9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2022, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Size

955KB
MD5

4e395b6d9f1e1f6e58085f5a7c429c2d
SHA1

a406c06a90b55dc73232627314f9cba014a6e83e
SHA256

9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42
SHA512

8f501d3455ff488c67b62eedcdfebb79444faa81d1c90d5be660d377ccf4b66e68b012978885578947d858384d58fe89ed7082af2366f47f2c609e97da64afc9
SSDEEP

768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4948	2116	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1596	schtasks.exe
3060	schtasks.exe
4476	schtasks.exe
4652	schtasks.exe
2308	schtasks.exe
2884	schtasks.exe
2336	schtasks.exe
3112	schtasks.exe
2816	schtasks.exe
1852	schtasks.exe
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4768	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	85
PID 2116 wrote to memory of 4768	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	85
PID 2116 wrote to memory of 4768	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	85
PID 2116 wrote to memory of 3732	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	86
PID 2116 wrote to memory of 3732	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	86
PID 2116 wrote to memory of 3732	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	86
PID 2116 wrote to memory of 3796	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	98
PID 2116 wrote to memory of 3796	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	98
PID 2116 wrote to memory of 3796	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	98
PID 2116 wrote to memory of 2084	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	96
PID 2116 wrote to memory of 2084	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	96
PID 2116 wrote to memory of 2084	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	96
PID 2116 wrote to memory of 3996	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	89
PID 2116 wrote to memory of 3996	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	89
PID 2116 wrote to memory of 3996	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	89
PID 2116 wrote to memory of 3828	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	95
PID 2116 wrote to memory of 3828	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	95
PID 2116 wrote to memory of 3828	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	95
PID 2116 wrote to memory of 3240	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	91
PID 2116 wrote to memory of 3240	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	91
PID 2116 wrote to memory of 3240	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	91
PID 2116 wrote to memory of 3548	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	93
PID 2116 wrote to memory of 3548	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	93
PID 2116 wrote to memory of 3548	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	93
PID 2116 wrote to memory of 2228	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	108
PID 2116 wrote to memory of 2228	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	108
PID 2116 wrote to memory of 2228	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	108
PID 2116 wrote to memory of 4812	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	106
PID 2116 wrote to memory of 4812	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	106
PID 2116 wrote to memory of 4812	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	106
PID 2116 wrote to memory of 3572	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	101
PID 2116 wrote to memory of 3572	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	101
PID 2116 wrote to memory of 3572	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	101
PID 2116 wrote to memory of 4356	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	102
PID 2116 wrote to memory of 4356	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	102
PID 2116 wrote to memory of 4356	2116	9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe	102
PID 2228 wrote to memory of 2884	2228	cmd.exe	113
PID 2228 wrote to memory of 2884	2228	cmd.exe	113
PID 2228 wrote to memory of 2884	2228	cmd.exe	113
PID 3796 wrote to memory of 1852	3796	cmd.exe	109
PID 3796 wrote to memory of 1852	3796	cmd.exe	109
PID 3796 wrote to memory of 1852	3796	cmd.exe	109
PID 4768 wrote to memory of 2308	4768	cmd.exe	112
PID 4768 wrote to memory of 2308	4768	cmd.exe	112
PID 4768 wrote to memory of 2308	4768	cmd.exe	112
PID 2084 wrote to memory of 4344	2084	cmd.exe	110
PID 2084 wrote to memory of 4344	2084	cmd.exe	110
PID 2084 wrote to memory of 4344	2084	cmd.exe	110
PID 3996 wrote to memory of 4652	3996	cmd.exe	111
PID 3996 wrote to memory of 4652	3996	cmd.exe	111
PID 3996 wrote to memory of 4652	3996	cmd.exe	111
PID 3828 wrote to memory of 1596	3828	cmd.exe	115
PID 3828 wrote to memory of 1596	3828	cmd.exe	115
PID 3828 wrote to memory of 1596	3828	cmd.exe	115
PID 3240 wrote to memory of 2336	3240	cmd.exe	114
PID 3240 wrote to memory of 2336	3240	cmd.exe	114
PID 3240 wrote to memory of 2336	3240	cmd.exe	114
PID 3548 wrote to memory of 3112	3548	cmd.exe	117
PID 3548 wrote to memory of 3112	3548	cmd.exe	117
PID 3548 wrote to memory of 3112	3548	cmd.exe	117
PID 3732 wrote to memory of 3060	3732	cmd.exe	116
PID 3732 wrote to memory of 3060	3732	cmd.exe	116
PID 3732 wrote to memory of 3060	3732	cmd.exe	116
PID 4812 wrote to memory of 2816	4812	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe
"C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk9771" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9451" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9451" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6393" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6393" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1756" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1756" /TR "C:\Users\Admin\AppData\Local\Temp\9ff9dbaf567db4658c58c1619f08f2d3830e47fb8b0b9f651b514b5183721f42.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1036
  2⤵
  - Program crash
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2116 -ip 2116
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-132-0x0000000000C80000-0x0000000000D30000-memory.dmp

Filesize
704KB

Download
memory/2116-135-0x0000000005780000-0x000000000578A000-memory.dmp

Filesize
40KB

Download
memory/2116-134-0x00000000056C0000-0x0000000005752000-memory.dmp

Filesize
584KB

Download
memory/2116-133-0x0000000005D20000-0x00000000062C4000-memory.dmp

Filesize
5.6MB

Download