5960275e53b4e9317452a9e745ac8c745044099df022342292ceb35b7162ec05

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AntimalwareServiceExecutable.exe
Size 530KB
Sample260930-pcrdxatt8r
SHA256 5960275e53b4e9317452a9e745ac8c745044099df022342292ceb35b7162ec05
MD5 17e54a7d867d5a84370848d45b6089e1
SHA1 7c2227b1b1c002f6a40381b275c4a46f2f7abec8
SHA512 aad5d31769592a5958484540a4949fa31b603cdf3554a5b9a78c569c05d1899e89dd0d84fe0dd0c027a58c2aa2a5eb0d7a931e55708a1c76eb4d0dc36e635302
SSDEEP 12288:V+HKkF3mvjqoVIp3y6PVle8MQ8nqvH3uhCuH3ZKH5bBpCM/:VL+zX8nqvH3uguJQ5Ll
TLSH
T12DB4C60CFE81E806CD2A3E77CEF914044B7122C16F228A573219AFFD976537259A667C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdWindowsDefender.exe"	AntimalwareServiceExecutable.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
2344	xdwdWindowsDefender.exe
300	xdwdExplorer.exe
2568	xdwdExplorer.exe

Loads dropped DLL 49 IoCs

pid	Process
2096	Process not Found
2344	xdwdWindowsDefender.exe
4188	Process not Found
1784	Process not Found
2968	Process not Found
300	xdwdExplorer.exe
2568	xdwdExplorer.exe
5232	Process not Found
1236	Process not Found
2180	Process not Found
3372	Process not Found
1728	Process not Found
2116	Process not Found
1112	Process not Found
5532	Process not Found
4540	Process not Found
2612	Process not Found
2204	Process not Found
4484	Process not Found
2472	Process not Found
2680	Process not Found
6060	Process not Found
3132	Process not Found
2524	Process not Found
2380	Process not Found
6100	Process not Found
3420	Process not Found
4444	Process not Found
3952	Process not Found
3224	Process not Found
1172	Process not Found
5232	Process not Found
5652	Process not Found
4804	Process not Found
5212	Process not Found
2820	Process not Found
1160	Process not Found
1460	Process not Found
2724	Process not Found
2204	Process not Found
6032	Process not Found
568	Process not Found
1856	Process not Found
2992	Process not Found
2904	Process not Found
2984	Process not Found
1544	Process not Found
3496	Process not Found
4796	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntimalwareServiceExecutable = "C:\\Windows\\System32/xdwdExplorer.exe"	AntimalwareServiceExecutable.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\xdwdWindowsDefender.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdExplorer.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdWindowsDefender.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	xdwdWindowsDefender.exe
File created	C:\Windows\System32\xdwdExplorer.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdExplorer.exe	AntimalwareServiceExecutable.exe
File opened for modification	C:\Windows\System32\xdwdWindowsDefender.exe	xdwdExplorer.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32	xdwdExplorer.exe
File opened for modification	C:\Windows\System32	xdwdExplorer.exe
File opened for modification	C:\Windows\System32	xdwdWindowsDefender.exe
File opened for modification	C:\Windows\System32	AntimalwareServiceExecutable.exe
File created	C:\Windows\xdwd.dll	AntimalwareServiceExecutable.exe

