Analysis
-
max time kernel
52s -
max time network
114s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 05:55
Static task
static1
Behavioral task
behavioral1
Sample
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe
Resource
win10-20220901-en
General
-
Target
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe
-
Size
918KB
-
MD5
cb168ac6077d422bde9cfef8fad58d98
-
SHA1
3457f73ae7dcdb790187de96165b22f02e41e9dc
-
SHA256
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621
-
SHA512
d98c62c9f777a8e13f30016cec54dc5aa97bf9ede59625f5738a14a5a09e01d31d5c3b6cbcedbc2f053f40cd26951c4d78d77fb5ad44d620682c54a1f23a5b5d
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4420 520 WerFault.exe 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5084 schtasks.exe 4636 schtasks.exe 5064 schtasks.exe 4988 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exepid process 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exedescription pid process Token: SeDebugPrivilege 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.execmd.execmd.execmd.execmd.exedescription pid process target process PID 520 wrote to memory of 3088 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3088 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3088 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4316 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4316 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4316 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3688 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3688 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3688 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 5032 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 5032 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 5032 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 1996 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 1996 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 1996 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4348 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4348 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4348 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4320 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4320 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4320 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4896 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4896 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4896 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4128 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4128 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4128 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4452 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4452 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 4452 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3004 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3004 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3004 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3944 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3944 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 520 wrote to memory of 3944 520 51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe cmd.exe PID 3088 wrote to memory of 5084 3088 cmd.exe schtasks.exe PID 3088 wrote to memory of 5084 3088 cmd.exe schtasks.exe PID 3088 wrote to memory of 5084 3088 cmd.exe schtasks.exe PID 5032 wrote to memory of 5064 5032 cmd.exe schtasks.exe PID 5032 wrote to memory of 5064 5032 cmd.exe schtasks.exe PID 5032 wrote to memory of 5064 5032 cmd.exe schtasks.exe PID 1996 wrote to memory of 4988 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 4988 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 4988 1996 cmd.exe schtasks.exe PID 3004 wrote to memory of 4636 3004 cmd.exe schtasks.exe PID 3004 wrote to memory of 4636 3004 cmd.exe schtasks.exe PID 3004 wrote to memory of 4636 3004 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1247" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk133" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk133" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3920" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk883" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\51acbec0926c85b817f1ba3005566062f75d6a6ce8b6457fe4f87a5ca8833621.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 13162⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-162-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-149-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-122-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-123-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-124-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-125-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-126-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-127-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-128-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-129-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-130-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-131-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-132-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-133-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-134-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-135-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-136-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-137-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-138-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-139-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-140-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-141-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-142-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-160-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-144-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-145-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-146-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-147-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-148-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-161-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-150-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-151-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-152-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-153-0x0000000000DA0000-0x0000000000E50000-memory.dmpFilesize
704KB
-
memory/520-154-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-155-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-156-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-157-0x0000000005CA0000-0x000000000619E000-memory.dmpFilesize
5.0MB
-
memory/520-158-0x00000000056C0000-0x0000000005752000-memory.dmpFilesize
584KB
-
memory/520-159-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-143-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-121-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-120-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-163-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-164-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-165-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-166-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-167-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-168-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-169-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-170-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-171-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-172-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-173-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/520-174-0x0000000003120000-0x000000000312A000-memory.dmpFilesize
40KB
-
memory/1996-184-0x0000000000000000-mapping.dmp
-
memory/3004-215-0x0000000000000000-mapping.dmp
-
memory/3088-190-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3088-175-0x0000000000000000-mapping.dmp
-
memory/3088-182-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3088-185-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3088-177-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3688-186-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3688-178-0x0000000000000000-mapping.dmp
-
memory/3688-181-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3688-191-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/3944-221-0x0000000000000000-mapping.dmp
-
memory/4128-205-0x0000000000000000-mapping.dmp
-
memory/4316-176-0x0000000000000000-mapping.dmp
-
memory/4316-188-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/4316-183-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/4316-179-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/4316-192-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/4320-195-0x0000000000000000-mapping.dmp
-
memory/4348-189-0x0000000000000000-mapping.dmp
-
memory/4452-210-0x0000000000000000-mapping.dmp
-
memory/4636-271-0x0000000000000000-mapping.dmp
-
memory/4896-200-0x0000000000000000-mapping.dmp
-
memory/4988-247-0x0000000000000000-mapping.dmp
-
memory/5032-187-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/5032-193-0x0000000077D60000-0x0000000077EEE000-memory.dmpFilesize
1.6MB
-
memory/5032-180-0x0000000000000000-mapping.dmp
-
memory/5064-246-0x0000000000000000-mapping.dmp
-
memory/5084-245-0x0000000000000000-mapping.dmp