sheetrat | b790035d175e34b5198f379ae6c876cf9d083cb29024616ed194e99b964ccfd5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 2.1MB
Sample261102-t4eawaxx4m
SHA256 b790035d175e34b5198f379ae6c876cf9d083cb29024616ed194e99b964ccfd5
MD5 5fb2fad21e08bcce1f9bed1bf638bbf3
SHA1 e7230e0fd5b6ddff996e74c1d475f7ac468d9910
SHA512 4c99bef46772de7563658c7305f1534f72bc97ae206c455b91b154de7fb0afc0354617b9519aa7934c57adc4d765089cd0cb9c67bdab649ced9d03788446ce8a
SSDEEP 24576:/s7FuGmUT6LpKe0bBZYP7AsVoz+0rXHOFYag734uibuP6sZmm3:+u0AoBA7RM+QOFHgTdFM
TLSH
T1C9A518187FA0A905D9592A7E86EA1110C77250D12B33A3073707BEF64E107EEDD693FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution sheetrat xorium_stealer xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

sheetrat

Version

0.cantdown.su:1786

Extracted

Family

xworm

Version

XWorm V7.1

0.cantdown.su:1786

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

Extracted

Family

sheetrat

Version

2.6.4

0.cantdown.su:1786

Extracted

Family

xorium_stealer

https://api.telegram.org/bot9118041330:AAElT-04bLVLm-NIlansJOqxJpKziXEjPJI/sendDocument

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
stealer xorium_stealer
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2196-0-0x0000000000F40000-0x000000000115C000-memory.dmp	family_xworm
behavioral2/files/0x001a00000002b457-30.dat	family_xworm
behavioral2/memory/2300-38-0x00000000007E0000-0x00000000007F8000-memory.dmp	family_xworm

Detects Sheetrat obfuscated V1.8 and higher 4 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x001b00000002b38e-26.dat	family_sheetrat_v4
behavioral2/memory/2772-27-0x00000000001F0000-0x0000000000272000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x001900000002b458-41.dat	family_sheetrat_v4
behavioral2/memory/5172-51-0x0000000000CC0000-0x0000000000D6A000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 3 IoCs

resource	yara_rule
behavioral2/memory/2196-0-0x0000000000F40000-0x000000000115C000-memory.dmp	Sheetrat_v5
behavioral2/files/0x001900000002b458-41.dat	Sheetrat_v5
behavioral2/memory/5172-51-0x0000000000CC0000-0x0000000000D6A000-memory.dmp	Sheetrat_v5

Detects XoriumStealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/2196-0-0x0000000000F40000-0x000000000115C000-memory.dmp	family_xorium_stealer
behavioral2/files/0x001900000002b459-54.dat	family_xorium_stealer
behavioral2/memory/2132-62-0x000001E4F69C0000-0x000001E4F6A02000-memory.dmp	family_xorium_stealer

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	BPVSlN0GICnKGKOy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe"	xdwdDefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe"	xdwdDefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\RuntimeBroker.exe"	Client1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe"	3u5d33denthmt5zf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\System32\\xdwdDefender.exe"	xdwdDefender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSub\\MalwareDef.exe"	MalwareDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\RuntimeBroker.exe"	RuntimeBroker.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 43 IoCs

