Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2022, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe
-
Size
878KB
-
MD5
052037bae5bed256aedae49a2b624b52
-
SHA1
96e0f460e0e158de0cf624cc545bc6641fed27c3
-
SHA256
f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7
-
SHA512
23fda0ffb23afae36e6eafc308c0fa8a80c37ffd14501d57103163f1efcf11a9696f742533ab3c32d01ba02be5b220495786b4d6fdb439933ca2b2b1d6868e85
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1276 4484 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1608 schtasks.exe 3052 schtasks.exe 3712 schtasks.exe 976 schtasks.exe 3720 schtasks.exe 452 schtasks.exe 5088 schtasks.exe 3120 schtasks.exe 4372 schtasks.exe 3188 schtasks.exe 588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 5036 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 82 PID 4484 wrote to memory of 5036 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 82 PID 4484 wrote to memory of 5036 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 82 PID 4484 wrote to memory of 5096 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 83 PID 4484 wrote to memory of 5096 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 83 PID 4484 wrote to memory of 5096 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 83 PID 4484 wrote to memory of 4696 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 84 PID 4484 wrote to memory of 4696 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 84 PID 4484 wrote to memory of 4696 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 84 PID 4484 wrote to memory of 4668 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 85 PID 4484 wrote to memory of 4668 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 85 PID 4484 wrote to memory of 4668 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 85 PID 4484 wrote to memory of 4864 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 102 PID 4484 wrote to memory of 4864 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 102 PID 4484 wrote to memory of 4864 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 102 PID 4484 wrote to memory of 1776 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 86 PID 4484 wrote to memory of 1776 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 86 PID 4484 wrote to memory of 1776 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 86 PID 4484 wrote to memory of 2828 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 92 PID 4484 wrote to memory of 2828 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 92 PID 4484 wrote to memory of 2828 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 92 PID 4484 wrote to memory of 4224 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 88 PID 4484 wrote to memory of 4224 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 88 PID 4484 wrote to memory of 4224 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 88 PID 4484 wrote to memory of 1180 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 90 PID 4484 wrote to memory of 1180 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 90 PID 4484 wrote to memory of 1180 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 90 PID 4484 wrote to memory of 2548 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 101 PID 4484 wrote to memory of 2548 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 101 PID 4484 wrote to memory of 2548 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 101 PID 4484 wrote to memory of 2336 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 95 PID 4484 wrote to memory of 2336 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 95 PID 4484 wrote to memory of 2336 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 95 PID 4484 wrote to memory of 1052 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 96 PID 4484 wrote to memory of 1052 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 96 PID 4484 wrote to memory of 1052 4484 f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe 96 PID 1776 wrote to memory of 3052 1776 cmd.exe 106 PID 1776 wrote to memory of 3052 1776 cmd.exe 106 PID 1776 wrote to memory of 3052 1776 cmd.exe 106 PID 2828 wrote to memory of 5088 2828 cmd.exe 107 PID 2828 wrote to memory of 5088 2828 cmd.exe 107 PID 2828 wrote to memory of 5088 2828 cmd.exe 107 PID 4696 wrote to memory of 4372 4696 cmd.exe 111 PID 4696 wrote to memory of 4372 4696 cmd.exe 111 PID 4696 wrote to memory of 4372 4696 cmd.exe 111 PID 5036 wrote to memory of 976 5036 cmd.exe 110 PID 5036 wrote to memory of 976 5036 cmd.exe 110 PID 5036 wrote to memory of 976 5036 cmd.exe 110 PID 2336 wrote to memory of 3120 2336 cmd.exe 108 PID 2336 wrote to memory of 3120 2336 cmd.exe 108 PID 2336 wrote to memory of 3120 2336 cmd.exe 108 PID 4864 wrote to memory of 3712 4864 cmd.exe 109 PID 4864 wrote to memory of 3712 4864 cmd.exe 109 PID 4864 wrote to memory of 3712 4864 cmd.exe 109 PID 4668 wrote to memory of 3188 4668 cmd.exe 112 PID 4668 wrote to memory of 3188 4668 cmd.exe 112 PID 4668 wrote to memory of 3188 4668 cmd.exe 112 PID 5096 wrote to memory of 3720 5096 cmd.exe 113 PID 5096 wrote to memory of 3720 5096 cmd.exe 113 PID 5096 wrote to memory of 3720 5096 cmd.exe 113 PID 4224 wrote to memory of 452 4224 cmd.exe 114 PID 4224 wrote to memory of 452 4224 cmd.exe 114 PID 4224 wrote to memory of 452 4224 cmd.exe 114 PID 2548 wrote to memory of 588 2548 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:976
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:3720
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:3188
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:3052
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:452
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9813" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵PID:1180
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2417" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2417" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:3120
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6710" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵PID:1052
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6710" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:1608
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6479" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6479" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:588
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\f5879366472ca4531d1e825ef9efb41400df299cfea956e806d16a572a071aa7.exe"3⤵
- Creates scheduled task(s)
PID:3712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 14362⤵
- Program crash
PID:1276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4484 -ip 44841⤵PID:2256