sheetrat | 867057b5fbbc5cabcef4dccc17be30108ca9513055985aa7c8bc56544be5ad3d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dropped_malware_RuntimeBroker.exe
Size 199KB
Sample260831-l2ngrsssbv
SHA256 867057b5fbbc5cabcef4dccc17be30108ca9513055985aa7c8bc56544be5ad3d
MD5 3c0888686421d1540abca47b97f32729
SHA1 d90d7a28c27f78a9f49673e7a52f7039050f3680
SHA512 e441db58b8639e21a5cb98c5aee2cd45b93b259180645671b908aeebb1260259ba3d48eefd62340e9e024bcb65b846e472d89d3452dca994d29fa876644dd644
SSDEEP 3072:aJTfLY1s4QdZKNeN3w/jhlhE1Z8Nig99FVRodG31Zbe4bsbf4lDPO/Qny7cUd2Y:Kss4Qdse6VlWT8b93V6M1Ne4IbGad9
TLSH
T1EA145C2EAFE14546F1ED0ABC89423452C73DF6DBA403F346A786A17B0DC6368ED450DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_mejmovssqulxp execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_mejmovssqulxp

https://pastefy.app/2aUAC7Vy/raw

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdsvchost.exe"	dropped_malware_RuntimeBroker.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
1476	xdwdWinlogon.exe
1276	xdwdsvchost.exe
2040	xdwdsvchost.exe

