def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:47

Target
Xenos.exe
Size 1.1MB
Sample240603-mvsctabh2v
SHA256 def1c2f12307d598e42506a55f1a06ed5e652af0d260aac9572469429f10d04d
MD5 4731b90db56fc5dd654d59deca1009e6
SHA1 7c486d696813b1e0102f2feb300e6c6a7610287c
SHA512 5d089c44cf073c438d68d3c48172647b8bf1b36886ab93fed3f2f41d2b5454ac14092653d4d70c5ef8076c1f88e1aab9c5bc732097f12e3ade32ab6ea258d6a0
SSDEEP 24576:F6vLpf9LJiOm0xg2VkVtw099I98mzGokH/Ngwpsu+VfSVgPCS3tMrMyj3F9hIF12:afJWVD99U8okH/NSVRSVE3tMx3FE1S0W
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\ = "Run"	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe,-135"	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\ = "Xenos injection profile"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe --run %1"	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\Content Type = "Application/xml"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xenos.exe --load %1"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\DefaultIcon	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell\Edit	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr	Xenos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpr\ = "XenosProfile"	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile	Xenos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile\shell	Xenos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	Xenos.exe
Token: SeLoadDriverPrivilege	1656	Xenos.exe

memory/1656-10-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download

memory/1656-11-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download