c7099ad1bac376792f58003a3b56f089b08a1a230bdda4c700a57b5d0fe8e8b4

Analysis

user interaction
yes
max time kernel
100s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xcxq0cizialxp6s7.exe
Size 816KB
Sample260720-tajcqsfs4q
SHA256 c7099ad1bac376792f58003a3b56f089b08a1a230bdda4c700a57b5d0fe8e8b4
MD5 2632cd9f297582b521b24705aad19b44
SHA1 f52d6ad071e72347608e87f404029823892f0cc2
SHA512 141991fea5194be04c6f46f5e3d3909a4f8dd35e533448d535ee767b7f13261862922b81d28f0a2ddbf675d883ac8cef28fc98d35272d3b64b93a673ba48adeb
SSDEEP 12288:ha2fYTuEfGSNcb9QSoABBZ5FHZUSs86jgZToZyEoMKwO9U0J:1Ef1qVFGx88yYboMKwUHJ
TLSH
T14405C6247B949E01E5401A3F92BA2618D73260F22713AB47370BF7614D44AFEED6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd_Microsoft67"	xcxq0cizialxp6s7.exe

Executes dropped EXE 9 IoCs

pid	Process
5472	xdwd_Microsoft67
3168	xdwd_Microsoft67
5344	xdwd_Microsoft67
3844	xdwd_Microsoft67
3932	xdwd_Microsoft67
2708	xdwd_Microsoft67
2308	xdwd_Microsoft67
2176	xdwd_Microsoft67
5964	xdwd_Microsoft67

Looks up external IP address via web service 17 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
31	icanhazip.com
56	icanhazip.com
63	ipinfo.io
1	icanhazip.com
11	api.ipify.org
16	icanhazip.com
51	api.ipify.org
3	api.ipify.org
8	api.ipify.org
10	api.ipify.org
33	icanhazip.com
50	api.ipify.org
55	api.ipify.org
62	ipinfo.io
1	api.ipify.org
12	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xdwd_Microsoft67	xcxq0cizialxp6s7.exe
File opened for modification	C:\Windows\xdwd_Microsoft67	xcxq0cizialxp6s7.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5540	cmd.exe
1340	cmd.exe
1364	cmd.exe
3600	cmd.exe
1676	cmd.exe
5608	cmd.exe
2596	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
836	schtasks.exe
4420	schtasks.exe
5604	schtasks.exe
6032	schtasks.exe
1672	schtasks.exe
3984	schtasks.exe
1684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe
3928	xcxq0cizialxp6s7.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	xcxq0cizialxp6s7.exe
Token: SeDebugPrivilege	5472	xdwd_Microsoft67
Token: SeDebugPrivilege	3168	xdwd_Microsoft67
Token: SeDebugPrivilege	5344	xdwd_Microsoft67
Token: SeDebugPrivilege	3932	xdwd_Microsoft67
Token: SeDebugPrivilege	3844	xdwd_Microsoft67
Token: SeDebugPrivilege	2708	xdwd_Microsoft67
Token: SeDebugPrivilege	2308	xdwd_Microsoft67
Token: SeIncBasePriorityPrivilege	5472	xdwd_Microsoft67

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4104	3928	xcxq0cizialxp6s7.exe	91
PID 3928 wrote to memory of 1364	3928	xcxq0cizialxp6s7.exe	93
PID 1364 wrote to memory of 4420	1364	cmd.exe	95
PID 3928 wrote to memory of 3600	3928	xcxq0cizialxp6s7.exe	96
PID 3600 wrote to memory of 5604	3600	cmd.exe	98
PID 3928 wrote to memory of 1676	3928	xcxq0cizialxp6s7.exe	99
PID 1676 wrote to memory of 6032	1676	cmd.exe	101
PID 3928 wrote to memory of 5608	3928	xcxq0cizialxp6s7.exe	102
PID 5608 wrote to memory of 1672	5608	cmd.exe	104
PID 3928 wrote to memory of 2596	3928	xcxq0cizialxp6s7.exe	105
PID 2596 wrote to memory of 3984	2596	cmd.exe	107
PID 3928 wrote to memory of 5540	3928	xcxq0cizialxp6s7.exe	109
PID 5540 wrote to memory of 1684	5540	cmd.exe	111
PID 3928 wrote to memory of 1340	3928	xcxq0cizialxp6s7.exe	112
PID 1340 wrote to memory of 836	1340	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xcxq0cizialxp6s7.exe
"C:\Users\Admin\AppData\Local\Temp\xcxq0cizialxp6s7.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="Y}w5kK]$kwVNk)" dir=in action=allow program="C:\Windows\xdwd_Microsoft67" enable=yes & exit
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5604
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:836

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
PID:5964

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
PID:252

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
PID:1268

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
PID:5668

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd_Microsoft67

Path C:\Windows\xdwd_Microsoft67
Size 816KB
SHA256 c7099ad1bac376792f58003a3b56f089b08a1a230bdda4c700a57b5d0fe8e8b4
MD5 2632cd9f297582b521b24705aad19b44
SHA1 f52d6ad071e72347608e87f404029823892f0cc2
SHA512 141991fea5194be04c6f46f5e3d3909a4f8dd35e533448d535ee767b7f13261862922b81d28f0a2ddbf675d883ac8cef28fc98d35272d3b64b93a673ba48adeb
SSDEEP 12288:ha2fYTuEfGSNcb9QSoABBZ5FHZUSs86jgZToZyEoMKwO9U0J:1Ef1qVFGx88yYboMKwUHJ
TLSH
T14405C6247B949E01E5401A3F92BA2618D73260F22713AB47370BF7614D44AFEED6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3928-1-0x0000025557680000-0x000002555774C000-memory.dmp

Download

memory/3928-0-0x00007FFFAD5DF000-0x00007FFFAD5E0000-memory.dmp

Download

memory/3928-2-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-3-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-4-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-5-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-6-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-7-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-8-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-9-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download

memory/3928-37-0x00007FFFAD450000-0x00007FFFADDF4000-memory.dmp

Download