Analysis
-
max time kernel
78s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2022, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe
-
Size
888KB
-
MD5
a765ecfd853abc79ddaa3684460a0df3
-
SHA1
f8ea52013c18f05b80a74dda45f831fa3479bb65
-
SHA256
19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727
-
SHA512
dae88f9865fc7398bf999436617c84ad290009b1ad4343f80957f400380ace9c1df6b0989b5518f9b3e2133c91f61f0d322ce6906f1f75551c7e296d7922deb9
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4908 1096 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4152 schtasks.exe 3772 schtasks.exe 3308 schtasks.exe 5104 schtasks.exe 4232 schtasks.exe 1944 schtasks.exe 796 schtasks.exe 2340 schtasks.exe 4704 schtasks.exe 1376 schtasks.exe 4512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 4200 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 86 PID 1096 wrote to memory of 4200 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 86 PID 1096 wrote to memory of 4200 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 86 PID 1096 wrote to memory of 1444 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 87 PID 1096 wrote to memory of 1444 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 87 PID 1096 wrote to memory of 1444 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 87 PID 1096 wrote to memory of 4608 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 90 PID 1096 wrote to memory of 4608 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 90 PID 1096 wrote to memory of 4608 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 90 PID 1096 wrote to memory of 4296 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 91 PID 1096 wrote to memory of 4296 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 91 PID 1096 wrote to memory of 4296 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 91 PID 1096 wrote to memory of 1016 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 92 PID 1096 wrote to memory of 1016 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 92 PID 1096 wrote to memory of 1016 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 92 PID 1096 wrote to memory of 424 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 95 PID 1096 wrote to memory of 424 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 95 PID 1096 wrote to memory of 424 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 95 PID 4200 wrote to memory of 796 4200 cmd.exe 98 PID 4200 wrote to memory of 796 4200 cmd.exe 98 PID 4200 wrote to memory of 796 4200 cmd.exe 98 PID 1096 wrote to memory of 4972 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 97 PID 1096 wrote to memory of 4972 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 97 PID 1096 wrote to memory of 4972 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 97 PID 1096 wrote to memory of 908 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 100 PID 1096 wrote to memory of 908 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 100 PID 1096 wrote to memory of 908 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 100 PID 1096 wrote to memory of 3472 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 101 PID 1096 wrote to memory of 3472 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 101 PID 1096 wrote to memory of 3472 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 101 PID 1096 wrote to memory of 1564 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 102 PID 1096 wrote to memory of 1564 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 102 PID 1096 wrote to memory of 1564 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 102 PID 1096 wrote to memory of 4192 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 104 PID 1096 wrote to memory of 4192 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 104 PID 1096 wrote to memory of 4192 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 104 PID 1096 wrote to memory of 1248 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 105 PID 1096 wrote to memory of 1248 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 105 PID 1096 wrote to memory of 1248 1096 19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe 105 PID 4192 wrote to memory of 4152 4192 cmd.exe 111 PID 4192 wrote to memory of 4152 4192 cmd.exe 111 PID 4192 wrote to memory of 4152 4192 cmd.exe 111 PID 1444 wrote to memory of 3772 1444 cmd.exe 112 PID 1444 wrote to memory of 3772 1444 cmd.exe 112 PID 1444 wrote to memory of 3772 1444 cmd.exe 112 PID 4608 wrote to memory of 1944 4608 cmd.exe 118 PID 4608 wrote to memory of 1944 4608 cmd.exe 118 PID 4608 wrote to memory of 1944 4608 cmd.exe 118 PID 4296 wrote to memory of 2340 4296 cmd.exe 114 PID 4296 wrote to memory of 2340 4296 cmd.exe 114 PID 4296 wrote to memory of 2340 4296 cmd.exe 114 PID 1016 wrote to memory of 4232 1016 cmd.exe 117 PID 1016 wrote to memory of 4232 1016 cmd.exe 117 PID 1016 wrote to memory of 4232 1016 cmd.exe 117 PID 424 wrote to memory of 3308 424 cmd.exe 113 PID 424 wrote to memory of 3308 424 cmd.exe 113 PID 424 wrote to memory of 3308 424 cmd.exe 113 PID 4972 wrote to memory of 4704 4972 cmd.exe 115 PID 4972 wrote to memory of 4704 4972 cmd.exe 115 PID 4972 wrote to memory of 4704 4972 cmd.exe 115 PID 3472 wrote to memory of 5104 3472 cmd.exe 116 PID 3472 wrote to memory of 5104 3472 cmd.exe 116 PID 3472 wrote to memory of 5104 3472 cmd.exe 116 PID 908 wrote to memory of 1376 908 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:3772
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:2340
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:4232
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:3308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:4704
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5420" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5420" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:5104
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8632" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵PID:1564
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8205" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8205" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:4152
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2327" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"2⤵PID:1248
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2327" /TR "C:\Users\Admin\AppData\Local\Temp\19a3e9a1b0a2c30494cc52877cf2d056cc6267b5b217260c4a9b120571201727.exe"3⤵
- Creates scheduled task(s)
PID:4512
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 13682⤵
- Program crash
PID:4908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1096 -ip 10961⤵PID:1792