74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec

Resubmissions

20/08/2026, 16:03

260820-thnmes1arg10

20/08/2026, 16:03

20/08/2026, 16:02

20/08/2026, 16:00

20/08/2026, 15:59

20/08/2026, 15:56

Analysis

max time kernel
518s
max time network
520s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
111.exe
Size 814KB
Sample260820-thfltatyfz
SHA256 74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec
MD5 0b83a955d9ba6d12341cf34a9bc7d37c
SHA1 a940d4304f3345b4b8eb28e9ee6b8691daebd407
SHA512 b4ff5dacc91f056b57fe1890927357c54b0241ac70c64adb9defeb3827bbc1e37cc7ed906576cc33967a3b54796864812328aaca4ce4ab6a4d4c8739d449bb56
SSDEEP 12288:e7Nd7hDT1Thg/WwpCHxtDPyZe/zrBYwh27qUTqj:WP7F1e/gHx9Uwzd9hzUK
TLSH
T11505D6247B959E41E540193E92BE2608D732A0F32312AB47370BF7615D44AFEED2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd_Microsoft67"	111.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation	xdwd_Microsoft67

Executes dropped EXE 49 IoCs

pid	Process
4312	xdwd_Microsoft67
5248	xdwd_Microsoft67
5196	xdwd_Microsoft67
1984	xdwd_Microsoft67
6048	xdwd_Microsoft67
476	xdwd_Microsoft67
3744	xdwd_Microsoft67
1744	xdwd_Microsoft67
3996	xdwd_Microsoft67
2520	xdwd_Microsoft67
5948	xdwd_Microsoft67
2348	xdwd_Microsoft67
5604	xdwd_Microsoft67
5340	xdwd_Microsoft67
5600	xdwd_Microsoft67
4836	xdwd_Microsoft67
3800	xdwd_Microsoft67
2384	xdwd_Microsoft67
5788	xdwd_Microsoft67
4180	xdwd_Microsoft67
1904	xdwd_Microsoft67
5360	xdwd_Microsoft67
4624	xdwd_Microsoft67
3496	xdwd_Microsoft67
4820	xdwd_Microsoft67
3692	xdwd_Microsoft67
5480	xdwd_Microsoft67
1092	xdwd_Microsoft67
3452	xdwd_Microsoft67
3828	xdwd_Microsoft67
4176	xdwd_Microsoft67
1916	xdwd_Microsoft67
5204	xdwd_Microsoft67
2448	xdwd_Microsoft67
2836	xdwd_Microsoft67
2664	xdwd_Microsoft67
3796	xdwd_Microsoft67
2992	xdwd_Microsoft67
2488	xdwd_Microsoft67
3528	xdwd_Microsoft67
3220	xdwd_Microsoft67
4796	xdwd_Microsoft67
4836	xdwd_Microsoft67
1492	xdwd_Microsoft67
2308	xdwd_Microsoft67
3728	xdwd_Microsoft67
5564	xdwd_Microsoft67
3636	xdwd_Microsoft67
632	xdwd_Microsoft67

