Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
60s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/10/2026, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
full.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
300 seconds
General
- Target full.exe
- Size 509KB
- Sample261013-vbvmtsw17r
- SHA256 4901dcff7ba81e29793f528db28bdfcba5d1c6b02e2793206295d72b8a3ab07b
- MD5 02661ede9275584761f0a7140e678182
- SHA1 f9c7ee2c7d56d4cd6df3ca857df5fd086eb353bc
- SHA512 d100b937317d1140062f34b7bdce00269221f9a3aed89fbbcd8d8342bdaed9a6730de5fc9bfd84f82861996915d4e2345e9161256d982301317ce8716c070c24
- SSDEEP 6144:ppjg54fgeGii8k23yWkxXo5NtcT0UqqG5t8pVqEdjjGNl7opKQayfgGVbokbWNR2:Lg2oUkeyZxXo5z2rqqG5+1AyfTbVo2
- TLSH T126B429147F998E08E480267E455E1A09DBAED1F225327303770AEF620D45DDEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe" full.exe - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation full.exe - Executes dropped EXE 4 IoCs
pid Process 1008 xdwdMalwareDef.exe 4248 xdwdDefender.exe 3000 xdwdDefender.exe 376 xdwdDefender.exe - Loads dropped DLL 12 IoCs
pid Process 4316 Process not Found 4672 Process not Found 1008 xdwdMalwareDef.exe 4248 xdwdDefender.exe 3000 xdwdDefender.exe 2512 Process not Found 3992 Process not Found 2500 Process not Found 2904 Process not Found 2596 taskmgr.exe 376 xdwdDefender.exe 4908 Process not Found - Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 api.ipify.org 24 api.ipify.org 47 api.ipify.org 6 api.ipify.org 7 api.ipify.org 20 api.ipify.org - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\xdwdDefender.exe full.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdMalwareDef.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File opened for modification C:\Windows\System32\xdwdDefender.exe xdwdDefender.exe File created C:\Windows\System32\xdwdDefender.exe full.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Web\xdwdMalwareDef.exe full.exe File created C:\Windows\xdwd.dll full.exe File opened for modification C:\Windows\xdwd.dll full.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdMalwareDef.exe File opened for modification C:\Windows\Web\xdwdMalwareDef.exe xdwdDefender.exe File created C:\Windows\Web\xdwdMalwareDef.exe full.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 452 cmd.exe 1796 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain full.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xdwdMalwareDef.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xdwdMalwareDef.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain xdwdDefender.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname full.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4000 schtasks.exe 100 schtasks.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3352 full.exe Token: SeDebugPrivilege 1008 xdwdMalwareDef.exe Token: SeDebugPrivilege 4248 xdwdDefender.exe Token: SeDebugPrivilege 3000 xdwdDefender.exe Token: SeIncBasePriorityPrivilege 4248 xdwdDefender.exe Token: SeDebugPrivilege 2596 taskmgr.exe Token: SeSystemProfilePrivilege 2596 taskmgr.exe Token: SeCreateGlobalPrivilege 2596 taskmgr.exe Token: SeDebugPrivilege 376 xdwdDefender.exe Token: 33 2596 taskmgr.exe Token: SeIncBasePriorityPrivilege 2596 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe 2596 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4856 3352 full.exe 91 PID 3352 wrote to memory of 452 3352 full.exe 92 PID 452 wrote to memory of 4000 452 cmd.exe 95 PID 3352 wrote to memory of 1796 3352 full.exe 96 PID 1796 wrote to memory of 100 1796 cmd.exe 98 PID 3352 wrote to memory of 3000 3352 full.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\full.exe"C:\Users\Admin\AppData\Local\Temp\full.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="(h?S7\z!7?YT7G" dir=in action=allow program="C:\Windows\System32\xdwdDefender.exe" enable=yes & exit2⤵PID:4856
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4000
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:100
-
-
-
C:\Windows\System32\xdwdDefender.exe"C:\Windows\System32\xdwdDefender.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\Web\xdwdMalwareDef.exeC:\Windows\Web\xdwdMalwareDef.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
C:\Windows\System32\xdwdDefender.exeC:\Windows\System32\xdwdDefender.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596
-
C:\Windows\System32\xdwdDefender.exeC:\Windows\System32\xdwdDefender.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:376
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdDefender.exe.log
- Size 1KB
- SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
- MD5 f26118d675c61402c218ac6794d90a63
- SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
- SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
- TLSH T17411CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\xdwdDefender.exe
- Size 509KB
- SHA256 4901dcff7ba81e29793f528db28bdfcba5d1c6b02e2793206295d72b8a3ab07b
- MD5 02661ede9275584761f0a7140e678182
- SHA1 f9c7ee2c7d56d4cd6df3ca857df5fd086eb353bc
- SHA512 d100b937317d1140062f34b7bdce00269221f9a3aed89fbbcd8d8342bdaed9a6730de5fc9bfd84f82861996915d4e2345e9161256d982301317ce8716c070c24
- SSDEEP 6144:ppjg54fgeGii8k23yWkxXo5NtcT0UqqG5t8pVqEdjjGNl7opKQayfgGVbokbWNR2:Lg2oUkeyZxXo5z2rqqG5+1AyfTbVo2
- TLSH T126B429147F998E08E480267E455E1A09DBAED1F225327303770AEF620D45DDEDE2D3EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\xdwd.dll
- Size 136KB
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH