Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2022, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe
-
Size
950KB
-
MD5
4b2fde109e0d8a7c63ba04d24743c0f9
-
SHA1
2d326c04ec3d25bdf12f4ae2ae40a8131616e64d
-
SHA256
0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd
-
SHA512
df793a316e0bc00841c94f8bd8d35647d4adb3ec809c8e703b83fc5d88fb0c0b2262dd3e35722d472730b3b6f0b8ef29839f2666e76a4cb01b284e8cb2daeff9
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2600 2824 WerFault.exe 77 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3476 schtasks.exe 1908 schtasks.exe 4888 schtasks.exe 4880 schtasks.exe 2292 schtasks.exe 3848 schtasks.exe 2828 schtasks.exe 5020 schtasks.exe 596 schtasks.exe 4836 schtasks.exe 4924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 712 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 79 PID 2824 wrote to memory of 712 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 79 PID 2824 wrote to memory of 712 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 79 PID 2824 wrote to memory of 3668 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 80 PID 2824 wrote to memory of 3668 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 80 PID 2824 wrote to memory of 3668 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 80 PID 2824 wrote to memory of 3672 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 81 PID 2824 wrote to memory of 3672 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 81 PID 2824 wrote to memory of 3672 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 81 PID 2824 wrote to memory of 1192 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 88 PID 2824 wrote to memory of 1192 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 88 PID 2824 wrote to memory of 1192 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 88 PID 2824 wrote to memory of 1504 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 84 PID 2824 wrote to memory of 1504 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 84 PID 2824 wrote to memory of 1504 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 84 PID 2824 wrote to memory of 4720 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 82 PID 2824 wrote to memory of 4720 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 82 PID 2824 wrote to memory of 4720 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 82 PID 2824 wrote to memory of 392 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 89 PID 2824 wrote to memory of 392 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 89 PID 2824 wrote to memory of 392 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 89 PID 2824 wrote to memory of 2224 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 90 PID 2824 wrote to memory of 2224 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 90 PID 2824 wrote to memory of 2224 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 90 PID 2824 wrote to memory of 3452 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 91 PID 2824 wrote to memory of 3452 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 91 PID 2824 wrote to memory of 3452 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 91 PID 2824 wrote to memory of 4460 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 93 PID 2824 wrote to memory of 4460 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 93 PID 2824 wrote to memory of 4460 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 93 PID 2824 wrote to memory of 4592 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 101 PID 2824 wrote to memory of 4592 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 101 PID 2824 wrote to memory of 4592 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 101 PID 2824 wrote to memory of 420 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 98 PID 2824 wrote to memory of 420 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 98 PID 2824 wrote to memory of 420 2824 0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe 98 PID 3672 wrote to memory of 1908 3672 cmd.exe 106 PID 3672 wrote to memory of 1908 3672 cmd.exe 106 PID 3672 wrote to memory of 1908 3672 cmd.exe 106 PID 3668 wrote to memory of 2828 3668 cmd.exe 103 PID 3668 wrote to memory of 2828 3668 cmd.exe 103 PID 3668 wrote to memory of 2828 3668 cmd.exe 103 PID 712 wrote to memory of 3476 712 cmd.exe 105 PID 712 wrote to memory of 3476 712 cmd.exe 105 PID 712 wrote to memory of 3476 712 cmd.exe 105 PID 4720 wrote to memory of 5020 4720 cmd.exe 104 PID 4720 wrote to memory of 5020 4720 cmd.exe 104 PID 4720 wrote to memory of 5020 4720 cmd.exe 104 PID 2224 wrote to memory of 4924 2224 cmd.exe 110 PID 2224 wrote to memory of 4924 2224 cmd.exe 110 PID 2224 wrote to memory of 4924 2224 cmd.exe 110 PID 3452 wrote to memory of 4836 3452 cmd.exe 107 PID 3452 wrote to memory of 4836 3452 cmd.exe 107 PID 3452 wrote to memory of 4836 3452 cmd.exe 107 PID 4460 wrote to memory of 4880 4460 cmd.exe 109 PID 4460 wrote to memory of 4880 4460 cmd.exe 109 PID 4460 wrote to memory of 4880 4460 cmd.exe 109 PID 1192 wrote to memory of 4888 1192 cmd.exe 108 PID 1192 wrote to memory of 4888 1192 cmd.exe 108 PID 1192 wrote to memory of 4888 1192 cmd.exe 108 PID 4592 wrote to memory of 3848 4592 cmd.exe 112 PID 4592 wrote to memory of 3848 4592 cmd.exe 112 PID 4592 wrote to memory of 3848 4592 cmd.exe 112 PID 1504 wrote to memory of 2292 1504 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:3476
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:2828
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:1908
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:5020
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:2292
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:4888
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵PID:392
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:4924
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3673" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3673" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:4836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7640" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7640" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4376" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵PID:420
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4376" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:596
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8350" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8350" /TR "C:\Users\Admin\AppData\Local\Temp\0587f27458a6a7471d9ce89aabc5fd7ec12e73ee8bf8421e83fadff81f63fcbd.exe"3⤵
- Creates scheduled task(s)
PID:3848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 10362⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2824 -ip 28241⤵PID:3020