Analysis
-
max time kernel
77s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2022 20:44
Static task
static1
Behavioral task
behavioral1
Sample
1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe
-
Size
896KB
-
MD5
4d656ee33b70f8b525df4e3de3d886bd
-
SHA1
79637a3f62f2dc6f86600e98a729d6aa386b7d2d
-
SHA256
1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106
-
SHA512
392e22cb57c08dadb35314154b10bbe33561b248552d6e1825fb4bd13fa2f04f43756e3ffe445d941b86ef2147df826514ad44c33bfac8ec9360b12006909b1a
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4288 4856 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3680 schtasks.exe 5056 schtasks.exe 4292 schtasks.exe 3540 schtasks.exe 2264 schtasks.exe 4088 schtasks.exe 3544 schtasks.exe 4692 schtasks.exe 2872 schtasks.exe 3104 schtasks.exe 928 schtasks.exe 3440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2536 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 84 PID 4856 wrote to memory of 2536 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 84 PID 4856 wrote to memory of 2536 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 84 PID 4856 wrote to memory of 3784 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 85 PID 4856 wrote to memory of 3784 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 85 PID 4856 wrote to memory of 3784 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 85 PID 4856 wrote to memory of 3740 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 107 PID 4856 wrote to memory of 3740 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 107 PID 4856 wrote to memory of 3740 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 107 PID 4856 wrote to memory of 3744 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 86 PID 4856 wrote to memory of 3744 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 86 PID 4856 wrote to memory of 3744 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 86 PID 4856 wrote to memory of 3624 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 106 PID 4856 wrote to memory of 3624 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 106 PID 4856 wrote to memory of 3624 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 106 PID 4856 wrote to memory of 2720 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 88 PID 4856 wrote to memory of 2720 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 88 PID 4856 wrote to memory of 2720 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 88 PID 4856 wrote to memory of 4532 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 89 PID 4856 wrote to memory of 4532 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 89 PID 4856 wrote to memory of 4532 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 89 PID 4856 wrote to memory of 256 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 90 PID 4856 wrote to memory of 256 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 90 PID 4856 wrote to memory of 256 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 90 PID 4856 wrote to memory of 1920 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 91 PID 4856 wrote to memory of 1920 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 91 PID 4856 wrote to memory of 1920 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 91 PID 4856 wrote to memory of 4752 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 92 PID 4856 wrote to memory of 4752 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 92 PID 4856 wrote to memory of 4752 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 92 PID 4856 wrote to memory of 2792 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 94 PID 4856 wrote to memory of 2792 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 94 PID 4856 wrote to memory of 2792 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 94 PID 4856 wrote to memory of 4328 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 101 PID 4856 wrote to memory of 4328 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 101 PID 4856 wrote to memory of 4328 4856 1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe 101 PID 256 wrote to memory of 2264 256 cmd.exe 110 PID 256 wrote to memory of 2264 256 cmd.exe 110 PID 256 wrote to memory of 2264 256 cmd.exe 110 PID 3740 wrote to memory of 3440 3740 cmd.exe 108 PID 3740 wrote to memory of 3440 3740 cmd.exe 108 PID 3740 wrote to memory of 3440 3740 cmd.exe 108 PID 2720 wrote to memory of 4088 2720 cmd.exe 109 PID 2720 wrote to memory of 4088 2720 cmd.exe 109 PID 2720 wrote to memory of 4088 2720 cmd.exe 109 PID 3624 wrote to memory of 3680 3624 cmd.exe 111 PID 3624 wrote to memory of 3680 3624 cmd.exe 111 PID 3624 wrote to memory of 3680 3624 cmd.exe 111 PID 4752 wrote to memory of 4692 4752 cmd.exe 113 PID 4752 wrote to memory of 4692 4752 cmd.exe 113 PID 4752 wrote to memory of 4692 4752 cmd.exe 113 PID 2536 wrote to memory of 5056 2536 cmd.exe 114 PID 2536 wrote to memory of 5056 2536 cmd.exe 114 PID 2536 wrote to memory of 5056 2536 cmd.exe 114 PID 1920 wrote to memory of 3544 1920 cmd.exe 112 PID 1920 wrote to memory of 3544 1920 cmd.exe 112 PID 1920 wrote to memory of 3544 1920 cmd.exe 112 PID 3784 wrote to memory of 928 3784 cmd.exe 119 PID 3784 wrote to memory of 928 3784 cmd.exe 119 PID 3784 wrote to memory of 928 3784 cmd.exe 119 PID 3744 wrote to memory of 3104 3744 cmd.exe 118 PID 3744 wrote to memory of 3104 3744 cmd.exe 118 PID 3744 wrote to memory of 3104 3744 cmd.exe 118 PID 4532 wrote to memory of 2872 4532 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:5056
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:928
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:3104
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:4088
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:2872
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk67" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk67" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:3544
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8602" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8602" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:4692
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7847" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵PID:2792
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7847" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:3540
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3372" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵PID:4328
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3372" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:4292
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:3680
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\1bd265e11c7085182ccf136bc98656f844f2af4495fb7e03642bb36171490106.exe"3⤵
- Creates scheduled task(s)
PID:3440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 10882⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4856 -ip 48561⤵PID:2480