Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    01/08/2024, 21:30

General

  • Target

    25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe

  • Size

    624KB

  • MD5

    14b4c5168cc9eb39e0cbe83c7a87e37f

  • SHA1

    dcf9a453797efbe11f2dfc847270e3494142c456

  • SHA256

    25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e

  • SHA512

    7d539543947c50ac97a8988fc36fc196fed878755bf25204ac70571e491a5ce29ed8e1ec45e6d53e4251ef3d4102339d4bece8199b66ea1d6eb06bb7a7427bf5

  • SSDEEP

    12288:50b7bqwCyGXBCPVle82FvkiEEiNlJJJQN0Q:yvbqty+BTiW0Q

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe
    "C:\Users\Admin\AppData\Local\Temp\25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\system32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2880
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2660
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2144
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2500
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2956
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2204
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3024
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1720
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2464
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2396
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:564
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2720
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      2⤵
        PID:548
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2604
      • C:\Windows\system32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
        2⤵
          PID:344
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1464
        • C:\Windows\system32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
          2⤵
            PID:2912
            • C:\Windows\system32\schtasks.exe
              SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1328
          • C:\Windows\system32\CMD.exe
            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
            2⤵
              PID:1772
              • C:\Windows\system32\schtasks.exe
                SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2296
            • C:\Windows\system32\CMD.exe
              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
              2⤵
                PID:2196
                • C:\Windows\system32\schtasks.exe
                  SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1372
              • C:\Windows\system32\CMD.exe
                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                2⤵
                  PID:1016
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2324
                • C:\Windows\system32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                  2⤵
                    PID:1580
                    • C:\Windows\system32\schtasks.exe
                      SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2292
                  • C:\Windows\system32\CMD.exe
                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                    2⤵
                      PID:2768
                      • C:\Windows\system32\schtasks.exe
                        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:912
                    • C:\Windows\system32\CMD.exe
                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                      2⤵
                        PID:892
                        • C:\Windows\system32\schtasks.exe
                          SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:2808
                      • C:\Windows\system32\CMD.exe
                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                        2⤵
                          PID:2640
                          • C:\Windows\system32\schtasks.exe
                            SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:2068
                        • C:\Windows\system32\CMD.exe
                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                          2⤵
                            PID:2216
                            • C:\Windows\system32\schtasks.exe
                              SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:1744
                          • C:\Windows\system32\CMD.exe
                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                            2⤵
                              PID:2500
                              • C:\Windows\system32\schtasks.exe
                                SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:1500
                            • C:\Windows\system32\CMD.exe
                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                              2⤵
                                PID:2080
                                • C:\Windows\system32\schtasks.exe
                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2304
                              • C:\Windows\system32\CMD.exe
                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                2⤵
                                  PID:2540
                                  • C:\Windows\system32\schtasks.exe
                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2644
                                • C:\Windows\system32\CMD.exe
                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                  2⤵
                                    PID:1992
                                    • C:\Windows\system32\schtasks.exe
                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:976
                                  • C:\Windows\system32\CMD.exe
                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                    2⤵
                                      PID:1296
                                      • C:\Windows\system32\schtasks.exe
                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                        3⤵
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:628
                                    • C:\Windows\system32\CMD.exe
                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                      2⤵
                                        PID:1728
                                        • C:\Windows\system32\schtasks.exe
                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                          3⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1860
                                      • C:\Windows\system32\CMD.exe
                                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                        2⤵
                                          PID:2360
                                          • C:\Windows\system32\schtasks.exe
                                            SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                            3⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1232
                                        • C:\Windows\system32\CMD.exe
                                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                          2⤵
                                            PID:2756
                                            • C:\Windows\system32\schtasks.exe
                                              SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                              3⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:564
                                          • C:\Windows\system32\CMD.exe
                                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                            2⤵
                                              PID:2068
                                              • C:\Windows\system32\schtasks.exe
                                                SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                3⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2604
                                            • C:\Windows\system32\CMD.exe
                                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                              2⤵
                                                PID:2684
                                                • C:\Windows\system32\schtasks.exe
                                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                  3⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:2724
                                              • C:\Windows\system32\CMD.exe
                                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                2⤵
                                                  PID:1672
                                                  • C:\Windows\system32\schtasks.exe
                                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                    3⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2912
                                                • C:\Windows\system32\CMD.exe
                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                  2⤵
                                                    PID:1584
                                                    • C:\Windows\system32\schtasks.exe
                                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2664
                                                  • C:\Windows\system32\CMD.exe
                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                    2⤵
                                                      PID:2440
                                                      • C:\Windows\system32\schtasks.exe
                                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:1304
                                                    • C:\Windows\system32\CMD.exe
                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                      2⤵
                                                        PID:1032
                                                        • C:\Windows\system32\schtasks.exe
                                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                          3⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2484
                                                      • C:\Windows\system32\CMD.exe
                                                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                        2⤵
                                                          PID:1996
                                                          • C:\Windows\system32\schtasks.exe
                                                            SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:1868
                                                        • C:\Windows\system32\CMD.exe
                                                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                          2⤵
                                                            PID:1444
                                                            • C:\Windows\system32\schtasks.exe
                                                              SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:1572
                                                          • C:\Windows\system32\CMD.exe
                                                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                            2⤵
                                                              PID:1944
                                                              • C:\Windows\system32\schtasks.exe
                                                                SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                3⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2344
                                                            • C:\Windows\system32\CMD.exe
                                                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                              2⤵
                                                                PID:1940
                                                                • C:\Windows\system32\schtasks.exe
                                                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:2804
                                                              • C:\Windows\system32\CMD.exe
                                                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                                2⤵
                                                                  PID:2888
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2660
                                                                • C:\Windows\system32\CMD.exe
                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                                  2⤵
                                                                    PID:2632
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                      3⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:692
                                                                  • C:\Windows\system32\CMD.exe
                                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                                    2⤵
                                                                      PID:2948
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                        3⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:1460
                                                                    • C:\Windows\system32\CMD.exe
                                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
                                                                      2⤵
                                                                        PID:2372
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
                                                                          3⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:2304

