Analysis
-
max time kernel
85s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2022, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe
-
Size
880KB
-
MD5
182136e2997197ac78a31126e3e6fd21
-
SHA1
a67627e8c6f9cda6893bba15ca5915fdf7680db3
-
SHA256
dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5
-
SHA512
dffed40e2a274cb75f9a49ce95b0bccf0b6de71a1572f8895c3c2bc84577bd7dd17741a5b581c0124efd7c034d5e9257e915df5717887f44fca6f14ee087ea5e
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2756 4888 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1500 schtasks.exe 908 schtasks.exe 3092 schtasks.exe 4064 schtasks.exe 3472 schtasks.exe 3800 schtasks.exe 4268 schtasks.exe 876 schtasks.exe 4220 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3428 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 83 PID 4888 wrote to memory of 3428 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 83 PID 4888 wrote to memory of 3428 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 83 PID 4888 wrote to memory of 5116 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 84 PID 4888 wrote to memory of 5116 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 84 PID 4888 wrote to memory of 5116 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 84 PID 4888 wrote to memory of 2120 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 89 PID 4888 wrote to memory of 2120 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 89 PID 4888 wrote to memory of 2120 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 89 PID 4888 wrote to memory of 3676 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 88 PID 4888 wrote to memory of 3676 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 88 PID 4888 wrote to memory of 3676 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 88 PID 4888 wrote to memory of 208 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 91 PID 4888 wrote to memory of 208 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 91 PID 4888 wrote to memory of 208 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 91 PID 4888 wrote to memory of 2620 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 103 PID 4888 wrote to memory of 2620 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 103 PID 4888 wrote to memory of 2620 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 103 PID 4888 wrote to memory of 3924 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 102 PID 4888 wrote to memory of 3924 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 102 PID 4888 wrote to memory of 3924 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 102 PID 4888 wrote to memory of 5052 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 101 PID 4888 wrote to memory of 5052 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 101 PID 4888 wrote to memory of 5052 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 101 PID 4888 wrote to memory of 1980 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 95 PID 4888 wrote to memory of 1980 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 95 PID 4888 wrote to memory of 1980 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 95 PID 4888 wrote to memory of 1376 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 96 PID 4888 wrote to memory of 1376 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 96 PID 4888 wrote to memory of 1376 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 96 PID 4888 wrote to memory of 5036 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 97 PID 4888 wrote to memory of 5036 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 97 PID 4888 wrote to memory of 5036 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 97 PID 4888 wrote to memory of 1312 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 104 PID 4888 wrote to memory of 1312 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 104 PID 4888 wrote to memory of 1312 4888 dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe 104 PID 3428 wrote to memory of 4220 3428 cmd.exe 115 PID 3428 wrote to memory of 4220 3428 cmd.exe 115 PID 3428 wrote to memory of 4220 3428 cmd.exe 115 PID 2120 wrote to memory of 3092 2120 cmd.exe 113 PID 2120 wrote to memory of 3092 2120 cmd.exe 113 PID 2120 wrote to memory of 3092 2120 cmd.exe 113 PID 5036 wrote to memory of 876 5036 cmd.exe 112 PID 5036 wrote to memory of 876 5036 cmd.exe 112 PID 5036 wrote to memory of 876 5036 cmd.exe 112 PID 2620 wrote to memory of 1500 2620 cmd.exe 107 PID 2620 wrote to memory of 1500 2620 cmd.exe 107 PID 2620 wrote to memory of 1500 2620 cmd.exe 107 PID 1980 wrote to memory of 4268 1980 cmd.exe 111 PID 1980 wrote to memory of 4268 1980 cmd.exe 111 PID 1980 wrote to memory of 4268 1980 cmd.exe 111 PID 3924 wrote to memory of 908 3924 cmd.exe 109 PID 3924 wrote to memory of 908 3924 cmd.exe 109 PID 3924 wrote to memory of 908 3924 cmd.exe 109 PID 5052 wrote to memory of 3472 5052 cmd.exe 108 PID 5052 wrote to memory of 3472 5052 cmd.exe 108 PID 5052 wrote to memory of 3472 5052 cmd.exe 108 PID 5116 wrote to memory of 3800 5116 cmd.exe 110 PID 5116 wrote to memory of 3800 5116 cmd.exe 110 PID 5116 wrote to memory of 3800 5116 cmd.exe 110 PID 1376 wrote to memory of 4064 1376 cmd.exe 114 PID 1376 wrote to memory of 4064 1376 cmd.exe 114 PID 1376 wrote to memory of 4064 1376 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:4220
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:3800
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵PID:3676
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:3092
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵PID:208
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9987" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9987" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:4268
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2612" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2612" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk670" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk670" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:876
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:3472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:908
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"3⤵
- Creates scheduled task(s)
PID:1500
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7757" /TR "C:\Users\Admin\AppData\Local\Temp\dfc092f11d1822cfca2ec8c3ac0ef78501e8d97a40e4d0c0144e7b6ad95134d5.exe"2⤵PID:1312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 13642⤵
- Program crash
PID:2756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4888 -ip 48881⤵PID:4028