a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
Size

606KB
MD5

755eb8b506abca0775abfecac004511c
SHA1

94755934eb50b64d3c38d3f480013a5e79fe2fa3
SHA256

a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e
SHA512

8475dca65e46b8d5a783eee62de4ad8e8230b8dc15b93943b7bf62263aa067d3491fc02731bc795c5ab9f9169036dec6bc083422a2d9575413b0d16dabd09562
SSDEEP

6144:1x88WAnqSpA55bOqmTvK7lmSqEmrV5e6VlWT8b93LeLk0FouiaMrLbHq1hyrMtJ0:168WAn2y5PVle81pMMrnfNTMlk

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdClient.exe"	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 46 IoCs

pid	Process
1836	Process not Found
3016	Process not Found
920	Process not Found
3900	Process not Found
2864	WmiApSrv.exe
2716	Process not Found
4904	Process not Found
4584	Process not Found
1900	Process not Found
384	Process not Found
4616	Process not Found
1768	Process not Found
2780	Process not Found
2268	Process not Found
2228	Process not Found
3508	Process not Found
1092	Process not Found
4808	Process not Found
2780	Process not Found
1380	Process not Found
4400	Process not Found
436	Process not Found
2008	Process not Found
2380	Process not Found
2736	Process not Found
4664	Process not Found
1440	Process not Found
3900	Process not Found
5028	Process not Found
4904	Process not Found
1936	Process not Found
2276	Process not Found
2160	Process not Found
4132	Process not Found
2552	Process not Found
1468	Process not Found
3876	Process not Found
3128	Process not Found
3296	Process not Found
2504	Process not Found
5116	Process not Found
760	Process not Found
4884	Process not Found
2484	Process not Found
1912	Process not Found
1768	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Windows\\Sub\\xdwdWatchDog.exe"	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Sub\xdwdClient.exe	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
File opened for modification	C:\Windows\Sub\xdwdClient.exe	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
File opened for modification	C:\Windows\Sub	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
File created	C:\Windows\Sub\xdwdWatchDog.exe	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
File opened for modification	C:\Windows\Sub\xdwdWatchDog.exe	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
File created	C:\Windows\xdwd.dll	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 43 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3840	schtasks.exe
4184	schtasks.exe
4316	schtasks.exe
2812	schtasks.exe
2360	schtasks.exe
432	schtasks.exe
4904	schtasks.exe
2248	schtasks.exe
3612	schtasks.exe
2244	schtasks.exe
1376	schtasks.exe
1768	schtasks.exe
3824	schtasks.exe
4612	schtasks.exe
1712	schtasks.exe
3156	schtasks.exe
2588	schtasks.exe
2812	schtasks.exe
3472	schtasks.exe
392	schtasks.exe
3940	schtasks.exe
4372	schtasks.exe
1472	schtasks.exe
4544	schtasks.exe
3720	schtasks.exe
3132	schtasks.exe
3696	schtasks.exe
1612	schtasks.exe
4568	schtasks.exe
1568	schtasks.exe
3832	schtasks.exe
4036	schtasks.exe
3508	schtasks.exe
3524	schtasks.exe
972	schtasks.exe
4816	schtasks.exe
1212	schtasks.exe
2336	schtasks.exe
3700	schtasks.exe
2564	schtasks.exe
3304	schtasks.exe
2136	schtasks.exe
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 748	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	95
PID 1924 wrote to memory of 748	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	95
PID 748 wrote to memory of 2336	748	CMD.exe	97
PID 748 wrote to memory of 2336	748	CMD.exe	97
PID 1924 wrote to memory of 2720	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	98
PID 1924 wrote to memory of 2720	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	98
PID 2720 wrote to memory of 1568	2720	CMD.exe	100
PID 2720 wrote to memory of 1568	2720	CMD.exe	100
PID 1924 wrote to memory of 3804	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	101
PID 1924 wrote to memory of 3804	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	101
PID 3804 wrote to memory of 4316	3804	CMD.exe	103
PID 3804 wrote to memory of 4316	3804	CMD.exe	103
PID 1924 wrote to memory of 4168	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	104
PID 1924 wrote to memory of 4168	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	104
PID 4168 wrote to memory of 1712	4168	CMD.exe	106