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4332	CMD.exe
1844	CMD.exe
1480	CMD.exe
5288	CMD.exe
5316	CMD.exe
5372	CMD.exe
5732	CMD.exe
4284	CMD.exe
2540	CMD.exe
1212	CMD.exe
4140	CMD.exe
3204	CMD.exe
4860	CMD.exe
5364	CMD.exe
1812	CMD.exe
4148	CMD.exe
4344	CMD.exe
2748	CMD.exe
4848	CMD.exe
3616	CMD.exe
1116	CMD.exe
5932	CMD.exe
2932	CMD.exe
4188	CMD.exe
4720	CMD.exe
4568	CMD.exe
2508	CMD.exe
1768	CMD.exe
4908	CMD.exe
1744	CMD.exe
4408	CMD.exe
1276	CMD.exe
4392	CMD.exe
2432	CMD.exe
5756	CMD.exe
1876	CMD.exe
4692	CMD.exe
4192	CMD.exe
1776	CMD.exe
2816	CMD.exe
4884	CMD.exe
5420	CMD.exe
3532	CMD.exe
2912	CMD.exe
5520	CMD.exe
1176	CMD.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdWindowsDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdExplorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdExplorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AntimalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AntimalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdExplorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdExplorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdWindowsDefender.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4552	schtasks.exe
5400	schtasks.exe
5364	schtasks.exe
5520	schtasks.exe
1512	schtasks.exe
3740	schtasks.exe
1912	schtasks.exe
3364	schtasks.exe
4292	schtasks.exe
4976	schtasks.exe
4552	schtasks.exe
5400	schtasks.exe
1960	schtasks.exe
5772	schtasks.exe
2896	schtasks.exe
4616	schtasks.exe
2360	schtasks.exe
348	schtasks.exe
5012	schtasks.exe
1592	schtasks.exe
3980	schtasks.exe
1308	schtasks.exe
4528	schtasks.exe
5916	schtasks.exe
2116	schtasks.exe
5112	schtasks.exe
3892	schtasks.exe
6096	schtasks.exe
4196	schtasks.exe
2088	schtasks.exe
5284	schtasks.exe
3952	schtasks.exe
5716	schtasks.exe
5904	schtasks.exe
5948	schtasks.exe
4408	schtasks.exe
2224	schtasks.exe
5688	schtasks.exe
4240	schtasks.exe
2808	schtasks.exe
4172	schtasks.exe
3388	schtasks.exe
2592	schtasks.exe
5228	schtasks.exe
4124	schtasks.exe
2680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe
1596	AntimalwareServiceExecutable.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	AntimalwareServiceExecutable.exe
Token: SeDebugPrivilege	2344	xdwdWindowsDefender.exe
Token: SeDebugPrivilege	300	xdwdExplorer.exe
Token: SeDebugPrivilege	2568	xdwdExplorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4884	1596	AntimalwareServiceExecutable.exe	89
PID 4884 wrote to memory of 4552	4884	CMD.exe	91
PID 1596 wrote to memory of 1116	1596	AntimalwareServiceExecutable.exe	92
PID 1116 wrote to memory of 2896	1116	CMD.exe	94
PID 1596 wrote to memory of 4284	1596	AntimalwareServiceExecutable.exe	96
PID 4284 wrote to memory of 5400	4284	CMD.exe	99
PID 1596 wrote to memory of 1480	1596	AntimalwareServiceExecutable.exe	100
PID 1480 wrote to memory of 3952	1480	CMD.exe	102
PID 1596 wrote to memory of 4720	1596	AntimalwareServiceExecutable.exe	107
PID 4720 wrote to memory of 5716	4720	CMD.exe	109
PID 1596 wrote to memory of 2432	1596	AntimalwareServiceExecutable.exe	110
PID 2432 wrote to memory of 5364	2432	CMD.exe	112
PID 1596 wrote to memory of 2540	1596	AntimalwareServiceExecutable.exe	114
PID 2540 wrote to memory of 5520	2540	CMD.exe	116
PID 1596 wrote to memory of 5288	1596	AntimalwareServiceExecutable.exe	117
PID 5288 wrote to memory of 1512	5288	CMD.exe	119
PID 300 wrote to memory of 1212	300	xdwdExplorer.exe	120
PID 2568 wrote to memory of 4140	2568	xdwdExplorer.exe	122
PID 1212 wrote to memory of 5904	1212	CMD.exe	124
PID 4140 wrote to memory of 1592	4140	CMD.exe	125
PID 2344 wrote to memory of 3204	2344	xdwdWindowsDefender.exe	126
PID 300 wrote to memory of 1276	300	xdwdExplorer.exe	128
PID 2568 wrote to memory of 5756	2568	xdwdExplorer.exe	130
PID 2344 wrote to memory of 4148	2344	xdwdWindowsDefender.exe	132
PID 3204 wrote to memory of 3980	3204	CMD.exe	134
PID 1276 wrote to memory of 1308	1276	CMD.exe	135
PID 5756 wrote to memory of 6096	5756	CMD.exe	136
PID 4148 wrote to memory of 4240	4148	CMD.exe	137
PID 1596 wrote to memory of 4568	1596	AntimalwareServiceExecutable.exe	138
PID 4568 wrote to memory of 4292	4568	CMD.exe	140
PID 1596 wrote to memory of 1876	1596	AntimalwareServiceExecutable.exe	141
PID 1876 wrote to memory of 4616	1876	CMD.exe	143
PID 1596 wrote to memory of 4692	1596	AntimalwareServiceExecutable.exe	144
PID 4692 wrote to memory of 5948	4692	CMD.exe	146
PID 1596 wrote to memory of 5932	1596	AntimalwareServiceExecutable.exe	147
PID 5932 wrote to memory of 4528	5932	CMD.exe	149
PID 1596 wrote to memory of 5420	1596	AntimalwareServiceExecutable.exe	150
PID 5420 wrote to memory of 4408	5420	CMD.exe	152
PID 1596 wrote to memory of 3532	1596	AntimalwareServiceExecutable.exe	153
PID 3532 wrote to memory of 2808	3532	CMD.exe	155
PID 1596 wrote to memory of 2932	1596	AntimalwareServiceExecutable.exe	156
PID 2932 wrote to memory of 4976	2932	CMD.exe	158
PID 1596 wrote to memory of 2912	1596	AntimalwareServiceExecutable.exe	159
PID 2912 wrote to memory of 2224	2912	CMD.exe	161
PID 1596 wrote to memory of 2508	1596	AntimalwareServiceExecutable.exe	162
PID 2508 wrote to memory of 4552	2508	CMD.exe	164
PID 1596 wrote to memory of 4344	1596	AntimalwareServiceExecutable.exe	165
PID 4344 wrote to memory of 5400	4344	CMD.exe	167
PID 1596 wrote to memory of 5316	1596	AntimalwareServiceExecutable.exe	168
PID 5316 wrote to memory of 2592	5316	CMD.exe	170
PID 1596 wrote to memory of 1768	1596	AntimalwareServiceExecutable.exe	171
PID 1768 wrote to memory of 3740	1768	CMD.exe	173
PID 1596 wrote to memory of 4188	1596	AntimalwareServiceExecutable.exe	174
PID 4188 wrote to memory of 4172	4188	CMD.exe	176
PID 1596 wrote to memory of 4908	1596	AntimalwareServiceExecutable.exe	177
PID 4908 wrote to memory of 5916	4908	CMD.exe	179
PID 1596 wrote to memory of 4860	1596	AntimalwareServiceExecutable.exe	180
PID 4860 wrote to memory of 1912	4860	CMD.exe	182
PID 1596 wrote to memory of 5364	1596	AntimalwareServiceExecutable.exe	183
PID 5364 wrote to memory of 2360	5364	CMD.exe	185
PID 1596 wrote to memory of 1744	1596	AntimalwareServiceExecutable.exe	186
PID 1744 wrote to memory of 5228	1744	CMD.exe	188
PID 1596 wrote to memory of 5520	1596	AntimalwareServiceExecutable.exe	189
PID 5520 wrote to memory of 4196	5520	CMD.exe	191

