Analysis
-
max time kernel
79s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 09:32
Static task
static1
Behavioral task
behavioral1
Sample
5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe
-
Size
908KB
-
MD5
34e0a6e6af42da27d89cfe610496c596
-
SHA1
b34e29e6193f9d195548ecc0ebf349ca8837c222
-
SHA256
5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538
-
SHA512
fb9e3b945a17e8af575f2cd51492057dd929094cd70c41f66ecd28b411a775dbf0afc2266b1914658b6f2bd2545984371162743768c8bd95eaf4f10d9722d3e8
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5112 3400 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4488 schtasks.exe 3996 schtasks.exe 1300 schtasks.exe 1448 schtasks.exe 1820 schtasks.exe 1204 schtasks.exe 1944 schtasks.exe 1476 schtasks.exe 1436 schtasks.exe 4484 schtasks.exe 5020 schtasks.exe 4080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3984 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 84 PID 3400 wrote to memory of 3984 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 84 PID 3400 wrote to memory of 3984 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 84 PID 3400 wrote to memory of 4020 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 85 PID 3400 wrote to memory of 4020 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 85 PID 3400 wrote to memory of 4020 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 85 PID 3400 wrote to memory of 232 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 93 PID 3400 wrote to memory of 232 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 93 PID 3400 wrote to memory of 232 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 93 PID 3400 wrote to memory of 228 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 92 PID 3400 wrote to memory of 228 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 92 PID 3400 wrote to memory of 228 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 92 PID 3400 wrote to memory of 856 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 88 PID 3400 wrote to memory of 856 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 88 PID 3400 wrote to memory of 856 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 88 PID 3400 wrote to memory of 3256 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 89 PID 3400 wrote to memory of 3256 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 89 PID 3400 wrote to memory of 3256 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 89 PID 3400 wrote to memory of 4072 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 100 PID 3400 wrote to memory of 4072 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 100 PID 3400 wrote to memory of 4072 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 100 PID 3400 wrote to memory of 1792 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 96 PID 3400 wrote to memory of 1792 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 96 PID 3400 wrote to memory of 1792 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 96 PID 3400 wrote to memory of 4992 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 97 PID 3400 wrote to memory of 4992 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 97 PID 3400 wrote to memory of 4992 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 97 PID 3400 wrote to memory of 332 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 101 PID 3400 wrote to memory of 332 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 101 PID 3400 wrote to memory of 332 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 101 PID 3400 wrote to memory of 2640 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 107 PID 3400 wrote to memory of 2640 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 107 PID 3400 wrote to memory of 2640 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 107 PID 3400 wrote to memory of 4744 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 103 PID 3400 wrote to memory of 4744 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 103 PID 3400 wrote to memory of 4744 3400 5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe 103 PID 4992 wrote to memory of 4080 4992 cmd.exe 119 PID 4992 wrote to memory of 4080 4992 cmd.exe 119 PID 4992 wrote to memory of 4080 4992 cmd.exe 119 PID 4072 wrote to memory of 4484 4072 cmd.exe 115 PID 4072 wrote to memory of 4484 4072 cmd.exe 115 PID 4072 wrote to memory of 4484 4072 cmd.exe 115 PID 2640 wrote to memory of 1476 2640 cmd.exe 111 PID 2640 wrote to memory of 1476 2640 cmd.exe 111 PID 2640 wrote to memory of 1476 2640 cmd.exe 111 PID 3256 wrote to memory of 1944 3256 cmd.exe 116 PID 3256 wrote to memory of 1944 3256 cmd.exe 116 PID 3256 wrote to memory of 1944 3256 cmd.exe 116 PID 332 wrote to memory of 1436 332 cmd.exe 114 PID 332 wrote to memory of 1436 332 cmd.exe 114 PID 332 wrote to memory of 1436 332 cmd.exe 114 PID 228 wrote to memory of 1204 228 cmd.exe 113 PID 228 wrote to memory of 1204 228 cmd.exe 113 PID 228 wrote to memory of 1204 228 cmd.exe 113 PID 4020 wrote to memory of 1448 4020 cmd.exe 110 PID 4020 wrote to memory of 1448 4020 cmd.exe 110 PID 4020 wrote to memory of 1448 4020 cmd.exe 110 PID 232 wrote to memory of 5020 232 cmd.exe 117 PID 232 wrote to memory of 5020 232 cmd.exe 117 PID 232 wrote to memory of 5020 232 cmd.exe 117 PID 856 wrote to memory of 3996 856 cmd.exe 108 PID 856 wrote to memory of 3996 856 cmd.exe 108 PID 856 wrote to memory of 3996 856 cmd.exe 108 PID 4744 wrote to memory of 4488 4744 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵PID:3984
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1300
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1448
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:3996
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1204
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:5020
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵PID:1792
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9816" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9816" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:4080
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:4484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7177" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7177" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1436
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3599" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3599" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2997" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2997" /TR "C:\Users\Admin\AppData\Local\Temp\5331b66b82b3054ded714f498d99511216e4c68d55abaa9c9a0b0fd9c5d6c538.exe"3⤵
- Creates scheduled task(s)
PID:1476
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 10082⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3400 -ip 34001⤵PID:4308