sheetrat | 42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb

Analysis

max time kernel
124s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe
Size 1.6MB
Sample260924-ndvx2scc55
SHA256 42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb
MD5 e826d17f50b05b37655cea60c4ddfc5a
SHA1 519166a8ca54c1bfbec9dbf64b5bd70a8f17bb6b
SHA512 f9e095c46eaebdf0548974990193c4575c2440cab3f68d78557266bb5575f413fd898164eeffbcd86ed965b0e7ef1559058002286b6ae9f3bbfcd31dbb4a32a6
SSDEEP 24576:bU4WpozoVO5kRSzThB9R56i7L0O3Bl5jWG3nkFiqJOXoItE:KpoMVBSzTp0Y0Fiq
TLSH
T10E75C8187F50EC1ECE28297A47D69310AF7114D03B63730237176AEE6E017AA9D972F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_wvnkneyyxn discovery execution sheetrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

91.92.42.94:1187

Mutex

F8qsJOjNOUJETWko

Attributes

Install_directory
%AppData%
install_file
Svchost.exe

aes.plain

Extracted

Family

sheetrat

Version

2.6.4

Campaign

Sheet_wvnkneyyxn

91.92.42.94:1187

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2116-1-0x00000000005A0000-0x000000000073C000-memory.dmp	family_xworm
behavioral2/files/0x000c00000001c62e-10.dat	family_xworm
behavioral2/memory/4696-14-0x00000000002F0000-0x0000000000300000-memory.dmp	family_xworm

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000c00000001c630-27.dat	family_sheetrat_v4
behavioral2/memory/680-31-0x0000000000020000-0x00000000000CE000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 3 IoCs

resource	yara_rule
behavioral2/memory/2116-1-0x00000000005A0000-0x000000000073C000-memory.dmp	Sheetrat_v5
behavioral2/files/0x000c00000001c630-27.dat	Sheetrat_v5
behavioral2/memory/680-31-0x0000000000020000-0x00000000000CE000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	liberka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\RuntimeBroker.exe"	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\RuntimeBroker.exe"	shitka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 24 IoCs

pid	Process
4696	XWorm.exe
1212	liberka.exe
680	shitka.exe
5328	xdwdRuntimeBroker.exe
5816	MalwareDef.exe
4632	MalwareDef.exe
6036	RuntimeBroker.exe
3476	MalwareDef.exe
2260	MalwareDef.exe
2972	MalwareDef.exe
4756	MalwareDef.exe
3400	MalwareDef.exe
3520	MalwareDef.exe
1132	MalwareDef.exe
4280	MalwareDef.exe
5740	MalwareDef.exe
4772	MalwareDef.exe
3040	MalwareDef.exe
5436	MalwareDef.exe
128	MalwareDef.exe
3504	MalwareDef.exe
1336	MalwareDef.exe
3212	MalwareDef.exe
4608	MalwareDef.exe