pid	Process
1412	BPVSlN0GICnKGKOy.exe
2772	3u5d33denthmt5zf.exe
2300	XWormClient.exe
5172	Client1.exe
2132	plikan.exe
6068	RuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
5760	MalwareDef.exe
4808	xdwdDefender.exe
2348	xdwdMalwareDef.exe
4700	xdwdDefender.exe
2836	MalwareDef.exe
5792	MalwareDef.exe
6056	MalwareDef.exe
5388	MalwareDef.exe
3192	MalwareDef.exe
5888	xdwdDefender.exe
1680	MalwareDef.exe
5776	MalwareDef.exe
4896	MalwareDef.exe
6120	MalwareDef.exe
5892	MalwareDef.exe
2432	MalwareDef.exe
1108	MalwareDef.exe
3996	MalwareDef.exe
4696	MalwareDef.exe
4220	MalwareDef.exe
3004	MalwareDef.exe
3280	MalwareDef.exe
3616	MalwareDef.exe
5772	MalwareDef.exe
4760	MalwareDef.exe
1464	MalwareDef.exe
2344	MalwareDef.exe
6008	MalwareDef.exe
1416	MalwareDef.exe
2492	MalwareDef.exe
1436	MalwareDef.exe
1660	xdwdDefender.exe
4244	MalwareDef.exe
2236	MalwareDef.exe
5676	MalwareDef.exe
5052	MalwareDef.exe

Loads dropped DLL 64 IoCs

pid	Process
5420	Process not Found
5376	Process not Found
5528	Process not Found
5696	Process not Found
5704	Process not Found
2560	Process not Found
2180	Process not Found
1020	Process not Found
4380	xdwdRuntimeBroker.exe
4620	Process not Found
5760	MalwareDef.exe
4808	xdwdDefender.exe
4396	Process not Found
1040	Process not Found
2348	xdwdMalwareDef.exe
4700	xdwdDefender.exe
1108	Process not Found
5080	Process not Found
4208	Process not Found
3992	Process not Found
4708	Process not Found
476	Process not Found
5384	Process not Found
5708	Process not Found
5608	Process not Found
244	Process not Found
2836	MalwareDef.exe
4116	Process not Found
2680	Process not Found
5792	MalwareDef.exe
6056	MalwareDef.exe
5388	MalwareDef.exe
3192	MalwareDef.exe
5888	xdwdDefender.exe
1680	MalwareDef.exe
2884	Process not Found
1844	Process not Found
2320	Process not Found
3384	Process not Found
5152	Process not Found
5148	Process not Found
4320	Process not Found
6000	Process not Found
1144	Process not Found
1884	Process not Found
5320	Process not Found
3280	Process not Found
1464	Process not Found
2492	Process not Found
5704	Process not Found
2080	Process not Found
4212	Process not Found
5332	Process not Found
4364	Process not Found
2496	Process not Found
5620	Process not Found
5328	Process not Found
496	Process not Found
5800	Process not Found
5564	Process not Found
1424	Process not Found
5744	Process not Found
5804	Process not Found
4540	Process not Found

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	plikan.exe
Key opened	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	plikan.exe
Key opened	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	plikan.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Sub\\xdwdRuntimeBroker.exe"	Client1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
1	ip-api.com

