Analysis
-
max time kernel
91s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 21:18
Static task
static1
Behavioral task
behavioral1
Sample
04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe
-
Size
906KB
-
MD5
3f36f499ecbd720254e2673b7b263c67
-
SHA1
555b122fcb88d569a5f780ced90242d5fd7bd460
-
SHA256
04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74
-
SHA512
04ce68551ee512d69c73092dcb21f0eab4e7dad3ac8baed4c9d159a79e18f9ca6e197b8a41e0b22540cd4b98f0bef7d5df4a5787ab5bb5cbbae42852aa7674f9
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4796 4868 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2612 schtasks.exe 3708 schtasks.exe 1796 schtasks.exe 4640 schtasks.exe 2776 schtasks.exe 2916 schtasks.exe 4612 schtasks.exe 1912 schtasks.exe 1136 schtasks.exe 5076 schtasks.exe 3976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4376 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 82 PID 4868 wrote to memory of 4376 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 82 PID 4868 wrote to memory of 4376 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 82 PID 4868 wrote to memory of 5116 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 83 PID 4868 wrote to memory of 5116 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 83 PID 4868 wrote to memory of 5116 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 83 PID 4868 wrote to memory of 668 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 98 PID 4868 wrote to memory of 668 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 98 PID 4868 wrote to memory of 668 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 98 PID 4868 wrote to memory of 2108 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 97 PID 4868 wrote to memory of 2108 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 97 PID 4868 wrote to memory of 2108 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 97 PID 4868 wrote to memory of 4904 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 96 PID 4868 wrote to memory of 4904 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 96 PID 4868 wrote to memory of 4904 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 96 PID 4868 wrote to memory of 4832 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 88 PID 4868 wrote to memory of 4832 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 88 PID 4868 wrote to memory of 4832 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 88 PID 4868 wrote to memory of 2580 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 89 PID 4868 wrote to memory of 2580 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 89 PID 4868 wrote to memory of 2580 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 89 PID 4868 wrote to memory of 3836 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 90 PID 4868 wrote to memory of 3836 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 90 PID 4868 wrote to memory of 3836 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 90 PID 4868 wrote to memory of 2076 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 92 PID 4868 wrote to memory of 2076 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 92 PID 4868 wrote to memory of 2076 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 92 PID 4868 wrote to memory of 1196 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 99 PID 4868 wrote to memory of 1196 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 99 PID 4868 wrote to memory of 1196 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 99 PID 4868 wrote to memory of 5088 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 100 PID 4868 wrote to memory of 5088 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 100 PID 4868 wrote to memory of 5088 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 100 PID 4868 wrote to memory of 4144 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 102 PID 4868 wrote to memory of 4144 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 102 PID 4868 wrote to memory of 4144 4868 04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe 102 PID 3836 wrote to memory of 1912 3836 cmd.exe 107 PID 4376 wrote to memory of 2612 4376 cmd.exe 105 PID 3836 wrote to memory of 1912 3836 cmd.exe 107 PID 3836 wrote to memory of 1912 3836 cmd.exe 107 PID 4376 wrote to memory of 2612 4376 cmd.exe 105 PID 4376 wrote to memory of 2612 4376 cmd.exe 105 PID 5116 wrote to memory of 1136 5116 cmd.exe 109 PID 5116 wrote to memory of 1136 5116 cmd.exe 109 PID 5116 wrote to memory of 1136 5116 cmd.exe 109 PID 4144 wrote to memory of 3708 4144 cmd.exe 108 PID 4144 wrote to memory of 3708 4144 cmd.exe 108 PID 4144 wrote to memory of 3708 4144 cmd.exe 108 PID 4904 wrote to memory of 3976 4904 cmd.exe 111 PID 4904 wrote to memory of 3976 4904 cmd.exe 111 PID 4904 wrote to memory of 3976 4904 cmd.exe 111 PID 4832 wrote to memory of 5076 4832 cmd.exe 110 PID 4832 wrote to memory of 5076 4832 cmd.exe 110 PID 4832 wrote to memory of 5076 4832 cmd.exe 110 PID 2108 wrote to memory of 1796 2108 cmd.exe 112 PID 2108 wrote to memory of 1796 2108 cmd.exe 112 PID 2108 wrote to memory of 1796 2108 cmd.exe 112 PID 2580 wrote to memory of 2776 2580 cmd.exe 113 PID 2580 wrote to memory of 2776 2580 cmd.exe 113 PID 2580 wrote to memory of 2776 2580 cmd.exe 113 PID 668 wrote to memory of 4612 668 cmd.exe 116 PID 668 wrote to memory of 4612 668 cmd.exe 116 PID 668 wrote to memory of 4612 668 cmd.exe 116 PID 2076 wrote to memory of 2916 2076 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:1136
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:5076
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7784" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7784" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:3976
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:1796
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:4612
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk227" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵PID:1196
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk227" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:4640
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9134" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵PID:5088
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1816" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1816" /TR "C:\Users\Admin\AppData\Local\Temp\04cdf544df22325874e4dfa80f457dbbcb3381aae9cd9a364b2ab787cfe03d74.exe"3⤵
- Creates scheduled task(s)
PID:3708
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 14362⤵
- Program crash
PID:4796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4868 -ip 48681⤵PID:1800