PID 4168 wrote to memory of 1712	4168	CMD.exe	106
PID 1924 wrote to memory of 4036	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	108
PID 1924 wrote to memory of 4036	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	108
PID 4036 wrote to memory of 3700	4036	CMD.exe	110
PID 4036 wrote to memory of 3700	4036	CMD.exe	110
PID 1924 wrote to memory of 4628	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	113
PID 1924 wrote to memory of 4628	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	113
PID 4628 wrote to memory of 2564	4628	CMD.exe	115
PID 4628 wrote to memory of 2564	4628	CMD.exe	115
PID 1924 wrote to memory of 432	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	116
PID 1924 wrote to memory of 432	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	116
PID 432 wrote to memory of 3720	432	CMD.exe	118
PID 432 wrote to memory of 3720	432	CMD.exe	118
PID 1924 wrote to memory of 2340	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	120
PID 1924 wrote to memory of 2340	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	120
PID 2340 wrote to memory of 3156	2340	CMD.exe	122
PID 2340 wrote to memory of 3156	2340	CMD.exe	122
PID 1924 wrote to memory of 1800	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	123
PID 1924 wrote to memory of 1800	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	123
PID 1800 wrote to memory of 3132	1800	CMD.exe	125
PID 1800 wrote to memory of 3132	1800	CMD.exe	125
PID 1924 wrote to memory of 1076	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	128
PID 1924 wrote to memory of 1076	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	128
PID 1076 wrote to memory of 2244	1076	CMD.exe	130
PID 1076 wrote to memory of 2244	1076	CMD.exe	130
PID 1924 wrote to memory of 2380	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	131
PID 1924 wrote to memory of 2380	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	131
PID 2380 wrote to memory of 2588	2380	CMD.exe	133
PID 2380 wrote to memory of 2588	2380	CMD.exe	133
PID 1924 wrote to memory of 3736	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	134
PID 1924 wrote to memory of 3736	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	134
PID 3736 wrote to memory of 3472	3736	CMD.exe	136
PID 3736 wrote to memory of 3472	3736	CMD.exe	136
PID 1924 wrote to memory of 3724	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	137
PID 1924 wrote to memory of 3724	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	137
PID 3724 wrote to memory of 2812	3724	CMD.exe	139
PID 3724 wrote to memory of 2812	3724	CMD.exe	139
PID 1924 wrote to memory of 3740	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	140
PID 1924 wrote to memory of 3740	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	140
PID 3740 wrote to memory of 3696	3740	CMD.exe	142
PID 3740 wrote to memory of 3696	3740	CMD.exe	142
PID 1924 wrote to memory of 4036	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	143
PID 1924 wrote to memory of 4036	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	143
PID 4036 wrote to memory of 3304	4036	CMD.exe	145
PID 4036 wrote to memory of 3304	4036	CMD.exe	145
PID 1924 wrote to memory of 1252	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	146
PID 1924 wrote to memory of 1252	1924	a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe	146
PID 1252 wrote to memory of 1612	1252	CMD.exe	148
PID 1252 wrote to memory of 1612	1252	CMD.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe
"C:\Users\Admin\AppData\Local\Temp\a3f0540bdba7548e3dd358dc3f1e500c49a932a367b869eb6d9c23a0b3aa971e.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdmvdratka" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdmvdratka" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:5104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDmvd" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3612

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1924-0-0x00007FFC36753000-0x00007FFC36755000-memory.dmp

Filesize
8KB

Download
memory/1924-1-0x0000000000650000-0x00000000006EE000-memory.dmp

Filesize
632KB

Download
memory/1924-43-0x00007FFC36750000-0x00007FFC37211000-memory.dmp

Filesize
10.8MB

Download
memory/1924-122-0x00007FFC36750000-0x00007FFC37211000-memory.dmp

Filesize
10.8MB

Download