74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec

Resubmissions

20/08/2026, 16:03

260820-thnmes1arg10

20/08/2026, 16:03

20/08/2026, 16:02

20/08/2026, 16:00

20/08/2026, 15:59

20/08/2026, 15:56

Analysis

max time kernel
491s
max time network
494s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
111.exe
Size 814KB
Sample260820-thnmes1arg
SHA256 74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec
MD5 0b83a955d9ba6d12341cf34a9bc7d37c
SHA1 a940d4304f3345b4b8eb28e9ee6b8691daebd407
SHA512 b4ff5dacc91f056b57fe1890927357c54b0241ac70c64adb9defeb3827bbc1e37cc7ed906576cc33967a3b54796864812328aaca4ce4ab6a4d4c8739d449bb56
SSDEEP 12288:e7Nd7hDT1Thg/WwpCHxtDPyZe/zrBYwh27qUTqj:WP7F1e/gHx9Uwzd9hzUK
TLSH
T11505D6247B959E41E540193E92BE2608D732A0F32312AB47370BF7615D44AFEED2D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwd_Microsoft67"	111.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	xdwd_Microsoft67

Executes dropped EXE 16 IoCs

pid	Process
1260	xdwd_Microsoft67
3404	xdwd_Microsoft67
2168	xdwd_Microsoft67
4860	xdwd_Microsoft67
4796	xdwd_Microsoft67
1552	xdwd_Microsoft67
972	xdwd_Microsoft67
1132	xdwd_Microsoft67
3292	xdwd_Microsoft67
4868	xdwd_Microsoft67
2168	xdwd_Microsoft67
1292	xdwd_Microsoft67
3628	xdwd_Microsoft67
3552	xdwd_Microsoft67
3860	xdwd_Microsoft67
4616	xdwd_Microsoft67

Looks up external IP address via web service 1 TTPs 28 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
94	checkip.amazonaws.com
8	api.ipify.org
77	api.ipify.org
98	icanhazip.com
102	api.ipify.org
104	ipinfo.io
7	api.ipify.org
16	icanhazip.com
43	api.ipify.org
48	icanhazip.com
65	api.ipify.org
84	icanhazip.com
97	api.ipify.org
100	api.ipify.org
51	icanhazip.com
57	checkip.amazonaws.com
58	checkip.amazonaws.com
75	api.ipify.org
76	api.ipify.org
80	api.ipify.org
82	api.ipify.org
105	ipinfo.io
9	api.ipify.org
15	icanhazip.com
55	ipinfo.io
66	api.ipify.org
81	api.ipify.org
92	ipinfo.io

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwd_Microsoft67	111.exe
File created	C:\Windows\xdwd_Microsoft67	111.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2524	cmd.exe
1044	cmd.exe
444	cmd.exe
2620	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "199"	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
780	schtasks.exe
4648	schtasks.exe
5044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe
1276	111.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	111.exe
Token: SeDebugPrivilege	1260	xdwd_Microsoft67
Token: SeDebugPrivilege	3404	xdwd_Microsoft67
Token: SeIncBasePriorityPrivilege	1260	xdwd_Microsoft67
Token: SeDebugPrivilege	2168	xdwd_Microsoft67
Token: SeDebugPrivilege	4860	xdwd_Microsoft67
Token: SeDebugPrivilege	4796	xdwd_Microsoft67
Token: SeDebugPrivilege	1552	xdwd_Microsoft67
Token: SeDebugPrivilege	972	xdwd_Microsoft67
Token: SeDebugPrivilege	1132	xdwd_Microsoft67
Token: SeDebugPrivilege	3292	xdwd_Microsoft67
Token: SeDebugPrivilege	4868	xdwd_Microsoft67
Token: SeDebugPrivilege	2168	xdwd_Microsoft67
Token: SeDebugPrivilege	1292	xdwd_Microsoft67
Token: SeDebugPrivilege	3628	xdwd_Microsoft67
Token: SeDebugPrivilege	3552	xdwd_Microsoft67
Token: SeDebugPrivilege	3860	xdwd_Microsoft67
Token: SeDebugPrivilege	4616	xdwd_Microsoft67
Token: SeShutdownPrivilege	2844	shutdown.exe
Token: SeRemoteShutdownPrivilege	2844	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4788	1276	111.exe	85
PID 1276 wrote to memory of 2620	1276	111.exe	87
PID 2620 wrote to memory of 780	2620	cmd.exe	89
PID 1276 wrote to memory of 2524	1276	111.exe	90
PID 2524 wrote to memory of 4648	2524	cmd.exe	92
PID 1276 wrote to memory of 1044	1276	111.exe	93
PID 1044 wrote to memory of 5044	1044	cmd.exe	95
PID 1260 wrote to memory of 444	1260	xdwd_Microsoft67	120
PID 444 wrote to memory of 2844	444	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\111.exe
"C:\Users\Admin\AppData\Local\Temp\111.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="+'s&>E8(>s\z>e" dir=in action=allow program="C:\Windows\xdwd_Microsoft67" enable=yes & exit
  2⤵
  PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:780
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5044

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2844

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\xdwd_Microsoft67
"C:\Windows\xdwd_Microsoft67"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd_Microsoft67.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwd_Microsoft67.log
Size 1KB
SHA256 7ab36169585ab02f0372b37a1442b9b117aba7515515c1813d23606f41dbb9bb
MD5 45e017cb1e5b78cb644a8f3a12dcf234
SHA1 ec14f82842f6331df1df460d9a60fb0bcb1c22cf
SHA512 417cf18f4e229756a1798a218ebc0cff3522418c0035050f22393a5430be03378581d442160967e734cbbf55e96f65e5e8dfca5d10fa33bb5e230070281175c0
TLSH
T19511AB7133B1A1D48A563F47187C258413FF4358FA90AE5C7AA8A26ED82B4171F322F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-64-0x000001CDC7DF0000-0x000001CDC7DFA000-memory.dmp

Download

memory/1276-0-0x00000278BE970000-0x00000278BEA40000-memory.dmp

Download

memory/1276-1-0x00000278D9200000-0x00000278D9210000-memory.dmp

Download

memory/1276-29-0x00000278D9200000-0x00000278D9210000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads