Analysis
-
max time kernel
52s -
max time network
113s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
27/09/2022, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe
Resource
win10-20220812-en
6 signatures
150 seconds
General
-
Target
cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe
-
Size
931KB
-
MD5
a22d477ad6e6a40ca99ec8c1bb2d93e4
-
SHA1
7e4eed7dbf4d848a1704247d4d895b96db7a3ce2
-
SHA256
cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975
-
SHA512
0e558d8b95230f375362fb3d5d87918d3a7dd46f321e6b27f3a56635b617524c7ed54e2a20cda41f617ab42da7be207e6a916c31e19b2ef79183c2789a68da0f
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 400 2660 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3964 schtasks.exe 3928 schtasks.exe 4536 schtasks.exe 3868 schtasks.exe 2280 schtasks.exe 4816 schtasks.exe 4776 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3300 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 66 PID 2660 wrote to memory of 3300 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 66 PID 2660 wrote to memory of 3300 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 66 PID 2660 wrote to memory of 4736 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 67 PID 2660 wrote to memory of 4736 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 67 PID 2660 wrote to memory of 4736 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 67 PID 2660 wrote to memory of 2104 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 68 PID 2660 wrote to memory of 2104 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 68 PID 2660 wrote to memory of 2104 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 68 PID 2660 wrote to memory of 4748 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 69 PID 2660 wrote to memory of 4748 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 69 PID 2660 wrote to memory of 4748 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 69 PID 2660 wrote to memory of 4792 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 70 PID 2660 wrote to memory of 4792 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 70 PID 2660 wrote to memory of 4792 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 70 PID 2660 wrote to memory of 4804 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 71 PID 2660 wrote to memory of 4804 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 71 PID 2660 wrote to memory of 4804 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 71 PID 2660 wrote to memory of 5100 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 72 PID 2660 wrote to memory of 5100 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 72 PID 2660 wrote to memory of 5100 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 72 PID 2660 wrote to memory of 4340 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 73 PID 2660 wrote to memory of 4340 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 73 PID 2660 wrote to memory of 4340 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 73 PID 2660 wrote to memory of 3404 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 76 PID 2660 wrote to memory of 3404 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 76 PID 2660 wrote to memory of 3404 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 76 PID 2660 wrote to memory of 2972 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 84 PID 2660 wrote to memory of 2972 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 84 PID 2660 wrote to memory of 2972 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 84 PID 2660 wrote to memory of 4276 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 81 PID 2660 wrote to memory of 4276 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 81 PID 2660 wrote to memory of 4276 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 81 PID 2660 wrote to memory of 1520 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 83 PID 2660 wrote to memory of 1520 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 83 PID 2660 wrote to memory of 1520 2660 cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe 83 PID 4792 wrote to memory of 4816 4792 cmd.exe 96 PID 4792 wrote to memory of 4816 4792 cmd.exe 96 PID 4792 wrote to memory of 4816 4792 cmd.exe 96 PID 4736 wrote to memory of 4776 4736 cmd.exe 90 PID 4736 wrote to memory of 4776 4736 cmd.exe 90 PID 4736 wrote to memory of 4776 4736 cmd.exe 90 PID 4804 wrote to memory of 2280 4804 cmd.exe 95 PID 4804 wrote to memory of 2280 4804 cmd.exe 95 PID 4804 wrote to memory of 2280 4804 cmd.exe 95 PID 4748 wrote to memory of 3964 4748 cmd.exe 91 PID 4748 wrote to memory of 3964 4748 cmd.exe 91 PID 4748 wrote to memory of 3964 4748 cmd.exe 91 PID 2104 wrote to memory of 3928 2104 cmd.exe 92 PID 2104 wrote to memory of 3928 2104 cmd.exe 92 PID 2104 wrote to memory of 3928 2104 cmd.exe 92 PID 4340 wrote to memory of 4536 4340 cmd.exe 93 PID 4340 wrote to memory of 4536 4340 cmd.exe 93 PID 4340 wrote to memory of 4536 4340 cmd.exe 93 PID 3404 wrote to memory of 3868 3404 cmd.exe 94 PID 3404 wrote to memory of 3868 3404 cmd.exe 94 PID 3404 wrote to memory of 3868 3404 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵PID:3300
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:4776
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:3928
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:3964
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:4816
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵PID:5100
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:4536
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4895" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4895" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"3⤵
- Creates scheduled task(s)
PID:3868
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4495" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵PID:4276
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2002" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵PID:1520
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5053" /TR "C:\Users\Admin\AppData\Local\Temp\cd2aa8df8a69ff11a302bbcec9d2fa98be0f292d9f87bf297ddd629b5c118975.exe"2⤵PID:2972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 13602⤵
- Program crash
PID:400
-