Behavioral Analysis

powershell.exe "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHelath';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHelath' -Value '"C:\Users\test22\AppData\Roaming\SecurityHelath\SecurityHelath.exe"' -PropertyType 'String'

cmd.exe "cmd" /C schtasks /create /tn \SecurityHelath /tr "C:\Users\test22\AppData\Roaming\SecurityHelath\SecurityHelath.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f