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\xdwdDefender.exe	3u5d33denthmt5zf.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File opened for modification	C:\Windows\System32\xdwdDefender.exe	xdwdDefender.exe
File created	C:\Windows\System32\xdwdDefender.exe	3u5d33denthmt5zf.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Sub	RuntimeBroker.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File created	C:\Windows\xdwd.dll	Client1.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File created	C:\Windows\Sub\RuntimeBroker.exe	Client1.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File created	C:\Windows\xdwdSub\MalwareDef.exe	BPVSlN0GICnKGKOy.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	BPVSlN0GICnKGKOy.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub	xdwdRuntimeBroker.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File created	C:\Windows\xdwdSub\WindowsUpdate.exe	BPVSlN0GICnKGKOy.exe
File opened for modification	C:\Windows\Sub\RuntimeBroker.exe	xdwdRuntimeBroker.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Sub	Client1.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\MalwareDef.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\Web\xdwdMalwareDef.exe	xdwdDefender.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe
File opened for modification	C:\Windows\xdwdSub\WindowsUpdate.exe	MalwareDef.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4640	cmd.exe
4988	cmd.exe
3388	cmd.exe
3304	cmd.exe
2072	cmd.exe
5372	cmd.exe
2212	cmd.exe
6540	cmd.exe
5972	cmd.exe
3952	cmd.exe
2508	cmd.exe
6176	cmd.exe
2500	CMD.exe
3888	cmd.exe
1768	cmd.exe
3916	cmd.exe
6964	cmd.exe
3508	cmd.exe
1564	cmd.exe
4796	cmd.exe
4692	cmd.exe
6232	cmd.exe
5480	cmd.exe
5740	cmd.exe
5032	cmd.exe
6248	cmd.exe
5980	cmd.exe
4728	cmd.exe
4052	cmd.exe
2712	cmd.exe
6264	cmd.exe
5752	cmd.exe
1432	cmd.exe
6372	cmd.exe
2124	cmd.exe
4416	cmd.exe
3620	cmd.exe
4848	cmd.exe
4928	cmd.exe
5864	cmd.exe
6196	cmd.exe
6364	cmd.exe
1556	cmd.exe
5944	cmd.exe
3380	cmd.exe
5096	cmd.exe
6756	cmd.exe
6288	cmd.exe
2244	cmd.exe
2532	cmd.exe
2572	cmd.exe
6572	cmd.exe
6916	cmd.exe
5748	cmd.exe
2428	cmd.exe
6064	cmd.exe
1684	cmd.exe
5592	cmd.exe
3244	cmd.exe
3852	cmd.exe
1676	cmd.exe
5400	cmd.exe
5340	cmd.exe
1240	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3u5d33denthmt5zf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XWormClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdRuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	plikan.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3u5d33denthmt5zf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdMalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdMalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BPVSlN0GICnKGKOy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xdwdDefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3800	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	plikan.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	plikan.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5816	schtasks.exe
6236	schtasks.exe
6724	schtasks.exe
4396	schtasks.exe
2528	schtasks.exe
6072	schtasks.exe
3384	schtasks.exe
440	schtasks.exe
6220	schtasks.exe
2672	schtasks.exe
3904	schtasks.exe
3020	schtasks.exe
2460	schtasks.exe
1352	schtasks.exe
2412	schtasks.exe
972	schtasks.exe
6752	schtasks.exe
4472	schtasks.exe
2804	schtasks.exe
896	schtasks.exe
5904	schtasks.exe
5160	schtasks.exe
5156	schtasks.exe
5884	schtasks.exe
432	schtasks.exe
2312	schtasks.exe
4912	schtasks.exe
2672	schtasks.exe
3876	schtasks.exe
5080	schtasks.exe
6604	schtasks.exe
5164	schtasks.exe
5104	schtasks.exe
5948	schtasks.exe
1572	schtasks.exe
4572	schtasks.exe
6552	schtasks.exe
4168	schtasks.exe
3428	schtasks.exe
1772	schtasks.exe
7108	schtasks.exe
6004	schtasks.exe
3852	schtasks.exe
5556	schtasks.exe
2768	schtasks.exe
4952	schtasks.exe
3544	schtasks.exe
5236	schtasks.exe
6664	schtasks.exe
3940	schtasks.exe
4352	schtasks.exe
1192	schtasks.exe
5320	schtasks.exe
4904	schtasks.exe
1360	schtasks.exe
4916	schtasks.exe
6288	schtasks.exe
1064	schtasks.exe
5900	schtasks.exe
1356	schtasks.exe
6296	schtasks.exe
6512	schtasks.exe
6240	schtasks.exe
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2132	plikan.exe
2132	plikan.exe
2132	plikan.exe
2132	plikan.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe
4380	xdwdRuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	BPVSlN0GICnKGKOy.exe
Token: SeDebugPrivilege	2772	3u5d33denthmt5zf.exe
Token: SeDebugPrivilege	2300	XWormClient.exe
Token: SeDebugPrivilege	5172	Client1.exe
Token: SeDebugPrivilege	2132	plikan.exe
Token: SeDebugPrivilege	2132	plikan.exe
Token: SeDebugPrivilege	2132	plikan.exe
Token: SeDebugPrivilege	6068	RuntimeBroker.exe
Token: SeDebugPrivilege	4380	xdwdRuntimeBroker.exe
Token: SeDebugPrivilege	5760	MalwareDef.exe
Token: SeDebugPrivilege	4808	xdwdDefender.exe
Token: SeDebugPrivilege	2348	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4700	xdwdDefender.exe
Token: SeIncBasePriorityPrivilege	5760	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4808	xdwdDefender.exe
