a9504fddb4d2bb5c3c2af238a1b8e1a60105d3dbf0576dabb56dd82bdba3b68b

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
22/04/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

43434343.exe
Size

577KB
MD5

dbfbb43a05e6dc400e28a8244c60ba25
SHA1

512a77466dac3f33af1ec28103f9bb2f89eb74c9
SHA256

a9504fddb4d2bb5c3c2af238a1b8e1a60105d3dbf0576dabb56dd82bdba3b68b
SHA512

a5339c4e878273886c6a97de1337c757a27a6b86aa4fb7e1815a22fe1a9e1ed2080ede612238255bee6021d8759c9ff5705aee3d5ef657dc5db151c117221986
SSDEEP

6144:ozN+SpinTfDha/wWvSUkl60e6VlWT8b9O8VZcs/CSMofaP0PE0gmLbSGxVznbGk5:oA2YbLnU2dPVle8ToSMo00xSGzPG

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdGIMP (GNU Image Manipulation Program).exe"	43434343.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Loads dropped DLL 42 IoCs

pid	Process
2392	Process not Found
2532	Process not Found
2732	Process not Found
4392	Process not Found
4136	Process not Found
2004	Process not Found
1388	Process not Found
2096	Process not Found
540	Process not Found
460	Process not Found
1572	Process not Found
3444	Process not Found
1440	Process not Found
1576	Process not Found
408	Process not Found
4564	Process not Found
2192	Process not Found
4032	Process not Found
2688	Process not Found
3184	Process not Found
4632	Process not Found
1112	Process not Found
4392	Process not Found
892	Process not Found
4880	Process not Found
3740	Process not Found
3988	Process not Found
2608	Process not Found
4220	Process not Found
2716	Process not Found
5008	Process not Found
3764	Process not Found
3516	Process not Found
5072	Process not Found
2368	Process not Found
1028	Process not Found
4640	Process not Found
4104	Process not Found
764	Process not Found
2328	Process not Found
904	Process not Found
4776	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	43434343.exe

