Analysis
-
max time kernel
54s -
max time network
118s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
18/09/2022, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe
Resource
win10-20220812-en
6 signatures
150 seconds
General
-
Target
39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe
-
Size
906KB
-
MD5
18693ca7ddafb6b20c34dc891c5d3564
-
SHA1
babd28e1f33b74fbd8bfbef1f1d5ca0a4f6dbae7
-
SHA256
39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2
-
SHA512
c612a30ba7a5af7e58fc02653b6ce01c6af90ec4c5e6a16a29288aed1a964b1989bde19effb0f28450a29e541f0c760dcea5d2f0189e8011a887a690fb4d7e3d
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4288 1816 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4412 schtasks.exe 4160 schtasks.exe 4176 schtasks.exe 1972 schtasks.exe 2088 schtasks.exe 4388 schtasks.exe 4492 schtasks.exe 2140 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1816 wrote to memory of 4892 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 66 PID 1816 wrote to memory of 4892 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 66 PID 1816 wrote to memory of 4892 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 66 PID 1816 wrote to memory of 4996 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 67 PID 1816 wrote to memory of 4996 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 67 PID 1816 wrote to memory of 4996 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 67 PID 1816 wrote to memory of 4136 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 68 PID 1816 wrote to memory of 4136 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 68 PID 1816 wrote to memory of 4136 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 68 PID 1816 wrote to memory of 4148 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 69 PID 1816 wrote to memory of 4148 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 69 PID 1816 wrote to memory of 4148 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 69 PID 1816 wrote to memory of 4488 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 70 PID 1816 wrote to memory of 4488 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 70 PID 1816 wrote to memory of 4488 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 70 PID 1816 wrote to memory of 3496 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 72 PID 1816 wrote to memory of 3496 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 72 PID 1816 wrote to memory of 3496 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 72 PID 1816 wrote to memory of 4616 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 85 PID 1816 wrote to memory of 4616 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 85 PID 1816 wrote to memory of 4616 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 85 PID 1816 wrote to memory of 4660 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 83 PID 1816 wrote to memory of 4660 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 83 PID 1816 wrote to memory of 4660 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 83 PID 1816 wrote to memory of 2424 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 73 PID 1816 wrote to memory of 2424 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 73 PID 1816 wrote to memory of 2424 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 73 PID 1816 wrote to memory of 3724 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 80 PID 1816 wrote to memory of 3724 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 80 PID 1816 wrote to memory of 3724 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 80 PID 1816 wrote to memory of 3716 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 79 PID 1816 wrote to memory of 3716 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 79 PID 1816 wrote to memory of 3716 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 79 PID 1816 wrote to memory of 4024 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 77 PID 1816 wrote to memory of 4024 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 77 PID 1816 wrote to memory of 4024 1816 39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe 77 PID 4660 wrote to memory of 4412 4660 cmd.exe 96 PID 4660 wrote to memory of 4412 4660 cmd.exe 96 PID 4660 wrote to memory of 4412 4660 cmd.exe 96 PID 3496 wrote to memory of 4388 3496 cmd.exe 93 PID 3496 wrote to memory of 4388 3496 cmd.exe 93 PID 3496 wrote to memory of 4388 3496 cmd.exe 93 PID 4616 wrote to memory of 4492 4616 cmd.exe 94 PID 4616 wrote to memory of 4492 4616 cmd.exe 94 PID 4616 wrote to memory of 4492 4616 cmd.exe 94 PID 4148 wrote to memory of 2140 4148 cmd.exe 95 PID 4148 wrote to memory of 2140 4148 cmd.exe 95 PID 4148 wrote to memory of 2140 4148 cmd.exe 95 PID 2424 wrote to memory of 2088 2424 cmd.exe 92 PID 2424 wrote to memory of 2088 2424 cmd.exe 92 PID 2424 wrote to memory of 2088 2424 cmd.exe 92 PID 4892 wrote to memory of 1972 4892 cmd.exe 91 PID 4892 wrote to memory of 1972 4892 cmd.exe 91 PID 4892 wrote to memory of 1972 4892 cmd.exe 91 PID 4996 wrote to memory of 4176 4996 cmd.exe 90 PID 4996 wrote to memory of 4176 4996 cmd.exe 90 PID 4996 wrote to memory of 4176 4996 cmd.exe 90 PID 4024 wrote to memory of 4160 4024 cmd.exe 97 PID 4024 wrote to memory of 4160 4024 cmd.exe 97 PID 4024 wrote to memory of 4160 4024 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵PID:4136
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:2140
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵PID:4488
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:4388
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6447" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6447" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:2088
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5016" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5016" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:4160
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2667" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵PID:3716
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9882" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵PID:3724
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:4412
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\39d6fb2b42512df8b240bb2ce101008fd38cb1204dd2d665f783c6b7076c49b2.exe"3⤵
- Creates scheduled task(s)
PID:4492
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 13162⤵
- Program crash
PID:4288
-