Token: SeDebugPrivilege	2836	MalwareDef.exe
Token: SeDebugPrivilege	5792	MalwareDef.exe
Token: SeDebugPrivilege	6056	MalwareDef.exe
Token: SeDebugPrivilege	5388	MalwareDef.exe
Token: SeDebugPrivilege	5888	xdwdDefender.exe
Token: SeDebugPrivilege	3192	MalwareDef.exe
Token: SeDebugPrivilege	1680	MalwareDef.exe
Token: SeDebugPrivilege	5776	MalwareDef.exe
Token: SeDebugPrivilege	4896	MalwareDef.exe
Token: SeDebugPrivilege	5892	MalwareDef.exe
Token: SeDebugPrivilege	6120	MalwareDef.exe
Token: SeDebugPrivilege	2432	MalwareDef.exe
Token: SeDebugPrivilege	3996	MalwareDef.exe
Token: SeDebugPrivilege	3004	MalwareDef.exe
Token: SeDebugPrivilege	1108	MalwareDef.exe
Token: SeDebugPrivilege	4220	MalwareDef.exe
Token: SeDebugPrivilege	3616	MalwareDef.exe
Token: SeDebugPrivilege	2236	MalwareDef.exe
Token: SeDebugPrivilege	4760	MalwareDef.exe
Token: SeDebugPrivilege	1464	MalwareDef.exe
Token: SeDebugPrivilege	2344	MalwareDef.exe
Token: SeDebugPrivilege	6008	MalwareDef.exe
Token: SeDebugPrivilege	2492	MalwareDef.exe
Token: SeDebugPrivilege	1660	xdwdDefender.exe
Token: SeDebugPrivilege	1436	MalwareDef.exe
Token: SeDebugPrivilege	3280	MalwareDef.exe
Token: SeDebugPrivilege	5052	MalwareDef.exe
Token: SeDebugPrivilege	1416	MalwareDef.exe
Token: SeDebugPrivilege	4696	MalwareDef.exe
Token: SeDebugPrivilege	5772	MalwareDef.exe
Token: SeDebugPrivilege	5676	MalwareDef.exe
Token: SeDebugPrivilege	4244	MalwareDef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1412	2196	Nursultan.exe	81
PID 2196 wrote to memory of 2772	2196	Nursultan.exe	83
PID 2196 wrote to memory of 2300	2196	Nursultan.exe	84
PID 2196 wrote to memory of 5172	2196	Nursultan.exe	85
PID 2196 wrote to memory of 2132	2196	Nursultan.exe	86
PID 2132 wrote to memory of 2464	2132	plikan.exe	87
PID 5172 wrote to memory of 2500	5172	Client1.exe	90
PID 2500 wrote to memory of 4168	2500	CMD.exe	93
PID 2132 wrote to memory of 3800	2132	plikan.exe	95
PID 1412 wrote to memory of 5448	1412	BPVSlN0GICnKGKOy.exe	98
PID 1412 wrote to memory of 5456	1412	BPVSlN0GICnKGKOy.exe	99
PID 5456 wrote to memory of 5592	5456	cmd.exe	102
PID 1412 wrote to memory of 5864	1412	BPVSlN0GICnKGKOy.exe	105
PID 2772 wrote to memory of 3176	2772	3u5d33denthmt5zf.exe	107
PID 2772 wrote to memory of 5980	2772	3u5d33denthmt5zf.exe	108
PID 2772 wrote to memory of 4728	2772	3u5d33denthmt5zf.exe	113
PID 5980 wrote to memory of 6140	5980	cmd.exe	115
PID 5864 wrote to memory of 5308	5864	cmd.exe	116
PID 4728 wrote to memory of 3384	4728	cmd.exe	117
PID 1412 wrote to memory of 5760	1412	BPVSlN0GICnKGKOy.exe	118
PID 2772 wrote to memory of 4808	2772	3u5d33denthmt5zf.exe	119
PID 5760 wrote to memory of 4052	5760	MalwareDef.exe	124
PID 5760 wrote to memory of 924	5760	MalwareDef.exe	126
PID 4052 wrote to memory of 3688	4052	cmd.exe	128
PID 924 wrote to memory of 4472	924	cmd.exe	129
PID 5760 wrote to memory of 1556	5760	MalwareDef.exe	130
PID 1556 wrote to memory of 1784	1556	cmd.exe	132
PID 5760 wrote to memory of 3900	5760	MalwareDef.exe	133
PID 3900 wrote to memory of 3852	3900	cmd.exe	135
PID 5760 wrote to memory of 5340	5760	MalwareDef.exe	136
PID 5340 wrote to memory of 5104	5340	cmd.exe	138
PID 5760 wrote to memory of 4640	5760	MalwareDef.exe	139
PID 4640 wrote to memory of 2356	4640	cmd.exe	141
PID 5760 wrote to memory of 5372	5760	MalwareDef.exe	142
PID 5372 wrote to memory of 5548	5372	cmd.exe	144
PID 5760 wrote to memory of 5652	5760	MalwareDef.exe	145
PID 5652 wrote to memory of 2256	5652	cmd.exe	147
PID 5760 wrote to memory of 5572	5760	MalwareDef.exe	148
PID 5572 wrote to memory of 5524	5572	cmd.exe	150
PID 5760 wrote to memory of 4848	5760	MalwareDef.exe	151
PID 4848 wrote to memory of 4952	4848	cmd.exe	153
PID 5760 wrote to memory of 4988	5760	MalwareDef.exe	155
PID 4988 wrote to memory of 5948	4988	cmd.exe	157
PID 5760 wrote to memory of 4668	5760	MalwareDef.exe	158
PID 4668 wrote to memory of 2460	4668	cmd.exe	160
PID 2836 wrote to memory of 5784	2836	MalwareDef.exe	167
PID 5784 wrote to memory of 2528	5784	cmd.exe	169
PID 2836 wrote to memory of 5812	2836	MalwareDef.exe	170
PID 5792 wrote to memory of 5748	5792	MalwareDef.exe	172
PID 5812 wrote to memory of 4912	5812	cmd.exe	174
PID 5748 wrote to memory of 1404	5748	cmd.exe	175
PID 5792 wrote to memory of 5752	5792	MalwareDef.exe	176
PID 5752 wrote to memory of 5160	5752	cmd.exe	178
PID 6056 wrote to memory of 1240	6056	MalwareDef.exe	179
PID 1240 wrote to memory of 3356	1240	cmd.exe	181
PID 6056 wrote to memory of 1564	6056	MalwareDef.exe	182
PID 1564 wrote to memory of 3108	1564	cmd.exe	184
PID 5388 wrote to memory of 560	5388	MalwareDef.exe	185
PID 560 wrote to memory of 4904	560	cmd.exe	187
PID 5388 wrote to memory of 2212	5388	MalwareDef.exe	188
PID 2212 wrote to memory of 1400	2212	cmd.exe	190
PID 3192 wrote to memory of 3388	3192	MalwareDef.exe	191
PID 1680 wrote to memory of 2752	1680	MalwareDef.exe	193
PID 3388 wrote to memory of 2804	3388	cmd.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	plikan.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	plikan.exe