Loads dropped DLL 64 IoCs

pid	Process
2452	Process not Found
3940	Process not Found
2784	Process not Found
1880	Process not Found
5404	Process not Found
5328	xdwdRuntimeBroker.exe
5816	MalwareDef.exe
4540	Process not Found
2440	Process not Found
4632	MalwareDef.exe
3488	Process not Found
4908	Process not Found
4524	Process not Found
5700	Process not Found
5576	Process not Found
5772	Process not Found
5288	Process not Found
6072	Process not Found
5744	Process not Found
1160	Process not Found
4976	Process not Found
5752	Process not Found
2336	Process not Found
5428	Process not Found
2720	Process not Found
5080	Process not Found
4832	Process not Found
2756	Process not Found
1860	Process not Found
2540	Process not Found
5392	Process not Found
1352	Process not Found
4996	Process not Found
1496	Process not Found
5636	Process not Found
4216	Process not Found
2824	Process not Found
2444	Process not Found
1244	Process not Found
3488	Process not Found
1188	Process not Found
1104	Process not Found
3476	MalwareDef.exe
2260	MalwareDef.exe
2972	MalwareDef.exe
4756	MalwareDef.exe
3400	MalwareDef.exe
3520	MalwareDef.exe
5608	Process not Found
2128	Process not Found
4324	Process not Found
2884	Process not Found
1132	MalwareDef.exe
4280	MalwareDef.exe
5740	MalwareDef.exe
4772	MalwareDef.exe
3040	MalwareDef.exe
128	MalwareDef.exe
5436	MalwareDef.exe
3504	MalwareDef.exe
1336	MalwareDef.exe
3212	MalwareDef.exe
4608	MalwareDef.exe
2476	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sub\\xdwdRuntimeBroker.exe"	shitka.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File created	C:\Windows\Sub\RuntimeBroker.exe	shitka.exe
File created	C:\Windows\xdwdSub\MalwareDef.exe	liberka.exe
File created	C:\Windows\xdwdSub\WindowsUpdate.exe	liberka.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub	xdwdRuntimeBroker.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	xdwdRuntimeBroker.exe
File opened for modification	C:\Windows\Sub	RuntimeBroker.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	RuntimeBroker.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	shitka.exe
File created	C:\Windows\xdwd.dll	shitka.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	liberka.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub	shitka.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	liberka.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6748	cmd.exe
4108	cmd.exe
5476	cmd.exe
3444	cmd.exe
6852	cmd.exe
6428	cmd.exe
4748	cmd.exe
4908	cmd.exe
1608	cmd.exe
4540	cmd.exe
6044	cmd.exe
6792	cmd.exe
7428	cmd.exe
12152	Process not Found
4324	cmd.exe
6284	cmd.exe
6532	cmd.exe
7768	cmd.exe
1340	cmd.exe
6324	cmd.exe
6160	cmd.exe
6676	cmd.exe
11220	Process not Found
3104	cmd.exe
5912	cmd.exe
6508	cmd.exe
6260	cmd.exe
11088	Process not Found
10912	Process not Found
3084	cmd.exe
460	cmd.exe
5596	cmd.exe
7316	cmd.exe
1904	cmd.exe
252	cmd.exe
7728	cmd.exe
7752	cmd.exe
8140	cmd.exe
4300	cmd.exe
8292	cmd.exe
5316	cmd.exe
1420	cmd.exe
6660	cmd.exe
1116	cmd.exe
7764	cmd.exe
7356	cmd.exe
8840	cmd.exe
2328	cmd.exe
7136	cmd.exe
6204	cmd.exe
6584	cmd.exe
8324	cmd.exe
10852	Process not Found
3188	cmd.exe
7744	cmd.exe
8968	cmd.exe
6520	cmd.exe
7324	cmd.exe
4336	cmd.exe
3724	cmd.exe
6928	cmd.exe
7176	cmd.exe
4704	cmd.exe
6604	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe
8100	schtasks.exe
8168	schtasks.exe
3352	schtasks.exe
620	schtasks.exe
7252	schtasks.exe
8808	schtasks.exe
6064	schtasks.exe
1268	schtasks.exe
11132	Process not Found
3064	schtasks.exe
1548	schtasks.exe
8180	schtasks.exe
5992	schtasks.exe
616	schtasks.exe
4968	schtasks.exe
6692	schtasks.exe
7236	schtasks.exe
7628	schtasks.exe
12092	Process not Found
4456	schtasks.exe
3964	schtasks.exe
4548	schtasks.exe
3508	schtasks.exe
6700	schtasks.exe
7280	schtasks.exe
6756	schtasks.exe
2680	schtasks.exe
7408	schtasks.exe
1840	schtasks.exe
1192	schtasks.exe
2232	schtasks.exe
8936	schtasks.exe
10844	Process not Found
1148	schtasks.exe
4288	schtasks.exe
2872	schtasks.exe
9020	schtasks.exe
1800	schtasks.exe
5216	schtasks.exe
3024	schtasks.exe
5108	schtasks.exe
2140	schtasks.exe
6816	schtasks.exe
6472	schtasks.exe
7640	schtasks.exe
1188	schtasks.exe
2008	schtasks.exe
5480	schtasks.exe
5132	schtasks.exe
7044	schtasks.exe
6984	schtasks.exe
11216	Process not Found
11208	Process not Found
3816	schtasks.exe
6176	schtasks.exe
6208	schtasks.exe
7996	schtasks.exe
11116	Process not Found
6184	schtasks.exe
8044	schtasks.exe
8436	schtasks.exe
764	schtasks.exe
6564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe
5328	xdwdRuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	XWorm.exe
Token: SeDebugPrivilege	1212	liberka.exe
Token: SeDebugPrivilege	680	shitka.exe
Token: SeDebugPrivilege	5328	xdwdRuntimeBroker.exe
Token: SeDebugPrivilege	5816	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	5816	MalwareDef.exe
Token: SeDebugPrivilege	4632	MalwareDef.exe
Token: SeDebugPrivilege	6036	RuntimeBroker.exe
Token: SeIncBasePriorityPrivilege	4632	MalwareDef.exe
Token: SeDebugPrivilege	3476	MalwareDef.exe
Token: SeDebugPrivilege	2260	MalwareDef.exe
Token: SeDebugPrivilege	2972	MalwareDef.exe
Token: SeDebugPrivilege	4756	MalwareDef.exe
Token: SeDebugPrivilege	3520	MalwareDef.exe
Token: SeDebugPrivilege	3400	MalwareDef.exe
Token: SeDebugPrivilege	4772	MalwareDef.exe
Token: SeDebugPrivilege	4280	MalwareDef.exe
Token: SeDebugPrivilege	5740	MalwareDef.exe
Token: SeDebugPrivilege	3040	MalwareDef.exe
Token: SeDebugPrivilege	128	MalwareDef.exe
Token: SeDebugPrivilege	5436	MalwareDef.exe
Token: SeDebugPrivilege	1336	MalwareDef.exe
Token: SeDebugPrivilege	3504	MalwareDef.exe
Token: SeDebugPrivilege	3212	MalwareDef.exe
Token: SeDebugPrivilege	1132	MalwareDef.exe
Token: SeDebugPrivilege	4608	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	2260	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3476	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	2972	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4280	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3400	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3520	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4756	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	5740	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4772	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	5436	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	1336	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3212	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3504	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	3040	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4608	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	1132	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	128	MalwareDef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4696	2116	42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe	89
PID 2116 wrote to memory of 1212	2116	42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe	90
PID 2116 wrote to memory of 680	2116	42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe	92
PID 680 wrote to memory of 2108	680	shitka.exe	97
PID 2108 wrote to memory of 4236	2108	CMD.exe	99
PID 680 wrote to memory of 4284	680	shitka.exe	100
PID 1212 wrote to memory of 1428	1212	liberka.exe	102
PID 1212 wrote to memory of 3784	1212	liberka.exe	103
PID 4284 wrote to memory of 3040	4284	CMD.exe	106
PID 3784 wrote to memory of 6104	3784	cmd.exe	108
PID 1212 wrote to memory of 3084	1212	liberka.exe	109
PID 3084 wrote to memory of 1132	3084	cmd.exe	111
PID 1212 wrote to memory of 5816	1212	liberka.exe	114
PID 5816 wrote to memory of 4672	5816	MalwareDef.exe	115
PID 5816 wrote to memory of 1864	5816	MalwareDef.exe	117
PID 4672 wrote to memory of 4996	4672	cmd.exe	119
PID 1864 wrote to memory of 4544	1864	cmd.exe	120
PID 5328 wrote to memory of 6036	5328	xdwdRuntimeBroker.exe	122
PID 4632 wrote to memory of 5100	4632	MalwareDef.exe	123
PID 5816 wrote to memory of 5492	5816	MalwareDef.exe	124
PID 5100 wrote to memory of 4456	5100	cmd.exe	127
PID 5492 wrote to memory of 3492	5492	cmd.exe	128
PID 5816 wrote to memory of 4276	5816	MalwareDef.exe	129
PID 4632 wrote to memory of 4520	4632	MalwareDef.exe	130
PID 4520 wrote to memory of 4228	4520	cmd.exe	133
PID 4276 wrote to memory of 2292	4276	cmd.exe	134
PID 5816 wrote to memory of 4560	5816	MalwareDef.exe	136
PID 4632 wrote to memory of 2452	4632	MalwareDef.exe	135
PID 2452 wrote to memory of 4932	2452	cmd.exe	139
PID 5816 wrote to memory of 1096	5816	MalwareDef.exe	140
PID 4632 wrote to memory of 1876	4632	MalwareDef.exe	141
PID 4560 wrote to memory of 3880	4560	cmd.exe	142
PID 1876 wrote to memory of 1192	1876	cmd.exe	145
PID 1096 wrote to memory of 4708	1096	cmd.exe	146
PID 4632 wrote to memory of 6052	4632	MalwareDef.exe	148
PID 5816 wrote to memory of 2456	5816	MalwareDef.exe	147
PID 6052 wrote to memory of 5940	6052	cmd.exe	151
PID 2456 wrote to memory of 1568	2456	cmd.exe	152
PID 5816 wrote to memory of 2656	5816	MalwareDef.exe	154
PID 4632 wrote to memory of 4928	4632	MalwareDef.exe	153
PID 2656 wrote to memory of 6004	2656	cmd.exe	157
PID 4928 wrote to memory of 5108	4928	cmd.exe	158
PID 4632 wrote to memory of 4872	4632	MalwareDef.exe	159
PID 5816 wrote to memory of 940	5816	MalwareDef.exe	160
PID 4872 wrote to memory of 1380	4872	cmd.exe	163
PID 4632 wrote to memory of 3104	4632	MalwareDef.exe	165
PID 5816 wrote to memory of 5044	5816	MalwareDef.exe	166
PID 940 wrote to memory of 3748	940	cmd.exe	164
PID 5044 wrote to memory of 2608	5044	cmd.exe	169
PID 3104 wrote to memory of 4408	3104	cmd.exe	170
PID 4632 wrote to memory of 2696	4632	MalwareDef.exe	171
PID 5816 wrote to memory of 4108	5816	MalwareDef.exe	172
PID 4108 wrote to memory of 5832	4108	cmd.exe	175
PID 2696 wrote to memory of 5992	2696	cmd.exe	176
PID 4632 wrote to memory of 4312	4632	MalwareDef.exe	178
PID 5816 wrote to memory of 2408	5816	MalwareDef.exe	177
PID 4312 wrote to memory of 2416	4312	cmd.exe	181
PID 2408 wrote to memory of 1012	2408	cmd.exe	182
PID 4632 wrote to memory of 5764	4632	MalwareDef.exe	183
PID 5816 wrote to memory of 5540	5816	MalwareDef.exe	184
PID 5764 wrote to memory of 1572	5764	cmd.exe	187
PID 5540 wrote to memory of 2368	5540	cmd.exe	188
PID 4632 wrote to memory of 4696	4632	MalwareDef.exe	189
PID 5816 wrote to memory of 3184	5816	MalwareDef.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe
"C:\Users\Admin\AppData\Local\Temp\42bca727bb43d8ce5e4746d205367123e9fb576cd955e88e37f1c631aa7395fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\XWorm.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\XWorm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\liberka.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\liberka.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name=")B.TJdhZJ.W5Jy" dir=in action=allow program="C:\Windows\xdwdSub\MalwareDef.exe" enable=yes & exit
    3⤵
    PID:1428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:6104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:1132
- - C:\Windows\xdwdSub\MalwareDef.exe
    "C:\Windows\xdwdSub\MalwareDef.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4996
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4544
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5492
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3492
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3880
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4708
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1568
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6004
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3748
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2608
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5832
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2368
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3184
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1972
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:3708
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2032
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1256
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3496
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4476
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5852
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1512
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3352
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:3304
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4392
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2500
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2968
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:2216
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4440
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1104
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3964
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5344
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3712
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5608
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5956
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5316
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2868
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5912
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3324
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5556
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6184
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2888
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6224
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7016
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:6192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7060
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6200
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6428
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:6976
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4596
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6944
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7148
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:7196
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:252
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7236
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7992
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:8088
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:8068
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:8128
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4700
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:7480
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7180
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7412
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:8080
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5004
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7304
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7456
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:8212
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:8376
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:8292
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:8428
- C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\shitka.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\shitka.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" /RL HIGHEST
      4⤵
      PID:4236
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "RuntimeBroker.exe" /tr "C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe" /RL HIGHEST
      4⤵
      PID:3040

C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\Sub\RuntimeBroker.exe
  "C:\Windows\Sub\RuntimeBroker.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6036

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1192
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4696
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:900
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4516
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4160
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5752
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:724
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1728
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3416
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3428
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1292
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7048
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7092
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7144
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6612
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6808
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7076
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7224
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6900
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7200
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7232
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1480
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8232
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:8324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8420

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1648
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4060
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:884
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4508
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4592
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6340
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6544
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6524
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6660
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6844
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7288
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7424
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7516
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2948
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8092

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2260
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4748
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1412
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:264
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1112
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1220
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5416
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3344
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6244
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6240
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5472
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3140
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6588
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6604
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6348
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4144
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2684
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7348
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5428
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7524
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7492
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7668
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7732

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3256
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4896
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5048
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3124
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1420
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2144
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6368
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6392
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6500
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6884
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6820
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7152
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6420
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7340
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7496
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7684
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7740
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7568
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7588
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7720
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7636
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8048

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3420
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4984
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:624
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5240
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2712
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:580
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5860
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6168
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6772
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6148
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6496
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6988
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6840
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6744
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6568
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7860
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7972
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6592
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7772
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7812
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7884
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7948
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8364

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2128
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4892
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3292
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5360
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3908
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3724
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2492
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6508
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6640
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6620
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7072
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6896
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6484
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7548
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7448
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7376
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7596
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1772
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8124

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3520
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4996
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1140
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1472
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4288
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6804
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6732
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6472
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6232
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1116
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7864
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7824
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8116
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8076
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6720
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7560
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7916
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7712
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7660
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7300
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5820

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1132
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3596
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4804
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7116
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7056
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6748
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6552
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6560
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8112
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6408
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7984
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8016
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5812
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6396
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7644
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7964
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8408
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4628
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8436

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6128
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5132
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3044
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5576
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6624
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6212
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6228
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6676
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6564
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7452
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7592
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7564
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8184
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7796
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8056
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8020
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5784
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1348

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2884
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4880
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2996
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6248
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6316
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6284
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1740
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7276
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7312
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7328
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7508
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7724
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7932
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7760
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8168
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8468
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8524
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8628

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5628
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3232
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5880
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6288
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6372
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6440
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4092
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6264
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1948
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7336
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7408
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7468
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7216
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7228
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7748
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7960
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6536
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7296
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8636
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8664

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2820
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1504
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:300
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4540
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2232
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6908
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6852
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6984
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3192
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6892
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6296
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7956
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7808
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7752
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7584
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7500
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6276
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8032
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7852
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7240
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:9104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:9140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:9156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5776

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2476
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5964
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2588
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:764
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6116
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6456
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6504
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6468
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6328
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6360
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6848
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7484
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7520
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7536
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7184
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7292
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7316
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7396
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7840
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7792
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7332
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7836
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7428
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8684
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8720
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8736
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8808

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2524
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4480
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5348
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6204
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6160
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6400
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6516
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6696
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7120
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6960
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1456
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7108
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8060
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7928
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7544
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8152
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8272
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8444
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8384
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8312

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2900
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5536
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5804
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1592
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3704
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6716
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6788
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6812
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6916
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7024
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6584
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7088
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6260
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7728
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7848
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7552
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7476
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6928
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8928
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:9032
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:9088

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3180
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2328
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1404
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6080
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1340
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3636
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6532
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6608
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6480
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6644
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6600
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7528
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7616
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7676
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7308
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7472
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7652
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6512
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1372
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7872
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8760
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:8840
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8876

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5824
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4820
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5476
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4436
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6740
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6796
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6528
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6692
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6752
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6632
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6728
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6680
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7692
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:7764
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7828
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7640
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7612
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7512
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6196
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4104
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7688
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7908
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:8892
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:8968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:9040

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3432
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4816
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5032
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5760
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:400
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6932
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7004
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5440
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7040
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7112
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6152
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6956
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6992
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7980
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8052
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8144
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7920
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6836
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7756
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7816
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:8140
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7604
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:9172
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8028
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:8204
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7192