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Windows\xdwd.dll

                                                                      Filesize

                                                                      136KB

                                                                      MD5

                                                                      16e5a492c9c6ae34c59683be9c51fa31

                                                                      SHA1

                                                                      97031b41f5c56f371c28ae0d62a2df7d585adaba

                                                                      SHA256

                                                                      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                                                      SHA512

                                                                      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                                                    • memory/344-316-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/548-284-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/564-255-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/564-787-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/628-702-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/860-170-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/892-512-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/912-478-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/976-674-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1016-423-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1224-66-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1232-758-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1296-703-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1304-926-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1328-338-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1372-394-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1464-311-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1500-590-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1580-451-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1584-900-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1672-871-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1692-228-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1720-169-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1728-731-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1744-567-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1772-367-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1860-730-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/1992-675-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2068-534-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2068-815-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2080-620-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2144-47-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2196-400-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2204-113-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2216-568-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2260-198-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2292-450-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2296-366-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2304-618-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2324-422-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2360-759-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2396-227-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2400-1-0x00000000008B0000-0x0000000000950000-memory.dmp

                                                                      Filesize

                                                                      640KB

                                                                    • memory/2400-0-0x000007FEF6683000-0x000007FEF6684000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2400-50-0x000007FEF6680000-0x000007FEF706C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2400-64-0x000007FEF6683000-0x000007FEF6684000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2400-207-0x000007FEF6680000-0x000007FEF706C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2464-197-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2484-142-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2500-591-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2500-65-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2540-647-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2604-282-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2604-814-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2640-535-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2644-646-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2664-86-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2664-899-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2684-845-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2720-254-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2724-842-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2756-788-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2768-479-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2808-511-0x000007FEF79E0000-0x000007FEF7A02000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2912-339-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2912-870-0x000007FEF86E0000-0x000007FEF8702000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/2956-85-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/3024-141-0x000007FEF7300000-0x000007FEF7322000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                    • memory/3068-115-0x000007FEF72D0000-0x000007FEF72F2000-memory.dmp

                                                                      Filesize

                                                                      136KB