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\BPVSlN0GICnKGKOy.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\BPVSlN0GICnKGKOy.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="VMT_tY:PtTb|t." dir=in action=allow program="C:\Windows\xdwdSub\MalwareDef.exe" enable=yes & exit
    3⤵
    PID:5448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
      4⤵
      PID:5592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:5308
- - C:\Windows\xdwdSub\MalwareDef.exe
    "C:\Windows\xdwdSub\MalwareDef.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3688
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4472
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1784
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3852
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5104
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2356
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5372
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5548
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2256
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5572
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5524
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4952
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5948
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2460
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1012
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1572
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4712
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3172
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5672
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3544
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1260
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:3964
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3348
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5480
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:896
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1056
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4916
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1612
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5556
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2428
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3164
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5156
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2712
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6072
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5944
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5816
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5876
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1704
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5972
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2272
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1764
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3212
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3952
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5036
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:2320
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3384
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5740
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1772
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:4416
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1352
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5148
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6052
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3472
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5256
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4584
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1832
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4804
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2532
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3876
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6084
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5236
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2000
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3200
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:5400
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:7008
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4948
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7036
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3244
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6552
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:4692
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3488
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5312
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4916
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:6040
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6240
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6756
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6752
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6288
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6512
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6232
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5524
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2244
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5308
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5164
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:440
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3020
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:6248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:972
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4316
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4380
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:3852
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1192
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1880
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:2124
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5636
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Executes a command shell one-liner
      PID:1676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6732
- C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\3u5d33denthmt5zf.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\3u5d33denthmt5zf.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="<3%:&,QG&%@.&z" dir=in action=allow program="C:\Windows\System32\xdwdDefender.exe" enable=yes & exit
    3⤵
    PID:3176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\System32\xdwdDefender.exe" /RL HIGHEST
      4⤵
      PID:6140
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\Web\xdwdMalwareDef.exe" /RL HIGHEST
      4⤵
      PID:3384
- - C:\Windows\System32\xdwdDefender.exe
    "C:\Windows\System32\xdwdDefender.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\XWormClient.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\XWormClient.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\Client1.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\Client1.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4168
- C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\plikan.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\plikan.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2132
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\IntelixWifiExport_ec3b70a92ef84a9388a6c0de31f0a6ea"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2464
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3800