Loads dropped DLL 49 IoCs

pid	Process
2828	Process not Found
4956	Process not Found
3392	Process not Found
6020	Process not Found
1476	xdwdWinlogon.exe
1276	xdwdsvchost.exe
1912	Process not Found
4452	Process not Found
3848	Process not Found
3756	Process not Found
4480	Process not Found
1060	Process not Found
5596	Process not Found
4816	Process not Found
4752	Process not Found
2040	xdwdsvchost.exe
548	Process not Found
2128	Process not Found
2088	Process not Found
2012	Process not Found
6028	Process not Found
6004	Process not Found
2140	Process not Found
3460	Process not Found
4396	Process not Found
2424	Process not Found
5404	Process not Found
5280	Process not Found
2268	Process not Found
1240	Process not Found
5792	Process not Found
2028	Process not Found
1368	Process not Found
2352	Process not Found
4112	Process not Found
1760	Process not Found
2820	Process not Found
4480	Process not Found
3044	Process not Found
4876	Process not Found
4200	Process not Found
2844	Process not Found
4916	Process not Found
3328	Process not Found
2920	Process not Found
4360	Process not Found
4308	Process not Found
1556	Process not Found
5556	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdge = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdWinlogon.exe"	dropped_malware_RuntimeBroker.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	dropped_malware_RuntimeBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5684	CMD.exe
3764	CMD.exe
3396	CMD.exe
5156	CMD.exe
3208	CMD.exe
3784	CMD.exe
2640	CMD.exe
248	CMD.exe
3428	CMD.exe
4864	CMD.exe
4548	CMD.exe
2148	CMD.exe
5892	CMD.exe
3536	CMD.exe
2708	CMD.exe
5056	CMD.exe
2004	CMD.exe
2244	CMD.exe
3476	CMD.exe
3744	CMD.exe
5088	CMD.exe
2336	CMD.exe
5236	CMD.exe
6136	CMD.exe
4756	CMD.exe
2432	CMD.exe
1960	CMD.exe
2360	CMD.exe
1376	CMD.exe
5168	CMD.exe
3092	CMD.exe
1520	CMD.exe
1756	CMD.exe
1248	CMD.exe
1804	CMD.exe
2104	CMD.exe
2676	CMD.exe
3588	CMD.exe
1904	CMD.exe
5300	CMD.exe
2988	CMD.exe
2508	CMD.exe
5312	CMD.exe
2812	CMD.exe
2768	CMD.exe
2752	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5708	schtasks.exe
1080	schtasks.exe
3048	schtasks.exe
5048	schtasks.exe
5668	schtasks.exe
3924	schtasks.exe
5892	schtasks.exe
2248	schtasks.exe
5912	schtasks.exe
5900	schtasks.exe
1808	schtasks.exe
252	schtasks.exe
1900	schtasks.exe
5968	schtasks.exe
3828	schtasks.exe
760	schtasks.exe
3924	schtasks.exe
4264	schtasks.exe
2276	schtasks.exe
4912	schtasks.exe
6068	schtasks.exe
2656	schtasks.exe
1776	schtasks.exe
200	schtasks.exe
3744	schtasks.exe
6100	schtasks.exe
2020	schtasks.exe
4276	schtasks.exe
1316	schtasks.exe
5704	schtasks.exe
2540	schtasks.exe
2928	schtasks.exe
4132	schtasks.exe
5480	schtasks.exe
2184	schtasks.exe
4680	schtasks.exe
6116	schtasks.exe
5840	schtasks.exe
2916	schtasks.exe
3532	schtasks.exe
3048	schtasks.exe
4576	schtasks.exe
4064	schtasks.exe
5532	schtasks.exe
3364	schtasks.exe
5760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe
1476	xdwdWinlogon.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	dropped_malware_RuntimeBroker.exe
Token: SeDebugPrivilege	1276	xdwdsvchost.exe
Token: SeDebugPrivilege	1476	xdwdWinlogon.exe
Token: SeDebugPrivilege	2040	xdwdsvchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5300	4832	dropped_malware_RuntimeBroker.exe	89
PID 5300 wrote to memory of 4680	5300	CMD.exe	91
PID 4832 wrote to memory of 2432	4832	dropped_malware_RuntimeBroker.exe	92
PID 2432 wrote to memory of 2916	2432	CMD.exe	94
PID 4832 wrote to memory of 4864	4832	dropped_malware_RuntimeBroker.exe	95
PID 4864 wrote to memory of 5892	4864	CMD.exe	97
PID 4832 wrote to memory of 1756	4832	dropped_malware_RuntimeBroker.exe	100
PID 1756 wrote to memory of 3532	1756	CMD.exe	102
PID 4832 wrote to memory of 5168	4832	dropped_malware_RuntimeBroker.exe	105
PID 5168 wrote to memory of 4264	5168	CMD.exe	107
PID 4832 wrote to memory of 4548	4832	dropped_malware_RuntimeBroker.exe	109
PID 4548 wrote to memory of 5704	4548	CMD.exe	111
PID 4832 wrote to memory of 2708	4832	dropped_malware_RuntimeBroker.exe	112
PID 2708 wrote to memory of 2540	2708	CMD.exe	114
PID 4832 wrote to memory of 2148	4832	dropped_malware_RuntimeBroker.exe	115
PID 2148 wrote to memory of 5900	2148	CMD.exe	117
PID 1276 wrote to memory of 3396	1276	xdwdsvchost.exe	118
PID 3396 wrote to memory of 1808	3396	CMD.exe	120
PID 4832 wrote to memory of 5156	4832	dropped_malware_RuntimeBroker.exe	121
PID 5156 wrote to memory of 3048	5156	CMD.exe	123
PID 1476 wrote to memory of 1248	1476	xdwdWinlogon.exe	124
PID 1248 wrote to memory of 252	1248	CMD.exe	126
PID 1276 wrote to memory of 3208	1276	xdwdsvchost.exe	127
PID 3208 wrote to memory of 200	3208	CMD.exe	129
PID 4832 wrote to memory of 5056	4832	dropped_malware_RuntimeBroker.exe	130
PID 5056 wrote to memory of 2928	5056	CMD.exe	132
PID 1476 wrote to memory of 2040	1476	xdwdWinlogon.exe	133
PID 4832 wrote to memory of 2988	4832	dropped_malware_RuntimeBroker.exe	134
PID 2988 wrote to memory of 3924	2988	CMD.exe	136
PID 4832 wrote to memory of 1960	4832	dropped_malware_RuntimeBroker.exe	137
PID 1960 wrote to memory of 4132	1960	CMD.exe	139
PID 4832 wrote to memory of 2508	4832	dropped_malware_RuntimeBroker.exe	140
PID 2508 wrote to memory of 3744	2508	CMD.exe	142
PID 4832 wrote to memory of 3092	4832	dropped_malware_RuntimeBroker.exe	143
PID 3092 wrote to memory of 6116	3092	CMD.exe	145
PID 2040 wrote to memory of 5312	2040	xdwdsvchost.exe	146
PID 5312 wrote to memory of 1900	5312	CMD.exe	148
PID 4832 wrote to memory of 3784	4832	dropped_malware_RuntimeBroker.exe	149
PID 3784 wrote to memory of 4576	3784	CMD.exe	151
PID 2040 wrote to memory of 1520	2040	xdwdsvchost.exe	152
PID 1520 wrote to memory of 4064	1520	CMD.exe	154
PID 4832 wrote to memory of 2640	4832	dropped_malware_RuntimeBroker.exe	155
PID 2640 wrote to memory of 6100	2640	CMD.exe	157
PID 4832 wrote to memory of 2004	4832	dropped_malware_RuntimeBroker.exe	158
PID 2004 wrote to memory of 2276	2004	CMD.exe	160
PID 4832 wrote to memory of 2360	4832	dropped_malware_RuntimeBroker.exe	161
PID 2360 wrote to memory of 5532	2360	CMD.exe	163
PID 4832 wrote to memory of 2244	4832	dropped_malware_RuntimeBroker.exe	164
PID 2244 wrote to memory of 5708	2244	CMD.exe	166
PID 4832 wrote to memory of 5892	4832	dropped_malware_RuntimeBroker.exe	167
PID 5892 wrote to memory of 2248	5892	CMD.exe	169
PID 4832 wrote to memory of 3476	4832	dropped_malware_RuntimeBroker.exe	170
PID 3476 wrote to memory of 1080	3476	CMD.exe	172
PID 4832 wrote to memory of 3764	4832	dropped_malware_RuntimeBroker.exe	173
PID 3764 wrote to memory of 5480	3764	CMD.exe	175
PID 4832 wrote to memory of 2812	4832	dropped_malware_RuntimeBroker.exe	176
PID 2812 wrote to memory of 5912	2812	CMD.exe	178
PID 4832 wrote to memory of 5088	4832	dropped_malware_RuntimeBroker.exe	179
PID 5088 wrote to memory of 4912	5088	CMD.exe	181
PID 4832 wrote to memory of 2336	4832	dropped_malware_RuntimeBroker.exe	182
PID 2336 wrote to memory of 5968	2336	CMD.exe	184
PID 4832 wrote to memory of 248	4832	dropped_malware_RuntimeBroker.exe	185
PID 248 wrote to memory of 2020	248	CMD.exe	187
PID 4832 wrote to memory of 3428	4832	dropped_malware_RuntimeBroker.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dropped_malware_RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\dropped_malware_RuntimeBroker.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Shell" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Shell" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftSharePoint" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdWinlogon.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftSharePoint" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdWinlogon.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdWinlogon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdWinlogon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:252
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1900
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4064

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "InkscapeUpgrade" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdsvchost.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4832-1-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp

Download

memory/4832-0-0x0000000000910000-0x0000000000946000-memory.dmp

Download

memory/4832-2-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-3-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-4-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-5-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-40-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4832-80-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download