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AntimalwareServiceExecutable.exe
"C:\Users\Admin\AppData\Local\Temp\AntimalwareServiceExecutable.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "ExplorerHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "ExplorerHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "ProcessorCoreHost" /tr "C:\Windows\System32\xdwdExplorer.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "ProcessorCoreHost" /tr "C:\Windows\System32\xdwdExplorer.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5716
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5688

C:\Windows\System32\xdwdWindowsDefender.exe
C:\Windows\System32\xdwdWindowsDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4240

C:\Windows\System32\xdwdExplorer.exe
C:\Windows\System32\xdwdExplorer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308

C:\Windows\System32\xdwdExplorer.exe
C:\Windows\System32/xdwdExplorer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "WindowsSearchHost" /tr "C:\Windows\System32\xdwdWindowsDefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdWindowsDefender.exe

Path C:\Windows\System32\xdwdWindowsDefender.exe
Size 530KB
SHA256 5960275e53b4e9317452a9e745ac8c745044099df022342292ceb35b7162ec05
MD5 17e54a7d867d5a84370848d45b6089e1
SHA1 7c2227b1b1c002f6a40381b275c4a46f2f7abec8
SHA512 aad5d31769592a5958484540a4949fa31b603cdf3554a5b9a78c569c05d1899e89dd0d84fe0dd0c027a58c2aa2a5eb0d7a931e55708a1c76eb4d0dc36e635302
SSDEEP 12288:V+HKkF3mvjqoVIp3y6PVle8MQ8nqvH3uhCuH3ZKH5bBpCM/:VL+zX8nqvH3uguJQ5Ll
TLSH
T12DB4C60CFE81E806CD2A3E77CEF914044B7122C16F228A573219AFFD976537259A667C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-0-0x00007FF9DC1DF000-0x00007FF9DC1E0000-memory.dmp

Download

memory/1596-1-0x00000000009F0000-0x0000000000A78000-memory.dmp

Download

memory/1596-2-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-3-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-4-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-5-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-6-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-35-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download

memory/1596-77-0x00007FF9DC050000-0x00007FF9DC9F4000-memory.dmp

Download