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1932	schtasks.exe
3596	schtasks.exe
3796	schtasks.exe
1784	schtasks.exe
3932	schtasks.exe
1804	schtasks.exe
3844	schtasks.exe
3476	schtasks.exe
1428	schtasks.exe
5088	schtasks.exe
580	schtasks.exe
4580	schtasks.exe
4236	schtasks.exe
232	schtasks.exe
2808	schtasks.exe
1388	schtasks.exe
2732	schtasks.exe
4588	schtasks.exe
3380	schtasks.exe
616	schtasks.exe
412	schtasks.exe
5048	schtasks.exe
652	schtasks.exe
2792	schtasks.exe
2632	schtasks.exe
4620	schtasks.exe
2748	schtasks.exe
596	schtasks.exe
4164	schtasks.exe
1456	schtasks.exe
2200	schtasks.exe
3456	schtasks.exe
3628	schtasks.exe
1444	schtasks.exe
3816	schtasks.exe
1620	schtasks.exe
1448	schtasks.exe
1184	schtasks.exe
4504	schtasks.exe
3724	schtasks.exe
3656	schtasks.exe
3352	schtasks.exe
1528	schtasks.exe
3148	schtasks.exe
4988	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	43434343.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2316	4700	43434343.exe	82
PID 4700 wrote to memory of 2316	4700	43434343.exe	82
PID 2316 wrote to memory of 1804	2316	CMD.exe	84
PID 2316 wrote to memory of 1804	2316	CMD.exe	84
PID 4700 wrote to memory of 4652	4700	43434343.exe	85
PID 4700 wrote to memory of 4652	4700	43434343.exe	85
PID 4652 wrote to memory of 3628	4652	CMD.exe	87
PID 4652 wrote to memory of 3628	4652	CMD.exe	87
PID 4700 wrote to memory of 908	4700	43434343.exe	88
PID 4700 wrote to memory of 908	4700	43434343.exe	88
PID 908 wrote to memory of 3844	908	CMD.exe	90
PID 908 wrote to memory of 3844	908	CMD.exe	90
PID 4700 wrote to memory of 2068	4700	43434343.exe	91
PID 4700 wrote to memory of 2068	4700	43434343.exe	91
PID 2068 wrote to memory of 1528	2068	CMD.exe	93
PID 2068 wrote to memory of 1528	2068	CMD.exe	93
PID 4700 wrote to memory of 1020	4700	43434343.exe	94
PID 4700 wrote to memory of 1020	4700	43434343.exe	94
PID 1020 wrote to memory of 3148	1020	CMD.exe	96
PID 1020 wrote to memory of 3148	1020	CMD.exe	96
PID 4700 wrote to memory of 3112	4700	43434343.exe	97
PID 4700 wrote to memory of 3112	4700	43434343.exe	97
PID 3112 wrote to memory of 1184	3112	CMD.exe	99
PID 3112 wrote to memory of 1184	3112	CMD.exe	99
PID 4700 wrote to memory of 4204	4700	43434343.exe	100
PID 4700 wrote to memory of 4204	4700	43434343.exe	100
PID 4204 wrote to memory of 1444	4204	CMD.exe	102
PID 4204 wrote to memory of 1444	4204	CMD.exe	102
PID 4700 wrote to memory of 3384	4700	43434343.exe	103
PID 4700 wrote to memory of 3384	4700	43434343.exe	103
PID 3384 wrote to memory of 4988	3384	CMD.exe	105
PID 3384 wrote to memory of 4988	3384	CMD.exe	105
PID 4700 wrote to memory of 1436	4700	43434343.exe	106
PID 4700 wrote to memory of 1436	4700	43434343.exe	106
PID 1436 wrote to memory of 3656	1436	CMD.exe	108
PID 1436 wrote to memory of 3656	1436	CMD.exe	108
PID 4700 wrote to memory of 1204	4700	43434343.exe	109
PID 4700 wrote to memory of 1204	4700	43434343.exe	109
PID 1204 wrote to memory of 616	1204	CMD.exe	111
PID 1204 wrote to memory of 616	1204	CMD.exe	111
PID 4700 wrote to memory of 276	4700	43434343.exe	112
PID 4700 wrote to memory of 276	4700	43434343.exe	112
PID 276 wrote to memory of 2632	276	CMD.exe	114
PID 276 wrote to memory of 2632	276	CMD.exe	114
PID 4700 wrote to memory of 4792	4700	43434343.exe	115
PID 4700 wrote to memory of 4792	4700	43434343.exe	115
PID 4792 wrote to memory of 4620	4792	CMD.exe	117
PID 4792 wrote to memory of 4620	4792	CMD.exe	117
PID 4700 wrote to memory of 4124	4700	43434343.exe	118
PID 4700 wrote to memory of 4124	4700	43434343.exe	118
PID 4124 wrote to memory of 3352	4124	CMD.exe	120
PID 4124 wrote to memory of 3352	4124	CMD.exe	120
PID 4700 wrote to memory of 2488	4700	43434343.exe	121
PID 4700 wrote to memory of 2488	4700	43434343.exe	121
PID 2488 wrote to memory of 2748	2488	CMD.exe	123
PID 2488 wrote to memory of 2748	2488	CMD.exe	123
PID 4700 wrote to memory of 4732	4700	43434343.exe	124
PID 4700 wrote to memory of 4732	4700	43434343.exe	124
PID 4732 wrote to memory of 3476	4732	CMD.exe	126
PID 4732 wrote to memory of 3476	4732	CMD.exe	126
PID 4700 wrote to memory of 4684	4700	43434343.exe	127
PID 4700 wrote to memory of 4684	4700	43434343.exe	127
PID 4684 wrote to memory of 232	4684	CMD.exe	129
PID 4684 wrote to memory of 232	4684	CMD.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\43434343.exe
"C:\Users\Admin\AppData\Local\Temp\43434343.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Eclipse" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe"
    3⤵
    - Creates scheduled task(s)
    PID:1804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Excel Host" /tr "C:\Users\Admin\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Excel Host" /tr "C:\Users\Admin\xdwdAdobe Photoshop Upgrade.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1444
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4164
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:4504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:2204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:1264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST & exit
  2⤵
  PID:3828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "KeePass Upgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdGIMP (GNU Image Manipulation Program).exe

Filesize
747.6MB

MD5
16113ff2629437e11989e31c00ec1d9a

SHA1
e53390cc0c98b1136d94260e78ba02bf3be53f99

SHA256
5b85eef648c93b71793f9c135a5fe76913c5d725c8b3d09cde59c0591f11e7ed

SHA512
11bd49158ab91da301b82e85767ca43227e9073c94916efef8b38618fbb879cedefc60a822154377b5323d5fce8b99d07f1aebba82eb886db6d6dee684574281

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/4700-0-0x00000000007C0000-0x0000000000856000-memory.dmp

Filesize
600KB

Download
memory/4700-1-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Filesize
10.8MB

Download
memory/4700-33-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download
memory/4700-88-0x00007FFF27450000-0x00007FFF27F12000-memory.dmp

Filesize
10.8MB

Download
memory/4700-224-0x000000001BB80000-0x000000001BB90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads