Analysis
-
max time kernel
91s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 18:46
Static task
static1
Behavioral task
behavioral1
Sample
aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe
-
Size
954KB
-
MD5
a9b05e664c547d398bc367f37cac1766
-
SHA1
e217441036970720411758360dd8c5621fb3c91e
-
SHA256
aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921
-
SHA512
9d2bbc64fc624fc967405efecb764728f70c94c089e925f145458cf9d068e5c394a2df26468c410cb5ca9886eadcd0d5d92cb675eca5240ea9743bfea3b5e300
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4024 2268 WerFault.exe 78 -
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4964 schtasks.exe 2028 schtasks.exe 3912 schtasks.exe 2792 schtasks.exe 3800 schtasks.exe 3720 schtasks.exe 3452 schtasks.exe 4200 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2268 wrote to memory of 608 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 79 PID 2268 wrote to memory of 608 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 79 PID 2268 wrote to memory of 608 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 79 PID 2268 wrote to memory of 1920 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 80 PID 2268 wrote to memory of 1920 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 80 PID 2268 wrote to memory of 1920 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 80 PID 2268 wrote to memory of 452 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 81 PID 2268 wrote to memory of 452 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 81 PID 2268 wrote to memory of 452 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 81 PID 2268 wrote to memory of 2304 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 88 PID 2268 wrote to memory of 2304 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 88 PID 2268 wrote to memory of 2304 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 88 PID 2268 wrote to memory of 224 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 85 PID 2268 wrote to memory of 224 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 85 PID 2268 wrote to memory of 224 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 85 PID 2268 wrote to memory of 3636 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 86 PID 2268 wrote to memory of 3636 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 86 PID 2268 wrote to memory of 3636 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 86 PID 2268 wrote to memory of 4672 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 91 PID 2268 wrote to memory of 4672 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 91 PID 2268 wrote to memory of 4672 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 91 PID 2268 wrote to memory of 4000 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 92 PID 2268 wrote to memory of 4000 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 92 PID 2268 wrote to memory of 4000 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 92 PID 2268 wrote to memory of 616 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 93 PID 2268 wrote to memory of 616 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 93 PID 2268 wrote to memory of 616 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 93 PID 2268 wrote to memory of 4716 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 94 PID 2268 wrote to memory of 4716 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 94 PID 2268 wrote to memory of 4716 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 94 PID 2268 wrote to memory of 1948 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 101 PID 2268 wrote to memory of 1948 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 101 PID 2268 wrote to memory of 1948 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 101 PID 1920 wrote to memory of 3912 1920 cmd.exe 100 PID 1920 wrote to memory of 3912 1920 cmd.exe 100 PID 1920 wrote to memory of 3912 1920 cmd.exe 100 PID 2268 wrote to memory of 4212 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 97 PID 2268 wrote to memory of 4212 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 97 PID 2268 wrote to memory of 4212 2268 aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe 97 PID 4716 wrote to memory of 3800 4716 cmd.exe 105 PID 4716 wrote to memory of 3800 4716 cmd.exe 105 PID 4716 wrote to memory of 3800 4716 cmd.exe 105 PID 616 wrote to memory of 2792 616 cmd.exe 104 PID 616 wrote to memory of 2792 616 cmd.exe 104 PID 616 wrote to memory of 2792 616 cmd.exe 104 PID 608 wrote to memory of 3452 608 cmd.exe 107 PID 608 wrote to memory of 3452 608 cmd.exe 107 PID 608 wrote to memory of 3452 608 cmd.exe 107 PID 2304 wrote to memory of 3720 2304 cmd.exe 106 PID 2304 wrote to memory of 3720 2304 cmd.exe 106 PID 2304 wrote to memory of 3720 2304 cmd.exe 106 PID 452 wrote to memory of 4200 452 cmd.exe 108 PID 452 wrote to memory of 4200 452 cmd.exe 108 PID 452 wrote to memory of 4200 452 cmd.exe 108 PID 224 wrote to memory of 4964 224 cmd.exe 109 PID 224 wrote to memory of 4964 224 cmd.exe 109 PID 224 wrote to memory of 4964 224 cmd.exe 109 PID 3636 wrote to memory of 2028 3636 cmd.exe 110 PID 3636 wrote to memory of 2028 3636 cmd.exe 110 PID 3636 wrote to memory of 2028 3636 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:3452
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:3912
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:4200
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:4964
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:2028
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:3720
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵PID:4672
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵PID:4000
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2081" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2081" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5171" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5171" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"3⤵
- Creates scheduled task(s)
PID:3800
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk914" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵PID:4212
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6453" /TR "C:\Users\Admin\AppData\Local\Temp\aa00b8d0b702f780df7ca5a90a3ae1eefc27a8fd8b7bafbb1a37d825333a0921.exe"2⤵PID:1948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 13642⤵
- Program crash
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2268 -ip 22681⤵PID:4492