.exe
696	schtasks.exe
592	schtasks.exe
416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

pid	process
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

description pid process

Token: SeDebugPrivilege 3160 97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

description	pid	process
Token: SeDebugPrivilege	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3160 wrote to memory of 2344	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2344	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2344	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2620	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2620	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2620	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2700	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2700	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2700	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3808	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3808	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3808	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3708	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3708	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3708	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2644	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2644	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2644	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 588	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 588	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 588	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3932	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3932	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 3932	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 212	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 212	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 212	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2340	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2340	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 2340	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 660	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 660	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 660	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 1812	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 1812	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 3160 wrote to memory of 1812	3160	97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe	cmd.exe
PID 2620 wrote to memory of 1164	2620	cmd.exe	schtasks.exe
PID 2620 wrote to memory of 1164	2620	cmd.exe	schtasks.exe
PID 2620 wrote to memory of 1164	2620	cmd.exe	schtasks.exe
PID 2700 wrote to memory of 696	2700	cmd.exe	schtasks.exe
PID 2700 wrote to memory of 696	2700	cmd.exe	schtasks.exe
PID 2700 wrote to memory of 696	2700	cmd.exe	schtasks.exe
PID 2344 wrote to memory of 416	2344	cmd.exe	schtasks.exe
PID 2344 wrote to memory of 416	2344	cmd.exe	schtasks.exe
PID 2344 wrote to memory of 416	2344	cmd.exe	schtasks.exe
PID 3808 wrote to memory of 592	3808	cmd.exe	schtasks.exe
PID 3808 wrote to memory of 592	3808	cmd.exe	schtasks.exe
PID 3808 wrote to memory of 592	3808	cmd.exe	schtasks.exe
PID 212 wrote to memory of 3408	212	cmd.exe	schtasks.exe
PID 212 wrote to memory of 3408	212	cmd.exe	schtasks.exe
PID 212 wrote to memory of 3408	212	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe
"C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
    3⤵
    - Creates scheduled task(s)
    PID:416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
    3⤵
    - Creates scheduled task(s)
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
    3⤵
    - Creates scheduled task(s)
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6030" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6030" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3369" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8896" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7622" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:3932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\97b522c8e6ad31f607932967ebb4b9aedb706a4a1a913eeff7ab12babf3aaf12.exe"
  2⤵
  PID:588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1316
  2⤵
  - Program crash
  PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-202-0x0000000000000000-mapping.dmp

Download
memory/416-243-0x0000000000000000-mapping.dmp

Download
memory/588-192-0x0000000000000000-mapping.dmp

Download
memory/592-244-0x0000000000000000-mapping.dmp

Download
memory/660-212-0x0000000000000000-mapping.dmp

Download
memory/696-242-0x0000000000000000-mapping.dmp

Download
memory/1164-241-0x0000000000000000-mapping.dmp

Download
memory/1812-218-0x0000000000000000-mapping.dmp

Download
memory/2340-207-0x0000000000000000-mapping.dmp

Download
memory/2344-174-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2344-176-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2344-178-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2344-180-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2344-172-0x0000000000000000-mapping.dmp

Download
memory/2620-182-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2620-177-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2620-185-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2620-189-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2620-173-0x0000000000000000-mapping.dmp

Download
memory/2644-187-0x0000000000000000-mapping.dmp

Download
memory/2700-181-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-188-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/2700-175-0x0000000000000000-mapping.dmp

Download
memory/2700-184-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-138-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-141-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-143-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-144-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-145-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-146-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-147-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-148-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-149-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-150-0x0000000000BD0000-0x0000000000C80000-memory.dmp

Filesize
704KB

Download
memory/3160-151-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-152-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-153-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-154-0x0000000005940000-0x0000000005E3E000-memory.dmp

Filesize
5.0MB

Download
memory/3160-155-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/3160-156-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-157-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-158-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-159-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-160-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-161-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-162-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-163-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-164-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-165-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-166-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-167-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-168-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-169-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-170-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-171-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/3160-142-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-140-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-139-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-118-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-117-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-137-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-136-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-119-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-135-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-133-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-134-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-132-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-131-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-130-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-129-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-128-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-127-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-120-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-126-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-121-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-125-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-122-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-124-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3160-123-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3408-272-0x0000000000000000-mapping.dmp

Download
memory/3708-190-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3708-183-0x0000000000000000-mapping.dmp

Download
memory/3808-186-0x0000000077B70000-0x0000000077CFE000-memory.dmp

Filesize
1.6MB

Download
memory/3808-179-0x0000000000000000-mapping.dmp

Download
memory/3932-197-0x0000000000000000-mapping.dmp

Download