Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe
Resource
win10v2004-20240730-en
General
-
Target
25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe
-
Size
624KB
-
MD5
14b4c5168cc9eb39e0cbe83c7a87e37f
-
SHA1
dcf9a453797efbe11f2dfc847270e3494142c456
-
SHA256
25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e
-
SHA512
7d539543947c50ac97a8988fc36fc196fed878755bf25204ac70571e491a5ce29ed8e1ec45e6d53e4251ef3d4102339d4bece8199b66ea1d6eb06bb7a7427bf5
-
SSDEEP
12288:50b7bqwCyGXBCPVle82FvkiEEiNlJJJQN0Q:yvbqty+BTiW0Q
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdClient.exe" 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Windows\\Sub\\xdwdWatchDog.exe" 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Sub\xdwdClient.exe 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe File opened for modification C:\Windows\Sub\xdwdClient.exe 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe File opened for modification C:\Windows\Sub 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe File created C:\Windows\Sub\xdwdWatchDog.exe 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe File opened for modification C:\Windows\Sub\xdwdWatchDog.exe 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe File created C:\Windows\xdwd.dll 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 44 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1304 schtasks.exe 2660 schtasks.exe 692 schtasks.exe 1460 schtasks.exe 2464 schtasks.exe 1372 schtasks.exe 564 schtasks.exe 1232 schtasks.exe 2664 schtasks.exe 2484 schtasks.exe 2804 schtasks.exe 3024 schtasks.exe 2296 schtasks.exe 2324 schtasks.exe 2660 schtasks.exe 2604 schtasks.exe 2204 schtasks.exe 1744 schtasks.exe 1464 schtasks.exe 1328 schtasks.exe 2068 schtasks.exe 1860 schtasks.exe 1868 schtasks.exe 1720 schtasks.exe 2396 schtasks.exe 2604 schtasks.exe 2292 schtasks.exe 912 schtasks.exe 2644 schtasks.exe 1572 schtasks.exe 2304 schtasks.exe 2144 schtasks.exe 2500 schtasks.exe 2720 schtasks.exe 628 schtasks.exe 2724 schtasks.exe 2344 schtasks.exe 1500 schtasks.exe 2304 schtasks.exe 976 schtasks.exe 2912 schtasks.exe 2880 schtasks.exe 2956 schtasks.exe 2808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 schtasks.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 1224 CMD.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2500 schtasks.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2664 CMD.exe 2956 schtasks.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 3068 CMD.exe 2204 schtasks.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 32 PID 2400 wrote to memory of 2068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 32 PID 2400 wrote to memory of 2068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 32 PID 2068 wrote to memory of 2880 2068 CMD.exe 34 PID 2068 wrote to memory of 2880 2068 CMD.exe 34 PID 2068 wrote to memory of 2880 2068 CMD.exe 34 PID 2400 wrote to memory of 2632 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 35 PID 2400 wrote to memory of 2632 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 35 PID 2400 wrote to memory of 2632 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 35 PID 2632 wrote to memory of 2660 2632 CMD.exe 37 PID 2632 wrote to memory of 2660 2632 CMD.exe 37 PID 2632 wrote to memory of 2660 2632 CMD.exe 37 PID 2400 wrote to memory of 2680 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 38 PID 2400 wrote to memory of 2680 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 38 PID 2400 wrote to memory of 2680 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 38 PID 2680 wrote to memory of 2144 2680 CMD.exe 40 PID 2680 wrote to memory of 2144 2680 CMD.exe 40 PID 2680 wrote to memory of 2144 2680 CMD.exe 40 PID 2400 wrote to memory of 1224 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 41 PID 2400 wrote to memory of 1224 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 41 PID 2400 wrote to memory of 1224 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 41 PID 1224 wrote to memory of 2500 1224 CMD.exe 43 PID 1224 wrote to memory of 2500 1224 CMD.exe 43 PID 1224 wrote to memory of 2500 1224 CMD.exe 43 PID 2400 wrote to memory of 2664 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 44 PID 2400 wrote to memory of 2664 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 44 PID 2400 wrote to memory of 2664 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 44 PID 2664 wrote to memory of 2956 2664 CMD.exe 46 PID 2664 wrote to memory of 2956 2664 CMD.exe 46 PID 2664 wrote to memory of 2956 2664 CMD.exe 46 PID 2400 wrote to memory of 3068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 47 PID 2400 wrote to memory of 3068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 47 PID 2400 wrote to memory of 3068 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 47 PID 3068 wrote to memory of 2204 3068 CMD.exe 49 PID 3068 wrote to memory of 2204 3068 CMD.exe 49 PID 3068 wrote to memory of 2204 3068 CMD.exe 49 PID 2400 wrote to memory of 2484 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 50 PID 2400 wrote to memory of 2484 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 50 PID 2400 wrote to memory of 2484 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 50 PID 2484 wrote to memory of 3024 2484 CMD.exe 52 PID 2484 wrote to memory of 3024 2484 CMD.exe 52 PID 2484 wrote to memory of 3024 2484 CMD.exe 52 PID 2400 wrote to memory of 860 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 53 PID 2400 wrote to memory of 860 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 53 PID 2400 wrote to memory of 860 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 53 PID 860 wrote to memory of 1720 860 CMD.exe 55 PID 860 wrote to memory of 1720 860 CMD.exe 55 PID 860 wrote to memory of 1720 860 CMD.exe 55 PID 2400 wrote to memory of 2260 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 56 PID 2400 wrote to memory of 2260 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 56 PID 2400 wrote to memory of 2260 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 56 PID 2260 wrote to memory of 2464 2260 CMD.exe 58 PID 2260 wrote to memory of 2464 2260 CMD.exe 58 PID 2260 wrote to memory of 2464 2260 CMD.exe 58 PID 2400 wrote to memory of 1692 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 59 PID 2400 wrote to memory of 1692 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 59 PID 2400 wrote to memory of 1692 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 59 PID 1692 wrote to memory of 2396 1692 CMD.exe 61 PID 1692 wrote to memory of 2396 1692 CMD.exe 61 PID 1692 wrote to memory of 2396 1692 CMD.exe 61 PID 2400 wrote to memory of 564 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 62 PID 2400 wrote to memory of 564 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 62 PID 2400 wrote to memory of 564 2400 25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe 62 PID 564 wrote to memory of 2720 564 CMD.exe 64 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe"C:\Users\Admin\AppData\Local\Temp\25f09e7a45466953a34615a5fbc6312b39a5222eb8d6bb95e89f57bc2334bd1e.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2660
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2956
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3024
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1720
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2464
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2396
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2720
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:548
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2604
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:344
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1464
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2912
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1328
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1772
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2296
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2196
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1372
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1016
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2324
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1580
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2768
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:912
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:892
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2640
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2068
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2216
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1744
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2500
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1500
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2080
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2304
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2540
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2644
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1992
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:976
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1296
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:628
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1728
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1860
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2360
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1232
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2756
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:564
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2068
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2604
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2684
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2724
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1672
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2912
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1584
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2664
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2440
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1304
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1032
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2484
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1996
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1868
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1444
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1572
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1944
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2344
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:1940
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2804
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2888
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2660
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2632
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:692
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2948
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1460
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit2⤵PID:2372
-
C:\Windows\system32\schtasks.exeSchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:2304
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6