C:\Windows\Sub\RuntimeBroker.exe
C:\Windows\Sub\RuntimeBroker.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\Web\xdwdMalwareDef.exe
C:\Windows\Web\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1404
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5160

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3108

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1400

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2112

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:972
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4388

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5776
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3888
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6076

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6236

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4952

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1432
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1884

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1684
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6288

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6296

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6228

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6364
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:440

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1768
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3172
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6664

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3280
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6164
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4952

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3616
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1880

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5772
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6724
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4784

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6744
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7108

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2308
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5084
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2768

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2344
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2392

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:6008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4320

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6596
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6848
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4396

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2492
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4352

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1436
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3184
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6176
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6004

C:\Windows\System32\xdwdDefender.exe
C:\Windows\System32\xdwdDefender.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4244
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6916
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6604

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2144
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5520

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5676
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6264
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6540
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5900

C:\Windows\xdwdSub\MalwareDef.exe
C:\Windows\xdwdSub\MalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5052
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwdSub\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\xdwdSub\WindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwdDefender.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdDefender.exe.log
Size 642B
SHA256 07cd502f2fffb7c6a891a219527278857fed0061bac452445b945c4753899f2f
MD5 fd08d0d1c404b16d00be959c6656523f
SHA1 d4849d6219a49ab44a105a99d451ded26173470c
SHA512 2f788cb4d91b021966ae25ab68c7a0973cb1e5f53425e6324d5af71d6e0a5fcf8b15da341335acc30740a9aa4a6104502c377da1fad6e81f6460c5fd017329c5
TLSH
T166F0A2313371A0D849563F432D2C179913BF4355A150EE0C7594625DD83681B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

