Analysis
-
max time kernel
54s -
max time network
111s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:31
Static task
static1
Behavioral task
behavioral1
Sample
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe
Resource
win10-20220718-en
General
-
Target
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe
-
Size
785KB
-
MD5
3ce97fd2279edbcd5112a8e4af2aad1f
-
SHA1
e2bd930ebd2668574d6e7e03651ea8b203bafe33
-
SHA256
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7
-
SHA512
7fd66aff7c653f05cf74a3b810e7de38e38a01caa202de40c914240c183e5fda69a2816feb5873e25898cdc4a549cf87a3e6ab63ab576d404dc22f860a5e5d48
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2848962218-3794400400-3934119819-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4364 1848 WerFault.exe 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3808 schtasks.exe 4984 schtasks.exe 4812 schtasks.exe 2428 schtasks.exe 3284 schtasks.exe 3916 schtasks.exe 1280 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exepid process 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exedescription pid process Token: SeDebugPrivilege 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1848 wrote to memory of 3972 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 3972 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 3972 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 3968 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 3968 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 3968 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1948 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1948 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1948 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4452 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4452 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4452 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4152 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4152 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4152 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4484 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4484 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4484 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4500 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4500 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4500 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4576 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4576 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4576 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4884 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4884 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 4884 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1248 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1248 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 1248 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 5008 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 5008 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 5008 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 2316 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 2316 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 1848 wrote to memory of 2316 1848 48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe cmd.exe PID 3968 wrote to memory of 4812 3968 cmd.exe schtasks.exe PID 3968 wrote to memory of 4812 3968 cmd.exe schtasks.exe PID 3968 wrote to memory of 4812 3968 cmd.exe schtasks.exe PID 1948 wrote to memory of 4984 1948 cmd.exe schtasks.exe PID 1948 wrote to memory of 4984 1948 cmd.exe schtasks.exe PID 1948 wrote to memory of 4984 1948 cmd.exe schtasks.exe PID 4452 wrote to memory of 3808 4452 cmd.exe schtasks.exe PID 4452 wrote to memory of 3808 4452 cmd.exe schtasks.exe PID 4452 wrote to memory of 3808 4452 cmd.exe schtasks.exe PID 4152 wrote to memory of 1280 4152 cmd.exe schtasks.exe PID 4152 wrote to memory of 1280 4152 cmd.exe schtasks.exe PID 4152 wrote to memory of 1280 4152 cmd.exe schtasks.exe PID 3972 wrote to memory of 2428 3972 cmd.exe schtasks.exe PID 3972 wrote to memory of 2428 3972 cmd.exe schtasks.exe PID 3972 wrote to memory of 2428 3972 cmd.exe schtasks.exe PID 1248 wrote to memory of 3916 1248 cmd.exe schtasks.exe PID 1248 wrote to memory of 3916 1248 cmd.exe schtasks.exe PID 1248 wrote to memory of 3916 1248 cmd.exe schtasks.exe PID 4576 wrote to memory of 3284 4576 cmd.exe schtasks.exe PID 4576 wrote to memory of 3284 4576 cmd.exe schtasks.exe PID 4576 wrote to memory of 3284 4576 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3892" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3892" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9270" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1633" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5701" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 13882⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\48bf1f078da321436371849d997b614084af6df6140ee8bc3f7e00916e6d1db7.exe"1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-206-0x0000000000000000-mapping.dmp
-
memory/1280-245-0x0000000000000000-mapping.dmp
-
memory/1848-158-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-145-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-132-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-137-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-138-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-139-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-140-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-141-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-142-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-143-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-157-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-159-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-160-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-148-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-149-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-150-0x0000000000410000-0x00000000004C0000-memory.dmpFilesize
704KB
-
memory/1848-151-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-152-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-153-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-154-0x00000000052F0000-0x00000000057EE000-memory.dmpFilesize
5.0MB
-
memory/1848-155-0x0000000004DF0000-0x0000000004E82000-memory.dmpFilesize
584KB
-
memory/1848-156-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-161-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-147-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-144-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-163-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-162-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-164-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-165-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-166-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-167-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-168-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-169-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-171-0x0000000004DB0000-0x0000000004DBA000-memory.dmpFilesize
40KB
-
memory/1848-170-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1948-177-0x0000000000000000-mapping.dmp
-
memory/1948-185-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1948-189-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1948-182-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/2316-217-0x0000000000000000-mapping.dmp
-
memory/2428-246-0x0000000000000000-mapping.dmp
-
memory/3284-275-0x0000000000000000-mapping.dmp
-
memory/3808-244-0x0000000000000000-mapping.dmp
-
memory/3916-273-0x0000000000000000-mapping.dmp
-
memory/3968-188-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3968-176-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3968-173-0x0000000000000000-mapping.dmp
-
memory/3968-179-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3968-183-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3972-175-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3972-174-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3972-178-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3972-172-0x0000000000000000-mapping.dmp
-
memory/3972-181-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/4152-190-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/4152-184-0x0000000000000000-mapping.dmp
-
memory/4452-186-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/4452-180-0x0000000000000000-mapping.dmp
-
memory/4484-187-0x0000000000000000-mapping.dmp
-
memory/4500-192-0x0000000000000000-mapping.dmp
-
memory/4576-197-0x0000000000000000-mapping.dmp
-
memory/4812-242-0x0000000000000000-mapping.dmp
-
memory/4884-202-0x0000000000000000-mapping.dmp
-
memory/4984-243-0x0000000000000000-mapping.dmp
-
memory/5008-211-0x0000000000000000-mapping.dmp