Looks up external IP address via web service 1 TTPs 58 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
80	api.ipify.org
101	api.ipify.org
111	api.ipify.org
100	api.ipify.org
126	api.ipify.org
103	api.ipify.org
120	checkip.amazonaws.com
30	api.ipify.org
79	api.ipify.org
95	api.ipify.org
97	api.ipify.org
99	api.ipify.org
56	api.ipify.org
105	api.ipify.org
133	api.ipify.org
7	api.ipify.org
8	api.ipify.org
88	ipinfo.io
107	api.ipify.org
132	api.ipify.org
44	ipinfo.io
78	api.ipify.org
94	api.ipify.org
98	api.ipify.org
55	api.ipify.org
102	api.ipify.org
46	checkip.amazonaws.com
117	ipinfo.io
122	api.ipify.org
39	icanhazip.com
47	checkip.amazonaws.com
119	checkip.amazonaws.com
130	api.ipify.org
29	api.ipify.org
36	api.ipify.org
89	ipinfo.io
113	icanhazip.com
128	api.ipify.org
96	api.ipify.org
52	api.ipify.org
63	icanhazip.com
33	api.ipify.org
106	api.ipify.org
112	icanhazip.com
116	ipinfo.io
125	api.ipify.org
129	api.ipify.org
131	api.ipify.org
35	api.ipify.org
38	icanhazip.com
64	ipinfo.io
76	api.ipify.org
81	api.ipify.org
124	api.ipify.org
123	api.ipify.org
93	api.ipify.org
104	api.ipify.org
127	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xdwd_Microsoft67	111.exe
File opened for modification	C:\Windows\xdwd_Microsoft67	111.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5368	cmd.exe
2912	cmd.exe
1280	cmd.exe
5244	cmd.exe
2844	cmd.exe
5624	cmd.exe
5056	cmd.exe
2872	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "15"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3896	schtasks.exe
4928	schtasks.exe
1072	schtasks.exe
412	schtasks.exe
2432	schtasks.exe
380	schtasks.exe
1484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe
4916	111.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	111.exe
Token: SeDebugPrivilege	4312	xdwd_Microsoft67
Token: SeDebugPrivilege	5248	xdwd_Microsoft67
Token: SeDebugPrivilege	5196	xdwd_Microsoft67
Token: SeDebugPrivilege	1984	xdwd_Microsoft67
Token: SeDebugPrivilege	6048	xdwd_Microsoft67
Token: SeDebugPrivilege	476	xdwd_Microsoft67
Token: SeDebugPrivilege	3744	xdwd_Microsoft67
Token: SeIncBasePriorityPrivilege	5248	xdwd_Microsoft67
Token: SeDebugPrivilege	1744	xdwd_Microsoft67
Token: SeDebugPrivilege	3996	xdwd_Microsoft67
Token: SeDebugPrivilege	5948	xdwd_Microsoft67
Token: SeDebugPrivilege	2520	xdwd_Microsoft67
Token: SeDebugPrivilege	2348	xdwd_Microsoft67
Token: SeDebugPrivilege	5604	xdwd_Microsoft67
Token: SeDebugPrivilege	5340	xdwd_Microsoft67
Token: SeDebugPrivilege	5600	xdwd_Microsoft67
Token: SeDebugPrivilege	3800	xdwd_Microsoft67
Token: SeDebugPrivilege	4836	xdwd_Microsoft67
Token: SeDebugPrivilege	2384	xdwd_Microsoft67
Token: SeDebugPrivilege	5788	xdwd_Microsoft67
Token: SeDebugPrivilege	4180	xdwd_Microsoft67
Token: SeDebugPrivilege	1904	xdwd_Microsoft67
Token: SeDebugPrivilege	5360	xdwd_Microsoft67
Token: SeDebugPrivilege	4624	xdwd_Microsoft67
Token: SeDebugPrivilege	3496	xdwd_Microsoft67
Token: SeDebugPrivilege	4820	xdwd_Microsoft67
Token: SeDebugPrivilege	3692	xdwd_Microsoft67
Token: SeDebugPrivilege	5480	xdwd_Microsoft67
Token: SeDebugPrivilege	1092	xdwd_Microsoft67
Token: SeDebugPrivilege	3452	xdwd_Microsoft67
Token: SeDebugPrivilege	3828	xdwd_Microsoft67
Token: SeDebugPrivilege	4176	xdwd_Microsoft67
Token: SeDebugPrivilege	1916	xdwd_Microsoft67
Token: SeDebugPrivilege	5204	xdwd_Microsoft67
Token: SeDebugPrivilege	2836	xdwd_Microsoft67
Token: SeDebugPrivilege	2448	xdwd_Microsoft67
Token: SeDebugPrivilege	2664	xdwd_Microsoft67
Token: SeDebugPrivilege	3796	xdwd_Microsoft67
Token: SeDebugPrivilege	2992	xdwd_Microsoft67
Token: SeDebugPrivilege	2488	xdwd_Microsoft67
Token: SeDebugPrivilege	3528	xdwd_Microsoft67
Token: SeDebugPrivilege	3220	xdwd_Microsoft67
Token: SeDebugPrivilege	4796	xdwd_Microsoft67
Token: SeDebugPrivilege	4836	xdwd_Microsoft67
Token: SeDebugPrivilege	1492	xdwd_Microsoft67
Token: SeDebugPrivilege	2308	xdwd_Microsoft67
Token: SeDebugPrivilege	3728	xdwd_Microsoft67
Token: SeDebugPrivilege	5564	xdwd_Microsoft67
Token: SeDebugPrivilege	3636	xdwd_Microsoft67
Token: SeDebugPrivilege	632	xdwd_Microsoft67
Token: SeShutdownPrivilege	4236	shutdown.exe
Token: SeRemoteShutdownPrivilege	4236	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	LogonUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2492	4916	111.exe	87
PID 4916 wrote to memory of 2912	4916	111.exe	88
PID 2912 wrote to memory of 1072	2912	cmd.exe	91
PID 4916 wrote to memory of 1280	4916	111.exe	92
PID 1280 wrote to memory of 412	1280	cmd.exe	94
PID 4916 wrote to memory of 5244	4916	111.exe	95
PID 5244 wrote to memory of 2432	5244	cmd.exe	97
PID 4916 wrote to memory of 2844	4916	111.exe	98
PID 2844 wrote to memory of 380	2844	cmd.exe	100
PID 4916 wrote to memory of 5624	4916	111.exe	101
PID 5624 wrote to memory of 1484	5624	cmd.exe	103
PID 4916 wrote to memory of 5056	4916	111.exe	107
PID 5056 wrote to memory of 3896	5056	cmd.exe	109
PID 4916 wrote to memory of 2872	4916	111.exe	112
PID 2872 wrote to memory of 4928	2872	cmd.exe	114
PID 5248 wrote to memory of 5368	5248	xdwd_Microsoft67	166
PID 5368 wrote to memory of 4236	5368	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\111.exe
"C:\Users\Admin\AppData\Local\Temp\111.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="+'s&>E8(>s\z>e" dir=in action=allow program="C:\Windows\xdwd_Microsoft67" enable=yes & exit
  2⤵
  PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1072
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:412
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:380
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4236

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6048

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5340

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39f9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd_Microsoft67.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwd_Microsoft67.log
Size 1KB
SHA256 7ab36169585ab02f0372b37a1442b9b117aba7515515c1813d23606f41dbb9bb
MD5 45e017cb1e5b78cb644a8f3a12dcf234
SHA1 ec14f82842f6331df1df460d9a60fb0bcb1c22cf
SHA512 417cf18f4e229756a1798a218ebc0cff3522418c0035050f22393a5430be03378581d442160967e734cbbf55e96f65e5e8dfca5d10fa33bb5e230070281175c0
TLSH
T19511AB7133B1A1D48A563F47187C258413FF4358FA90AE5C7AA8A26ED82B4171F322F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4916-0-0x000001F4DCA10000-0x000001F4DCAE0000-memory.dmp

Download

memory/4916-1-0x000001F4F71A0000-0x000001F4F71B0000-memory.dmp

Download

memory/4916-29-0x000001F4F71A0000-0x000001F4F71B0000-memory.dmp

Download

memory/5248-149-0x0000022D9BB50000-0x0000022D9BB5A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads