Analysis
-
max time kernel
49s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe
-
Size
963KB
-
MD5
30e6ab7a3d6e52e9036d14ed2eeac294
-
SHA1
54c1be5f673a42eeb6afbbbf71b89fada1ae2741
-
SHA256
2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f
-
SHA512
848413c86982617ca28d29687c376cb6609791f8b0dd379ca664005fea20aa647657e7675bd3ebd90b7b39b7d1ed701898005e00ad6f8cd872df3ff73f759795
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2964 4536 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2876 schtasks.exe 3120 schtasks.exe 5056 schtasks.exe 5112 schtasks.exe 4984 schtasks.exe 4792 schtasks.exe 928 schtasks.exe 3628 schtasks.exe 1868 schtasks.exe 3424 schtasks.exe 4048 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4536 wrote to memory of 4872 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 83 PID 4536 wrote to memory of 4872 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 83 PID 4536 wrote to memory of 4872 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 83 PID 4536 wrote to memory of 4748 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 84 PID 4536 wrote to memory of 4748 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 84 PID 4536 wrote to memory of 4748 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 84 PID 4536 wrote to memory of 4188 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 85 PID 4536 wrote to memory of 4188 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 85 PID 4536 wrote to memory of 4188 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 85 PID 4536 wrote to memory of 620 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 87 PID 4536 wrote to memory of 620 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 87 PID 4536 wrote to memory of 620 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 87 PID 4536 wrote to memory of 744 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 98 PID 4536 wrote to memory of 744 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 98 PID 4536 wrote to memory of 744 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 98 PID 4536 wrote to memory of 5116 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 88 PID 4536 wrote to memory of 5116 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 88 PID 4536 wrote to memory of 5116 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 88 PID 4536 wrote to memory of 1524 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 89 PID 4536 wrote to memory of 1524 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 89 PID 4536 wrote to memory of 1524 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 89 PID 4536 wrote to memory of 372 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 90 PID 4536 wrote to memory of 372 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 90 PID 4536 wrote to memory of 372 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 90 PID 4536 wrote to memory of 1192 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 94 PID 4536 wrote to memory of 1192 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 94 PID 4536 wrote to memory of 1192 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 94 PID 4536 wrote to memory of 4244 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 96 PID 4536 wrote to memory of 4244 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 96 PID 4536 wrote to memory of 4244 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 96 PID 4536 wrote to memory of 2108 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 104 PID 4536 wrote to memory of 2108 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 104 PID 4536 wrote to memory of 2108 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 104 PID 4536 wrote to memory of 480 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 102 PID 4536 wrote to memory of 480 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 102 PID 4536 wrote to memory of 480 4536 2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe 102 PID 4872 wrote to memory of 3424 4872 cmd.exe 106 PID 4872 wrote to memory of 3424 4872 cmd.exe 106 PID 4872 wrote to memory of 3424 4872 cmd.exe 106 PID 4188 wrote to memory of 4048 4188 cmd.exe 109 PID 4188 wrote to memory of 4048 4188 cmd.exe 109 PID 4188 wrote to memory of 4048 4188 cmd.exe 109 PID 1192 wrote to memory of 5112 1192 cmd.exe 108 PID 1192 wrote to memory of 5112 1192 cmd.exe 108 PID 1192 wrote to memory of 5112 1192 cmd.exe 108 PID 480 wrote to memory of 2876 480 cmd.exe 111 PID 480 wrote to memory of 2876 480 cmd.exe 111 PID 480 wrote to memory of 2876 480 cmd.exe 111 PID 4244 wrote to memory of 4984 4244 cmd.exe 110 PID 4244 wrote to memory of 4984 4244 cmd.exe 110 PID 4244 wrote to memory of 4984 4244 cmd.exe 110 PID 744 wrote to memory of 4792 744 cmd.exe 112 PID 744 wrote to memory of 4792 744 cmd.exe 112 PID 744 wrote to memory of 4792 744 cmd.exe 112 PID 4748 wrote to memory of 928 4748 cmd.exe 113 PID 4748 wrote to memory of 928 4748 cmd.exe 113 PID 4748 wrote to memory of 928 4748 cmd.exe 113 PID 1524 wrote to memory of 3628 1524 cmd.exe 114 PID 1524 wrote to memory of 3628 1524 cmd.exe 114 PID 1524 wrote to memory of 3628 1524 cmd.exe 114 PID 5116 wrote to memory of 5056 5116 cmd.exe 117 PID 5116 wrote to memory of 5056 5116 cmd.exe 117 PID 5116 wrote to memory of 5056 5116 cmd.exe 117 PID 620 wrote to memory of 1868 620 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:3424
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:928
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:4048
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:1868
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:5056
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵PID:372
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1353" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1353" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9563" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9563" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:4792
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9408" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9408" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk676" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"2⤵PID:2108
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk676" /TR "C:\Users\Admin\AppData\Local\Temp\2660f670296be0b21c855beeb9fe262815c12bf1b0e7531d79d1d8057372e67f.exe"3⤵
- Creates scheduled task(s)
PID:3120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 10882⤵
- Program crash
PID:2964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4536 -ip 45361⤵PID:3652