Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09/09/2022, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe
Resource
win10-20220812-en
General
-
Target
1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe
-
Size
884KB
-
MD5
607a2ac432aa2cb05217cc3eef11b8c9
-
SHA1
cfa1101cc321c384ec6b260d727d02a2d24b6b29
-
SHA256
1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844
-
SHA512
69a05069615854b271b76ebf07b7e073edff9e7d7905e75f86adc0269fec74100da661a87add53584863fd77b03a89a306fbb1a17b177145430fafc9e5581c5f
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 580 2704 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4844 schtasks.exe 4024 schtasks.exe 4064 schtasks.exe 4636 schtasks.exe 3512 schtasks.exe 4012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2704 wrote to memory of 4772 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 66 PID 2704 wrote to memory of 4772 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 66 PID 2704 wrote to memory of 4772 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 66 PID 2704 wrote to memory of 2140 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 67 PID 2704 wrote to memory of 2140 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 67 PID 2704 wrote to memory of 2140 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 67 PID 2704 wrote to memory of 4720 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 78 PID 2704 wrote to memory of 4720 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 78 PID 2704 wrote to memory of 4720 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 78 PID 2704 wrote to memory of 4820 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 77 PID 2704 wrote to memory of 4820 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 77 PID 2704 wrote to memory of 4820 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 77 PID 2704 wrote to memory of 4832 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 76 PID 2704 wrote to memory of 4832 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 76 PID 2704 wrote to memory of 4832 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 76 PID 2704 wrote to memory of 4748 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 75 PID 2704 wrote to memory of 4748 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 75 PID 2704 wrote to memory of 4748 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 75 PID 2704 wrote to memory of 4716 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 72 PID 2704 wrote to memory of 4716 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 72 PID 2704 wrote to memory of 4716 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 72 PID 2704 wrote to memory of 3472 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 68 PID 2704 wrote to memory of 3472 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 68 PID 2704 wrote to memory of 3472 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 68 PID 2704 wrote to memory of 1544 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 69 PID 2704 wrote to memory of 1544 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 69 PID 2704 wrote to memory of 1544 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 69 PID 2704 wrote to memory of 2816 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 70 PID 2704 wrote to memory of 2816 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 70 PID 2704 wrote to memory of 2816 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 70 PID 2704 wrote to memory of 4388 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 79 PID 2704 wrote to memory of 4388 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 79 PID 2704 wrote to memory of 4388 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 79 PID 2704 wrote to memory of 1532 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 82 PID 2704 wrote to memory of 1532 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 82 PID 2704 wrote to memory of 1532 2704 1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe 82 PID 2140 wrote to memory of 4844 2140 cmd.exe 90 PID 2140 wrote to memory of 4844 2140 cmd.exe 90 PID 2140 wrote to memory of 4844 2140 cmd.exe 90 PID 4388 wrote to memory of 4024 4388 cmd.exe 91 PID 4388 wrote to memory of 4024 4388 cmd.exe 91 PID 4388 wrote to memory of 4024 4388 cmd.exe 91 PID 4832 wrote to memory of 4064 4832 cmd.exe 92 PID 4832 wrote to memory of 4064 4832 cmd.exe 92 PID 4832 wrote to memory of 4064 4832 cmd.exe 92 PID 4820 wrote to memory of 4012 4820 cmd.exe 95 PID 4820 wrote to memory of 4012 4820 cmd.exe 95 PID 4820 wrote to memory of 4012 4820 cmd.exe 95 PID 4772 wrote to memory of 3512 4772 cmd.exe 94 PID 4772 wrote to memory of 3512 4772 cmd.exe 94 PID 4772 wrote to memory of 3512 4772 cmd.exe 94 PID 2816 wrote to memory of 4636 2816 cmd.exe 93 PID 2816 wrote to memory of 4636 2816 cmd.exe 93 PID 2816 wrote to memory of 4636 2816 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:3512
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:4844
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:3472
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1067" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:1544
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8425" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8425" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:4716
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:4748
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:4012
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:4720
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7719" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7719" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"3⤵
- Creates scheduled task(s)
PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8394" /TR "C:\Users\Admin\AppData\Local\Temp\1584c92ac78974b7f69b2cceec0421657a90e53ca083270590b596b3be057844.exe"2⤵PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 13202⤵
- Program crash
PID:580
-