Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
77s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe
-
Size
908KB
-
MD5
bb3a9ca029f6b1e6f1a15bac18d476ce
-
SHA1
1861f7c798cffdd5609a72b54d4d1be2fe323c57
-
SHA256
4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037
-
SHA512
de89d9cd9202bcafcb2a676f67fc27ec15e0acaa3f488125ee47fe51cef4d7bc7a5fd61dcf06d2ec5d1505f62a436b2f6e0f075fa071517cb174e567ec22ece0
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4748 3628 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1196 schtasks.exe 544 schtasks.exe 4152 schtasks.exe 2040 schtasks.exe 960 schtasks.exe 1012 schtasks.exe 892 schtasks.exe 1944 schtasks.exe 3784 schtasks.exe 3788 schtasks.exe 4604 schtasks.exe 492 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1164 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 85 PID 3628 wrote to memory of 1164 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 85 PID 3628 wrote to memory of 1164 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 85 PID 3628 wrote to memory of 4860 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 86 PID 3628 wrote to memory of 4860 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 86 PID 3628 wrote to memory of 4860 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 86 PID 3628 wrote to memory of 4200 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 87 PID 3628 wrote to memory of 4200 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 87 PID 3628 wrote to memory of 4200 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 87 PID 3628 wrote to memory of 1444 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 100 PID 3628 wrote to memory of 1444 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 100 PID 3628 wrote to memory of 1444 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 100 PID 3628 wrote to memory of 3372 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 92 PID 3628 wrote to memory of 3372 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 92 PID 3628 wrote to memory of 3372 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 92 PID 3628 wrote to memory of 1940 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 90 PID 3628 wrote to memory of 1940 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 90 PID 3628 wrote to memory of 1940 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 90 PID 3628 wrote to memory of 3808 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 96 PID 3628 wrote to memory of 3808 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 96 PID 3628 wrote to memory of 3808 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 96 PID 3628 wrote to memory of 2364 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 97 PID 3628 wrote to memory of 2364 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 97 PID 3628 wrote to memory of 2364 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 97 PID 3628 wrote to memory of 4720 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 98 PID 3628 wrote to memory of 4720 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 98 PID 3628 wrote to memory of 4720 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 98 PID 3628 wrote to memory of 2564 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 101 PID 3628 wrote to memory of 2564 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 101 PID 3628 wrote to memory of 2564 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 101 PID 3628 wrote to memory of 4380 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 102 PID 3628 wrote to memory of 4380 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 102 PID 3628 wrote to memory of 4380 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 102 PID 3628 wrote to memory of 3744 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 103 PID 3628 wrote to memory of 3744 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 103 PID 3628 wrote to memory of 3744 3628 4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe 103 PID 4380 wrote to memory of 2040 4380 cmd.exe 119 PID 4380 wrote to memory of 2040 4380 cmd.exe 119 PID 4380 wrote to memory of 2040 4380 cmd.exe 119 PID 1444 wrote to memory of 960 1444 cmd.exe 120 PID 1444 wrote to memory of 960 1444 cmd.exe 120 PID 1444 wrote to memory of 960 1444 cmd.exe 120 PID 4720 wrote to memory of 492 4720 cmd.exe 118 PID 4720 wrote to memory of 492 4720 cmd.exe 118 PID 4720 wrote to memory of 492 4720 cmd.exe 118 PID 2564 wrote to memory of 4152 2564 cmd.exe 117 PID 2564 wrote to memory of 4152 2564 cmd.exe 117 PID 2564 wrote to memory of 4152 2564 cmd.exe 117 PID 3808 wrote to memory of 544 3808 cmd.exe 116 PID 3808 wrote to memory of 544 3808 cmd.exe 116 PID 3808 wrote to memory of 544 3808 cmd.exe 116 PID 4200 wrote to memory of 4604 4200 cmd.exe 115 PID 4200 wrote to memory of 4604 4200 cmd.exe 115 PID 4200 wrote to memory of 4604 4200 cmd.exe 115 PID 1164 wrote to memory of 3788 1164 cmd.exe 114 PID 1164 wrote to memory of 3788 1164 cmd.exe 114 PID 1164 wrote to memory of 3788 1164 cmd.exe 114 PID 3744 wrote to memory of 3784 3744 cmd.exe 113 PID 3744 wrote to memory of 3784 3744 cmd.exe 113 PID 3744 wrote to memory of 3784 3744 cmd.exe 113 PID 4860 wrote to memory of 1944 4860 cmd.exe 112 PID 4860 wrote to memory of 1944 4860 cmd.exe 112 PID 4860 wrote to memory of 1944 4860 cmd.exe 112 PID 2364 wrote to memory of 892 2364 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:3788
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵PID:1940
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵PID:3372
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:1012
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:544
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:892
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2258" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2258" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:492
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:960
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9243" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9243" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:4152
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9471" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9471" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8997" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8997" /TR "C:\Users\Admin\AppData\Local\Temp\4ecd1c37e69975a45c8373e780a41e0678c7179d2c3cf474be7c7a79a2323037.exe"3⤵
- Creates scheduled task(s)
PID:3784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 13682⤵
- Program crash
PID:4748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3628 -ip 36281⤵PID:3024