4e671c40d9d780b85f8a44aa50a5c175a9f2c2a0a530e450a981905713ec5378

Resubmissions

02/04/2025, 22:36 UTC

250402-2h95esxpz5 3

30/03/2025, 19:46 UTC

250330-yg7q5avzew 6

29/03/2025, 19:55 UTC

250329-ynl31axwgv 6

29/03/2025, 19:55 UTC

250329-ym9gxaxvf1 6

29/03/2025, 18:18 UTC

250329-wxy3taznv5 6

29/03/2025, 10:24 UTC

250329-mfdwwa1xay 7

29/03/2025, 00:19 UTC

250329-amltvawpx2 6

28/03/2025, 22:33 UTC

250328-2gj7lssxgv 6

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 18:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno-v1.1.65/XenoUI.deps.json
Size

2KB
MD5

f264dff8b12b6341b6bb97f9cea46324
SHA1

f8f19c048eacb31fb11b88d2a14b02cb3b7dbd74
SHA256

16b09c4fa7b6b3b75ded9a5ea854ad0b1b88288969376c94de1546cd02a82905
SHA512

4c69f803f0c48cff3da3b862dcad62b5c29af197f83d52cbf176c91e16752f883aea5ccb264aec66c2af179e038b5cf98439561ce08ffd31fc8b385486c67b93

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2736	AcroRd32.exe
2736	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 308	2268	cmd.exe	31
PID 2268 wrote to memory of 308	2268	cmd.exe	31
PID 2268 wrote to memory of 308	2268	cmd.exe	31
PID 308 wrote to memory of 2736	308	rundll32.exe	33
PID 308 wrote to memory of 2736	308	rundll32.exe	33
PID 308 wrote to memory of 2736	308	rundll32.exe	33
PID 308 wrote to memory of 2736	308	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.65\XenoUI.deps.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.65\XenoUI.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.1.65\XenoUI.deps.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1bc7b10ee6063ab024bc09d6672d0cdd

SHA1
4cc24b51fc0cc0703071facfb8fed287e46af82d

SHA256
53e7803c6102b1d8d1f5fce7cee538b42e26a72f114197e8dc6b3075095bbf1d

SHA512
b10cfb9846587ced15a6318602322fe782eaa9ed686e9460e65a2c762a1392cc1f843d5488ef6d94c122850088c2e441046bbcf84b60b54b2bc1fea0f464cb13

Download Submit