Analysis
-
max time kernel
112s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2022, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe
-
Size
953KB
-
MD5
adf5636ef8ea217dae6e0bc991b89dc7
-
SHA1
9d5650bfa3f470453d28157e11a447cb083ac61e
-
SHA256
73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29
-
SHA512
ad18f826d97f14b986e3a9e6b30552e81e6b5d5b0b3ab4e2422b94e3f18fffeed7480adb71ec54a7fa2fb3e13d51b4813bc2eb6dea1871c7c9fe0113ae595905
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4136 640 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 440 schtasks.exe 2776 schtasks.exe 3780 schtasks.exe 4728 schtasks.exe 3032 schtasks.exe 2940 schtasks.exe 764 schtasks.exe 1960 schtasks.exe 2376 schtasks.exe 1492 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 3604 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 82 PID 640 wrote to memory of 3604 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 82 PID 640 wrote to memory of 3604 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 82 PID 640 wrote to memory of 1280 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 83 PID 640 wrote to memory of 1280 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 83 PID 640 wrote to memory of 1280 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 83 PID 640 wrote to memory of 3364 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 87 PID 640 wrote to memory of 3364 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 87 PID 640 wrote to memory of 3364 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 87 PID 640 wrote to memory of 4716 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 85 PID 640 wrote to memory of 4716 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 85 PID 640 wrote to memory of 4716 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 85 PID 640 wrote to memory of 2636 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 88 PID 640 wrote to memory of 2636 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 88 PID 640 wrote to memory of 2636 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 88 PID 640 wrote to memory of 1644 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 91 PID 640 wrote to memory of 1644 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 91 PID 640 wrote to memory of 1644 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 91 PID 640 wrote to memory of 3392 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 92 PID 640 wrote to memory of 3392 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 92 PID 640 wrote to memory of 3392 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 92 PID 640 wrote to memory of 1292 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 93 PID 640 wrote to memory of 1292 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 93 PID 640 wrote to memory of 1292 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 93 PID 640 wrote to memory of 4444 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 101 PID 640 wrote to memory of 4444 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 101 PID 640 wrote to memory of 4444 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 101 PID 640 wrote to memory of 852 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 95 PID 640 wrote to memory of 852 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 95 PID 640 wrote to memory of 852 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 95 PID 640 wrote to memory of 2036 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 97 PID 640 wrote to memory of 2036 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 97 PID 640 wrote to memory of 2036 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 97 PID 640 wrote to memory of 556 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 99 PID 640 wrote to memory of 556 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 99 PID 640 wrote to memory of 556 640 73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe 99 PID 3604 wrote to memory of 440 3604 cmd.exe 105 PID 3604 wrote to memory of 440 3604 cmd.exe 105 PID 3604 wrote to memory of 440 3604 cmd.exe 105 PID 1280 wrote to memory of 2940 1280 cmd.exe 109 PID 1280 wrote to memory of 2940 1280 cmd.exe 109 PID 1280 wrote to memory of 2940 1280 cmd.exe 109 PID 4444 wrote to memory of 2776 4444 cmd.exe 107 PID 4444 wrote to memory of 2776 4444 cmd.exe 107 PID 4444 wrote to memory of 2776 4444 cmd.exe 107 PID 3364 wrote to memory of 3780 3364 cmd.exe 108 PID 3364 wrote to memory of 3780 3364 cmd.exe 108 PID 3364 wrote to memory of 3780 3364 cmd.exe 108 PID 2036 wrote to memory of 1492 2036 cmd.exe 114 PID 2036 wrote to memory of 1492 2036 cmd.exe 114 PID 2036 wrote to memory of 1492 2036 cmd.exe 114 PID 3392 wrote to memory of 764 3392 cmd.exe 110 PID 3392 wrote to memory of 764 3392 cmd.exe 110 PID 3392 wrote to memory of 764 3392 cmd.exe 110 PID 1644 wrote to memory of 1960 1644 cmd.exe 111 PID 1644 wrote to memory of 1960 1644 cmd.exe 111 PID 1644 wrote to memory of 1960 1644 cmd.exe 111 PID 1292 wrote to memory of 2376 1292 cmd.exe 112 PID 1292 wrote to memory of 2376 1292 cmd.exe 112 PID 1292 wrote to memory of 2376 1292 cmd.exe 112 PID 2636 wrote to memory of 4728 2636 cmd.exe 113 PID 2636 wrote to memory of 4728 2636 cmd.exe 113 PID 2636 wrote to memory of 4728 2636 cmd.exe 113 PID 852 wrote to memory of 3032 852 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:440
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:2940
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵PID:4716
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:3780
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:4728
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:1960
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:764
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5056" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5056" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:3032
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3449" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk3449" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4699" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8671" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8671" /TR "C:\Users\Admin\AppData\Local\Temp\73b8a7ca0dbab3f51d513df8f96544fb94833efd0d1f5cfb7ba3796d11e79d29.exe"3⤵
- Creates scheduled task(s)
PID:2776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 11402⤵
- Program crash
PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 640 -ip 6401⤵PID:2228