Analysis
-
max time kernel
113s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2022, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe
-
Size
890KB
-
MD5
689aaea54fbf95813a7b0844764c8a2f
-
SHA1
960acbee8be05452e3a3c7d199a415e984480473
-
SHA256
94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc
-
SHA512
79117d5e6a9217816beb049d34bed1c2ed8c94e0f7d9d62e7e64ab765a51c7cebbb673ae41c83a896bf84057c590447c53347a2fc51c15e23aa161d1f88a20c7
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4556 1360 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2156 schtasks.exe 4472 schtasks.exe 3480 schtasks.exe 2880 schtasks.exe 3648 schtasks.exe 4900 schtasks.exe 1312 schtasks.exe 2228 schtasks.exe 4568 schtasks.exe 1568 schtasks.exe 1836 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 1548 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 84 PID 1360 wrote to memory of 1548 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 84 PID 1360 wrote to memory of 1548 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 84 PID 1360 wrote to memory of 4380 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 85 PID 1360 wrote to memory of 4380 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 85 PID 1360 wrote to memory of 4380 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 85 PID 1360 wrote to memory of 4668 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 86 PID 1360 wrote to memory of 4668 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 86 PID 1360 wrote to memory of 4668 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 86 PID 1360 wrote to memory of 4384 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 91 PID 1360 wrote to memory of 4384 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 91 PID 1360 wrote to memory of 4384 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 91 PID 1360 wrote to memory of 4448 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 89 PID 1360 wrote to memory of 4448 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 89 PID 1360 wrote to memory of 4448 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 89 PID 1360 wrote to memory of 4964 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 93 PID 1360 wrote to memory of 4964 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 93 PID 1360 wrote to memory of 4964 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 93 PID 1360 wrote to memory of 1832 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 95 PID 1360 wrote to memory of 1832 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 95 PID 1360 wrote to memory of 1832 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 95 PID 1360 wrote to memory of 2080 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 96 PID 1360 wrote to memory of 2080 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 96 PID 1360 wrote to memory of 2080 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 96 PID 1360 wrote to memory of 3824 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 97 PID 1360 wrote to memory of 3824 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 97 PID 1360 wrote to memory of 3824 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 97 PID 1360 wrote to memory of 3628 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 104 PID 1360 wrote to memory of 3628 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 104 PID 1360 wrote to memory of 3628 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 104 PID 1360 wrote to memory of 3664 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 102 PID 1360 wrote to memory of 3664 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 102 PID 1360 wrote to memory of 3664 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 102 PID 1360 wrote to memory of 2092 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 101 PID 1360 wrote to memory of 2092 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 101 PID 1360 wrote to memory of 2092 1360 94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe 101 PID 1548 wrote to memory of 2156 1548 cmd.exe 108 PID 1548 wrote to memory of 2156 1548 cmd.exe 108 PID 1548 wrote to memory of 2156 1548 cmd.exe 108 PID 2080 wrote to memory of 4900 2080 cmd.exe 109 PID 2080 wrote to memory of 4900 2080 cmd.exe 109 PID 2080 wrote to memory of 4900 2080 cmd.exe 109 PID 4668 wrote to memory of 1312 4668 cmd.exe 110 PID 4668 wrote to memory of 1312 4668 cmd.exe 110 PID 4668 wrote to memory of 1312 4668 cmd.exe 110 PID 4380 wrote to memory of 4568 4380 cmd.exe 112 PID 4380 wrote to memory of 4568 4380 cmd.exe 112 PID 4380 wrote to memory of 4568 4380 cmd.exe 112 PID 4384 wrote to memory of 2228 4384 cmd.exe 111 PID 4384 wrote to memory of 2228 4384 cmd.exe 111 PID 4384 wrote to memory of 2228 4384 cmd.exe 111 PID 4964 wrote to memory of 4472 4964 cmd.exe 115 PID 4964 wrote to memory of 4472 4964 cmd.exe 115 PID 4964 wrote to memory of 4472 4964 cmd.exe 115 PID 4448 wrote to memory of 1836 4448 cmd.exe 114 PID 4448 wrote to memory of 1836 4448 cmd.exe 114 PID 4448 wrote to memory of 1836 4448 cmd.exe 114 PID 1832 wrote to memory of 1568 1832 cmd.exe 113 PID 1832 wrote to memory of 1568 1832 cmd.exe 113 PID 1832 wrote to memory of 1568 1832 cmd.exe 113 PID 3824 wrote to memory of 2880 3824 cmd.exe 116 PID 3824 wrote to memory of 2880 3824 cmd.exe 116 PID 3824 wrote to memory of 2880 3824 cmd.exe 116 PID 3664 wrote to memory of 3648 3664 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:4568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:1836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:2228
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:4472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4415" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4415" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3234" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵PID:2092
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8804" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8804" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2931" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"2⤵PID:3628
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2931" /TR "C:\Users\Admin\AppData\Local\Temp\94e02c224fd39769613813fd6783ffcd3a6e090a4742e1f43dca0be755abb1cc.exe"3⤵
- Creates scheduled task(s)
PID:3480
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 10362⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1360 -ip 13601⤵PID:1428