3u5d33denthmt5zf.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\3u5d33denthmt5zf.exe
Size 493KB
SHA256 81811e1909c0479f15fdd3bb3300e499ad6776209567b47930529b91c1fda865
MD5 872dcafadb6f6e2b1fd7bf832d474b8a
SHA1 8cb751d28ab7f722e26914a6207703ba1ed43ad4
SHA512 fabffe8eb0ae88875ad2757d8876e893297ea34346fac200ddf31ea80f4c5401522ce39c28e27f79b28d18adf040f658b712173c00c657520d6f1db96b61bc8f
SSDEEP 12288:vlkPrUYlZkP3Pfm4zAGdVolVH+0r5zNm3j:kZYP7AsVoz+0rX
TLSH
T1FBB44B297FA48E00D585257ECABE3A09CB16E0F1150263433706F7A25D459EEEE2D3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BPVSlN0GICnKGKOy.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\BPVSlN0GICnKGKOy.exe
Size 652KB
SHA256 c491e1b26aed4e2e66f681b2da86f6de6d65f8cd7df165abaae8333c1b0e4bdd
MD5 6cca0e62105b4703855ad9df1fe007f0
SHA1 25a781a792218a4e23f1b33d4b58ffd7984dee04
SHA512 b9b5679d163d9dafbda5544d0cbfd0347dbb2ed4a3902128e0d8ce0bbbd6a84ea6ed510a2f11a00df9344b7b5c834d034aa350bd191eaf84f438e54b01eee396
SSDEEP 12288:DsoqDSTuXIIJtNuj6mgfS0EWaVgxsLcmRKegDN++:Ds7FuGmUT6LpKe0b
TLSH
T140E4B1242FB4A90AE458173E42DA1510E7BA52E123337347370BBE625D40BDEDE6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client1.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\Client1.exe
Size 659KB
SHA256 b585fcd0ea40d5c5c231f7dc04f1caf0eb90e9ae197dff36ff0e10ffd1429def
MD5 d6910cd1897278af35a8b355cf375e13
SHA1 3d5e83b963adbe97b58497083e9f2142736e0bcf
SHA512 842413b83f5864b79141e7651e97b8d8c691b728ace5e16a3df623cc730729fcba4ba5cd2171331f935f29e5a2148138ea5718f0893928f4cef09891fcdb547f
SSDEEP 12288:MJQkqFnPFYag734uyrSSF2YlH286CuPaB:MOFYag734uibuP6
TLSH
T117E4910DBD51FC04CE6E3DB38BE690A11B3210C23F129516370A6FFA9B653B659A217D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\XWormClient.exe
Size 73KB
SHA256 053d2fb97bc2a6e13672e2b31e0d71fbbf284659d8801248f70fbe636ef8d5df
MD5 07e79363bfcd60a7118b5e4887ca7236
SHA1 5203aa53625f8838d169c939d6d0ba2019892ef1
SHA512 ff3b9e72c021c6f0d2ed9b75cfe365d883120150adb1b62c59918fc17d3255c3d6152161256d8f3bc2c1d3d4804a9b5233a56e0cd6a098d9ab62148826d8ed9b
SSDEEP 1536:PtdAUYvHXNg/AvI+q7keSdbahH2EEk6pWIOY6dd:HG3Ng/AvP0lSdba9ZgWIOYk
TLSH
T128738D18B3E5052AE4FFAFB41DF13222C776F6136803D61F14D8519A2B37A898E117E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plikan.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_338e6cbb\plikan.exe
Size 246KB
SHA256 29bfeb955c1ad28de1af86fb10dff11fb1b9ca6111c46581eaaaec6d6624249e
MD5 1716229348ac61d7d5de1bf25484b67e
SHA1 c03728c7a890b0305b6fcd6a1e2c77fe29aa0f6a
SHA512 022b81aa43a2c30ce546716c7922a7c54980067bd895decc653ccf83a1949143404736c75ba76a3dff858a81bec9b800aafd2f1ba5a0ece39a10b2efced7812a
SSDEEP 3072:DcDTxU7ZsUFLX1OSBsZHvfDMPcNJGdSutY2Oz50ARISFirKoXsQ+fKpK:DVfcKGHYPUZmm+rKo+yp
TLSH
T13734189477FC1214F2BF8F79A87454504AB7F427A926D70E1CDA61DC2A32B90EA14B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cvbyodjm.2kw

