Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe
-
Size
946KB
-
MD5
2043c85f13d5c50d2d3bc59ab0e07fce
-
SHA1
ac572a87b8a4795e6ea2410e109d679f3a2cb6bb
-
SHA256
0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3
-
SHA512
9af788e61aed325abffc846e54e151191dac906f3ff4f602bf8ed1219d1576df7b24fcb6bf9bad8f7a84d6a80a93af9724a0c27b296a06f7626b478fdf57be04
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4800 5052 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4052 schtasks.exe 724 schtasks.exe 2804 schtasks.exe 3728 schtasks.exe 4476 schtasks.exe 4128 schtasks.exe 1956 schtasks.exe 2564 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4416 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 86 PID 5052 wrote to memory of 4416 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 86 PID 5052 wrote to memory of 4416 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 86 PID 5052 wrote to memory of 1412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 87 PID 5052 wrote to memory of 1412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 87 PID 5052 wrote to memory of 1412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 87 PID 5052 wrote to memory of 4448 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 91 PID 5052 wrote to memory of 4448 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 91 PID 5052 wrote to memory of 4448 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 91 PID 5052 wrote to memory of 1132 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 89 PID 5052 wrote to memory of 1132 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 89 PID 5052 wrote to memory of 1132 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 89 PID 5052 wrote to memory of 3964 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 92 PID 5052 wrote to memory of 3964 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 92 PID 5052 wrote to memory of 3964 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 92 PID 5052 wrote to memory of 752 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 94 PID 5052 wrote to memory of 752 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 94 PID 5052 wrote to memory of 752 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 94 PID 5052 wrote to memory of 1728 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 95 PID 5052 wrote to memory of 1728 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 95 PID 5052 wrote to memory of 1728 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 95 PID 5052 wrote to memory of 1432 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 96 PID 5052 wrote to memory of 1432 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 96 PID 5052 wrote to memory of 1432 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 96 PID 5052 wrote to memory of 4912 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 97 PID 5052 wrote to memory of 4912 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 97 PID 5052 wrote to memory of 4912 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 97 PID 5052 wrote to memory of 4228 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 98 PID 5052 wrote to memory of 4228 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 98 PID 5052 wrote to memory of 4228 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 98 PID 5052 wrote to memory of 4412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 99 PID 5052 wrote to memory of 4412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 99 PID 5052 wrote to memory of 4412 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 99 PID 5052 wrote to memory of 1836 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 100 PID 5052 wrote to memory of 1836 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 100 PID 5052 wrote to memory of 1836 5052 0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe 100 PID 4416 wrote to memory of 4128 4416 cmd.exe 111 PID 1412 wrote to memory of 4476 1412 cmd.exe 110 PID 4416 wrote to memory of 4128 4416 cmd.exe 111 PID 4416 wrote to memory of 4128 4416 cmd.exe 111 PID 1412 wrote to memory of 4476 1412 cmd.exe 110 PID 1412 wrote to memory of 4476 1412 cmd.exe 110 PID 1132 wrote to memory of 1956 1132 cmd.exe 112 PID 1132 wrote to memory of 1956 1132 cmd.exe 112 PID 1132 wrote to memory of 1956 1132 cmd.exe 112 PID 752 wrote to memory of 2564 752 cmd.exe 113 PID 752 wrote to memory of 2564 752 cmd.exe 113 PID 752 wrote to memory of 2564 752 cmd.exe 113 PID 1432 wrote to memory of 724 1432 cmd.exe 115 PID 1432 wrote to memory of 724 1432 cmd.exe 115 PID 1432 wrote to memory of 724 1432 cmd.exe 115 PID 4412 wrote to memory of 4052 4412 cmd.exe 114 PID 4412 wrote to memory of 4052 4412 cmd.exe 114 PID 4412 wrote to memory of 4052 4412 cmd.exe 114 PID 1836 wrote to memory of 2804 1836 cmd.exe 116 PID 1836 wrote to memory of 2804 1836 cmd.exe 116 PID 1836 wrote to memory of 2804 1836 cmd.exe 116 PID 1728 wrote to memory of 3728 1728 cmd.exe 117 PID 1728 wrote to memory of 3728 1728 cmd.exe 117 PID 1728 wrote to memory of 3728 1728 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:4128
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:4476
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵PID:4448
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵PID:3964
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:3728
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:724
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7514" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵PID:4912
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3951" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵PID:4228
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9803" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9803" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:4052
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5337" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5337" /TR "C:\Users\Admin\AppData\Local\Temp\0690c067414f03967c6fd912616b1c7537a722c58355f969590586e13910ccd3.exe"3⤵
- Creates scheduled task(s)
PID:2804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 14522⤵
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5052 -ip 50521⤵PID:4416