Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 05:37
Static task
static1
Behavioral task
behavioral1
Sample
cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe
-
Size
947KB
-
MD5
35e44b0173e79f118f3e6c8d52d9f0d0
-
SHA1
b1fc29a8db71223e758150988d967110dc9c3d28
-
SHA256
cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf
-
SHA512
58b70cde853b9d1859a65b3016fda96e014c645bc5a39952f639cea238243f5e99bdf5a224d09ea413c7f5167356afe28d696e2c6674435b0367dcfad3f299d1
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1408 3168 WerFault.exe 79 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3572 schtasks.exe 4660 schtasks.exe 3108 schtasks.exe 3112 schtasks.exe 4956 schtasks.exe 1360 schtasks.exe 2052 schtasks.exe 3156 schtasks.exe 3884 schtasks.exe 1248 schtasks.exe 2344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 5056 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 82 PID 3168 wrote to memory of 5056 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 82 PID 3168 wrote to memory of 5056 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 82 PID 3168 wrote to memory of 4944 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 83 PID 3168 wrote to memory of 4944 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 83 PID 3168 wrote to memory of 4944 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 83 PID 3168 wrote to memory of 2968 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 84 PID 3168 wrote to memory of 2968 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 84 PID 3168 wrote to memory of 2968 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 84 PID 3168 wrote to memory of 636 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 85 PID 3168 wrote to memory of 636 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 85 PID 3168 wrote to memory of 636 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 85 PID 3168 wrote to memory of 4460 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 86 PID 3168 wrote to memory of 4460 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 86 PID 3168 wrote to memory of 4460 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 86 PID 3168 wrote to memory of 4752 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 87 PID 3168 wrote to memory of 4752 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 87 PID 3168 wrote to memory of 4752 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 87 PID 3168 wrote to memory of 3528 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 88 PID 3168 wrote to memory of 3528 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 88 PID 3168 wrote to memory of 3528 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 88 PID 3168 wrote to memory of 1200 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 89 PID 3168 wrote to memory of 1200 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 89 PID 3168 wrote to memory of 1200 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 89 PID 3168 wrote to memory of 1712 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 90 PID 3168 wrote to memory of 1712 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 90 PID 3168 wrote to memory of 1712 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 90 PID 3168 wrote to memory of 1688 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 91 PID 3168 wrote to memory of 1688 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 91 PID 3168 wrote to memory of 1688 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 91 PID 3168 wrote to memory of 1596 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 92 PID 3168 wrote to memory of 1596 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 92 PID 3168 wrote to memory of 1596 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 92 PID 3168 wrote to memory of 2296 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 93 PID 3168 wrote to memory of 2296 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 93 PID 3168 wrote to memory of 2296 3168 cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe 93 PID 4460 wrote to memory of 2344 4460 cmd.exe 116 PID 4460 wrote to memory of 2344 4460 cmd.exe 116 PID 4460 wrote to memory of 2344 4460 cmd.exe 116 PID 4944 wrote to memory of 1248 4944 cmd.exe 115 PID 4944 wrote to memory of 1248 4944 cmd.exe 115 PID 4944 wrote to memory of 1248 4944 cmd.exe 115 PID 1596 wrote to memory of 1360 1596 cmd.exe 114 PID 1596 wrote to memory of 1360 1596 cmd.exe 114 PID 1596 wrote to memory of 1360 1596 cmd.exe 114 PID 1200 wrote to memory of 3112 1200 cmd.exe 112 PID 1200 wrote to memory of 3112 1200 cmd.exe 112 PID 1200 wrote to memory of 3112 1200 cmd.exe 112 PID 4752 wrote to memory of 4956 4752 cmd.exe 113 PID 4752 wrote to memory of 4956 4752 cmd.exe 113 PID 4752 wrote to memory of 4956 4752 cmd.exe 113 PID 5056 wrote to memory of 3572 5056 cmd.exe 107 PID 5056 wrote to memory of 3572 5056 cmd.exe 107 PID 5056 wrote to memory of 3572 5056 cmd.exe 107 PID 2296 wrote to memory of 2052 2296 cmd.exe 106 PID 2296 wrote to memory of 2052 2296 cmd.exe 106 PID 2296 wrote to memory of 2052 2296 cmd.exe 106 PID 636 wrote to memory of 3156 636 cmd.exe 108 PID 636 wrote to memory of 3156 636 cmd.exe 108 PID 636 wrote to memory of 3156 636 cmd.exe 108 PID 1688 wrote to memory of 4660 1688 cmd.exe 109 PID 1688 wrote to memory of 4660 1688 cmd.exe 109 PID 1688 wrote to memory of 4660 1688 cmd.exe 109 PID 1712 wrote to memory of 3884 1712 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:3572
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:1248
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵PID:2968
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:3108
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:3156
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:2344
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:4956
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵PID:3528
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:3112
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2296" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2296" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:3884
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2414" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2414" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:4660
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3974" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3974" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6981" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6981" /TR "C:\Users\Admin\AppData\Local\Temp\cabbbb90fcdac97f8fcfc676b39f84494f8c5c4c5123dc18ec1027d419da22bf.exe"3⤵
- Creates scheduled task(s)
PID:2052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 10962⤵
- Program crash
PID:1408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3168 -ip 31681⤵PID:1708