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8496

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8476

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8608

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8588

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8560

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8556

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8660

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8528

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8580

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8584

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8548

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8676

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8672

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8652

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8624

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8616

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8772

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8724

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8688

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8716

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8704

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8700

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8852

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8820

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8836

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8764

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8740

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8792

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8788

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8784

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8756

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8752

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8904

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8844

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8860

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8856

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8948

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8964

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8896

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8920

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8916

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9052

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9024

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9044

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9064

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9016

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8988

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9008

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8996

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9012

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8944

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8980

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9096

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9080

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9068

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:4636

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:528

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9152

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9148

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9108

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9124

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9112

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9120

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:1424

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8200

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:5396

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9180

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9196

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:7380

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:7900

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9176

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9212

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:9200

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8412

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:7084

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:8336

C:\Windows\xdwdSub\MalwareDef.exe
"C:\Windows\xdwdSub\MalwareDef.exe"
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XWorm.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\XWorm.exe
Size 40KB
SHA256 42accc543372058532b20b6d9b22e254dd748405d4986a74a675caead837a424
MD5 6fa9a9bdd2668e26be9fe237fdb2c1b5
SHA1 4387193913bb30f29c147b14155b421785bf543d
SHA512 e866154e3b73d7c7f946ef5929c69fdf7ca7f1130d86113b981fe7666cd9261dfc7c08c7505bc72194e7c857ec02907e531fda470ff01f851531185a1b3cd8d4
SSDEEP 768:iUapfagX2JYnXcBw5dRFk9uXt6iOwhiL0PVEo:isc8YnXcBw5TFk96t6iOwEeVEo
TLSH
T1FB135C087BE48525D5FE6B7558B2660B0731E6039917E75E0CE486AE2F3B6C1CE007E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liberka.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\liberka.exe
Size 643KB
SHA256 108ed24925de57fc9c0c26d727d7b2c96cdba9e8cf056b18756e1ce71427ab42
MD5 059e6e97415cb9ad5c8a764b051904ac
SHA1 15630867e6cf16ad2cc276e1041bd8b27f42766f
SHA512 af8dbbba20a4fec8640543582e635ed7b35d8efe5ecaeb269007780aaa61a7e0e58097604eda2476c107b7f04cc877b476dbd4b46467db688f9c076b77c19651
SSDEEP 12288:ZRC4MXpozo7BYb5Zpi6aRSzThcZ7g9R56i7QUiS:ZU4WpozoVO5kRSzThB9R56i7L
TLSH
T123E4A1247FB5AA0AE5585A3D42DB0510E7AA11E123337347374BBE620D01BDEED6C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shitka.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_e020ddaa\shitka.exe
Size 673KB
SHA256 dbc5ee03828ffe6da2bdf4d164c285ce3d0c7e12551b73c97c53929d615dc7ab
MD5 add00161df72fa6e1da44b41c3643dae
SHA1 93e598a6cdeca5b169f266b4a43aea6a5b5542de
SHA512 edafdb132bdd0b5b4c694d944ffc4df60aa937b499219e0bbe8a6b23948a40c41cc1450ba2fb20e400ede3527f9a22f0c642c20ef4a880acc46242a5d6cba3f8
SSDEEP 6144:hG3tYGs0COF6+iMFtfOVMmxb5F3Lb3r2092IRxgPWFvbLBiJ2Jwgm3CmQ+6t2Wx3:Q3W0COvcX3H3BkKw2JyQ5t2EduG
TLSH
T1E9E4A30CFD51FC15CE6E3DB38BE290A11B3110C63E629116370A6FFA9B643B659A217D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/128-343-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/528-365-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/680-31-0x0000000000020000-0x00000000000CE000-memory.dmp

Download

memory/1132-338-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/1212-226-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/1212-282-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/1212-22-0x0000000000F80000-0x0000000001026000-memory.dmp

Download

memory/1212-42-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/1212-41-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/1336-346-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/1424-372-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/2116-6-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/2116-1-0x00000000005A0000-0x000000000073C000-memory.dmp

Download

memory/2116-23-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/2116-32-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/2116-34-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/2116-0-0x00007FFC471BF000-0x00007FFC471C0000-memory.dmp

Download

memory/2116-5-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/2260-333-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/2972-334-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3040-342-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3212-347-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3400-336-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3476-332-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3504-345-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/3520-337-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4280-339-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4292-388-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4608-348-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4632-300-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4632-288-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4636-364-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4696-39-0x000000001B520000-0x000000001B610000-memory.dmp

Download

memory/4696-33-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-36-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-14-0x00000000002F0000-0x0000000000300000-memory.dmp

Download

memory/4696-37-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-35-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-225-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-40-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4696-38-0x00007FFC47030000-0x00007FFC479D4000-memory.dmp

Download

memory/4756-335-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/4772-341-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5328-261-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5328-280-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5328-290-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5396-383-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5436-344-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5740-340-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5816-295-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/5816-281-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/7084-394-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/7380-378-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/7600-396-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/7900-389-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8200-370-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8336-384-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8356-399-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8412-395-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8476-351-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8496-374-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8528-391-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8560-398-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8588-397-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8608-373-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8820-349-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8856-350-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8896-375-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8916-379-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8920-352-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8944-385-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8948-377-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8964-376-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8980-360-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8988-357-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/8996-359-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9008-358-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9012-381-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9016-356-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9024-353-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9044-355-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9052-380-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9064-354-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9068-363-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9080-361-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9096-362-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9108-367-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9112-371-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9120-369-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9124-382-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9148-368-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9152-366-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9176-392-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9180-386-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9196-387-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9200-393-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download

memory/9212-390-0x00007FFC59410000-0x00007FFC59432000-memory.dmp

Download