Path C:\Users\Admin\AppData\Local\Temp\cvbyodjm.2kw
Size 8KB
SHA256 4d3730935c6d68aeb147b039110b2c9ae8d05322310b7a3189d050785b4d5c69
MD5 3ae1bcb45c5631c77c9aa0120594b60e
SHA1 76093f17ec562a768e2a5ff122691181f4916b32
SHA512 7ec553a75a0533850c7cf0f6ee8ce3ac37d8a0f7d84ab956a488a8f91331db20bde5470e9f2dfe35d38b2e0a07167447395f904fcd993c6121da1643c447b15e
SSDEEP 192:AGNS6WLkQmiUyymOLEbnckX5m9r8gNjzorYW3Rl/ne:AGNS6a09vLQckX5mV8gB8zfve
TLSH
T16F02D735AC787C7B9EF2AD49B5463717AFE1102BEA852F54DAE81E1D00D729C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iaatkspy.qii

Path C:\Users\Admin\AppData\Local\Temp\iaatkspy.qii
Size 130KB
SHA256 02b0eaa2ec89109fd407a25b86a3a217401ad0f417eb6d85e7bbb39dd147f871
MD5 ec893054677064c83a82d23ec49cf9ac
SHA1 e455b3d9e549971ca2bdbd70f7d5d85c04ea5f6f
SHA512 8237bd97426e46c634c5555f3ce6753234b32717f9273277fa4d23903493b4541d88f67acedeb6fc9d50e44e894fe7091526ab25300430a2e3504731cffcb635
SSDEEP 3072:khgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCS:kxmX/B5UgKf2ne1utLS
TLSH
T190D302BF9DD9DFA36361F02679A95B6EC9F67FC4A160DA4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-386-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1108-368-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1412-16-0x0000000000DE0000-0x0000000000E8A000-memory.dmp

Download

memory/1416-404-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1436-397-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1436-371-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1436-390-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1464-378-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1464-395-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1660-393-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/1680-359-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2132-114-0x000001E4F9230000-0x000001E4F9242000-memory.dmp

Download

memory/2132-74-0x000001E4F9300000-0x000001E4F9350000-memory.dmp

Download

memory/2132-62-0x000001E4F69C0000-0x000001E4F6A02000-memory.dmp

Download

memory/2196-0-0x0000000000F40000-0x000000000115C000-memory.dmp

Download

memory/2236-401-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2300-38-0x00000000007E0000-0x00000000007F8000-memory.dmp

Download

memory/2344-398-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2344-379-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2348-323-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2348-312-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2432-367-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2432-389-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2492-381-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2492-402-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2772-27-0x00000000001F0000-0x0000000000272000-memory.dmp

Download

memory/2836-353-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/2836-338-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3004-373-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3004-391-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3192-358-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3280-363-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3280-374-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3280-399-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3616-376-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3616-394-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3996-388-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3996-369-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/3996-360-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4220-372-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4220-387-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4244-405-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4244-408-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4380-325-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4380-176-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4696-406-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4696-361-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4696-370-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4700-315-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4700-322-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4760-377-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4760-392-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4808-306-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4808-329-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4896-364-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/4896-384-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5052-407-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5172-51-0x0000000000CC0000-0x0000000000D6A000-memory.dmp

Download

memory/5388-356-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5676-403-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5760-326-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5760-300-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5772-400-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5772-375-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5776-362-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5776-382-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5792-354-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5888-357-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5892-385-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/5892-366-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/6008-396-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/6008-380-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/6056-355-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/6120-383-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download

memory/6120-365-0x00007FFFFB620000-0x00007FFFFB642000-memory.dmp

Download