Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2022, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe
-
Size
882KB
-
MD5
d28e65004ddb9dc757bcd6c098c2416e
-
SHA1
42d4038e7f85c54855fe58988da788b526833bbf
-
SHA256
984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579
-
SHA512
b9f5ddec78d73071f639f2ac8efdd2e83e0f91fe9b41f9a3ebcd714ad7b530431fa63039905f9014ac406b5f383c39e29f1896a23b9b85b6df09a5af8a427a26
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe" 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1544 4904 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3608 schtasks.exe 4332 schtasks.exe 1184 schtasks.exe 3236 schtasks.exe 3464 schtasks.exe 1364 schtasks.exe 4288 schtasks.exe 3816 schtasks.exe 4804 schtasks.exe 4368 schtasks.exe 4336 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4716 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 84 PID 4904 wrote to memory of 4716 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 84 PID 4904 wrote to memory of 4716 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 84 PID 4904 wrote to memory of 3112 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 89 PID 4904 wrote to memory of 3112 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 89 PID 4904 wrote to memory of 3112 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 89 PID 4904 wrote to memory of 5108 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 85 PID 4904 wrote to memory of 5108 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 85 PID 4904 wrote to memory of 5108 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 85 PID 4904 wrote to memory of 5064 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 87 PID 4904 wrote to memory of 5064 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 87 PID 4904 wrote to memory of 5064 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 87 PID 4904 wrote to memory of 4348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 91 PID 4904 wrote to memory of 4348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 91 PID 4904 wrote to memory of 4348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 91 PID 4904 wrote to memory of 4520 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 93 PID 4904 wrote to memory of 4520 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 93 PID 4904 wrote to memory of 4520 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 93 PID 4904 wrote to memory of 1284 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 94 PID 4904 wrote to memory of 1284 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 94 PID 4904 wrote to memory of 1284 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 94 PID 4904 wrote to memory of 1940 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 98 PID 4904 wrote to memory of 1940 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 98 PID 4904 wrote to memory of 1940 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 98 PID 4904 wrote to memory of 2944 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 99 PID 4904 wrote to memory of 2944 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 99 PID 4904 wrote to memory of 2944 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 99 PID 4904 wrote to memory of 1368 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 105 PID 4904 wrote to memory of 1368 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 105 PID 4904 wrote to memory of 1368 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 105 PID 4904 wrote to memory of 2872 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 102 PID 4904 wrote to memory of 2872 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 102 PID 4904 wrote to memory of 2872 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 102 PID 4904 wrote to memory of 1348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 103 PID 4904 wrote to memory of 1348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 103 PID 4904 wrote to memory of 1348 4904 984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe 103 PID 4716 wrote to memory of 4288 4716 cmd.exe 108 PID 4716 wrote to memory of 4288 4716 cmd.exe 108 PID 4716 wrote to memory of 4288 4716 cmd.exe 108 PID 5108 wrote to memory of 1184 5108 cmd.exe 110 PID 5108 wrote to memory of 1184 5108 cmd.exe 110 PID 5108 wrote to memory of 1184 5108 cmd.exe 110 PID 2872 wrote to memory of 4332 2872 cmd.exe 109 PID 2872 wrote to memory of 4332 2872 cmd.exe 109 PID 2872 wrote to memory of 4332 2872 cmd.exe 109 PID 2944 wrote to memory of 4804 2944 cmd.exe 114 PID 2944 wrote to memory of 4804 2944 cmd.exe 114 PID 2944 wrote to memory of 4804 2944 cmd.exe 114 PID 1940 wrote to memory of 3236 1940 cmd.exe 112 PID 1940 wrote to memory of 3236 1940 cmd.exe 112 PID 1940 wrote to memory of 3236 1940 cmd.exe 112 PID 3112 wrote to memory of 3464 3112 cmd.exe 113 PID 3112 wrote to memory of 3464 3112 cmd.exe 113 PID 3112 wrote to memory of 3464 3112 cmd.exe 113 PID 5064 wrote to memory of 3816 5064 cmd.exe 111 PID 5064 wrote to memory of 3816 5064 cmd.exe 111 PID 5064 wrote to memory of 3816 5064 cmd.exe 111 PID 4348 wrote to memory of 4336 4348 cmd.exe 117 PID 4348 wrote to memory of 4336 4348 cmd.exe 117 PID 4348 wrote to memory of 4336 4348 cmd.exe 117 PID 1368 wrote to memory of 4368 1368 cmd.exe 116 PID 1368 wrote to memory of 4368 1368 cmd.exe 116 PID 1368 wrote to memory of 4368 1368 cmd.exe 116 PID 1284 wrote to memory of 1364 1284 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:4288
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:3816
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:3464
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:4336
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵PID:4520
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:3236
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3482" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3482" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:4804
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6196" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6196" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:4332
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3512" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵PID:1348
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3512" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7355" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7355" /TR "C:\Users\Admin\AppData\Local\Temp\984998bc814cbcf26a2fb9330e9878c4660f3b1b00f0b3ee507d1f5ba4cf7579.exe"3⤵
- Creates scheduled task(s)
PID:4368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 10402⤵
- Program crash
PID:1544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4904 -ip 49041⤵PID:3364