Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2022, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe
-
Size
904KB
-
MD5
01b58dadfcaa4902f44d9b8283051a35
-
SHA1
f7a6b33063fe9f2087846f557cb3076186a3aa63
-
SHA256
89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa
-
SHA512
c0908257914e439c80126a1a4cfbc5c2ba27ee1e2554b5b32fa34580f0cf074ffb2e4fbbf3e4e34379c4f4df10e696e36a03c7267dd7c4d5e37ba22eaf703a4d
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3420 4696 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3708 schtasks.exe 3652 schtasks.exe 3832 schtasks.exe 2836 schtasks.exe 3044 schtasks.exe 2372 schtasks.exe 3764 schtasks.exe 116 schtasks.exe 180 schtasks.exe 2924 schtasks.exe 2316 schtasks.exe 2916 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2692 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 81 PID 4696 wrote to memory of 2692 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 81 PID 4696 wrote to memory of 2692 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 81 PID 4696 wrote to memory of 2740 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 82 PID 4696 wrote to memory of 2740 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 82 PID 4696 wrote to memory of 2740 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 82 PID 4696 wrote to memory of 668 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 104 PID 4696 wrote to memory of 668 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 104 PID 4696 wrote to memory of 668 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 104 PID 4696 wrote to memory of 4948 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 84 PID 4696 wrote to memory of 4948 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 84 PID 4696 wrote to memory of 4948 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 84 PID 4696 wrote to memory of 4904 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 86 PID 4696 wrote to memory of 4904 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 86 PID 4696 wrote to memory of 4904 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 86 PID 4696 wrote to memory of 4832 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 101 PID 4696 wrote to memory of 4832 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 101 PID 4696 wrote to memory of 4832 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 101 PID 4696 wrote to memory of 2288 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 87 PID 4696 wrote to memory of 2288 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 87 PID 4696 wrote to memory of 2288 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 87 PID 4696 wrote to memory of 448 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 88 PID 4696 wrote to memory of 448 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 88 PID 4696 wrote to memory of 448 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 88 PID 4696 wrote to memory of 4436 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 98 PID 4696 wrote to memory of 4436 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 98 PID 4696 wrote to memory of 4436 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 98 PID 4696 wrote to memory of 764 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 97 PID 4696 wrote to memory of 764 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 97 PID 4696 wrote to memory of 764 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 97 PID 4696 wrote to memory of 3164 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 93 PID 4696 wrote to memory of 3164 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 93 PID 4696 wrote to memory of 3164 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 93 PID 4696 wrote to memory of 3804 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 94 PID 4696 wrote to memory of 3804 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 94 PID 4696 wrote to memory of 3804 4696 89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe 94 PID 4948 wrote to memory of 180 4948 cmd.exe 111 PID 4948 wrote to memory of 180 4948 cmd.exe 111 PID 4948 wrote to memory of 180 4948 cmd.exe 111 PID 2288 wrote to memory of 3764 2288 cmd.exe 105 PID 2288 wrote to memory of 3764 2288 cmd.exe 105 PID 2288 wrote to memory of 3764 2288 cmd.exe 105 PID 2692 wrote to memory of 2836 2692 cmd.exe 109 PID 2692 wrote to memory of 2836 2692 cmd.exe 109 PID 2692 wrote to memory of 2836 2692 cmd.exe 109 PID 668 wrote to memory of 116 668 cmd.exe 110 PID 668 wrote to memory of 116 668 cmd.exe 110 PID 668 wrote to memory of 116 668 cmd.exe 110 PID 2740 wrote to memory of 3708 2740 cmd.exe 106 PID 2740 wrote to memory of 3708 2740 cmd.exe 106 PID 2740 wrote to memory of 3708 2740 cmd.exe 106 PID 4904 wrote to memory of 3652 4904 cmd.exe 107 PID 4904 wrote to memory of 3652 4904 cmd.exe 107 PID 4904 wrote to memory of 3652 4904 cmd.exe 107 PID 448 wrote to memory of 3832 448 cmd.exe 108 PID 448 wrote to memory of 3832 448 cmd.exe 108 PID 448 wrote to memory of 3832 448 cmd.exe 108 PID 764 wrote to memory of 2924 764 cmd.exe 112 PID 764 wrote to memory of 2924 764 cmd.exe 112 PID 764 wrote to memory of 2924 764 cmd.exe 112 PID 4832 wrote to memory of 2316 4832 cmd.exe 113 PID 4832 wrote to memory of 2316 4832 cmd.exe 113 PID 4832 wrote to memory of 2316 4832 cmd.exe 113 PID 4436 wrote to memory of 3044 4436 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:2836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:3708
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:180
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:3652
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:3764
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:3832
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9826" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵PID:3164
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9826" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4058" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵PID:3804
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4058" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:2372
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9734" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9734" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:2924
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8133" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8133" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:2316
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\89881e770a846470269863bdf750a76aa907f0fc134a735d1ef1d2a1565693aa.exe"3⤵
- Creates scheduled task(s)
PID:116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 14442⤵
- Program crash
PID:3420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 46961⤵PID:4796