ebd0e5e091384ac81574eade9d82639fed6ff060cacee7764ff44cbc6a74d7fa

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XZP-Tool-v2.0/XzpTool 2.exe
Size 374KB
Sample260714-cfd7jacv5q
SHA256 ebd0e5e091384ac81574eade9d82639fed6ff060cacee7764ff44cbc6a74d7fa
MD5 b26f3eaf9aa03e94b27ad4f9abba113b
SHA1 3c13d946eaf548b84d3b5a3567d887ba80bd0f97
SHA512 7d947893c9b7a7e391569875d4f32a34beed0ef629387804bc985b6eff44f7189b2aa0dd73f0b6fd424f3ef60207d630edfee3cda96ed0115836e7e80c2815ef
SSDEEP 6144:VH+j2YrMMLZJmctUhMMUZVmMGH5w5SLmNk8U:VV2MMLZYgyMMUZ0w/
TLSH
T1C1845BC2B2900B33EC7A42F94973443107717DBAA501E6D99DC832AF0AF37529A56B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XzpTool 2.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95ca67a11004465736b746f7000680009000400efbee95c2b72ee5c1d102e0000005e0000000000020000000000000000003e0000000000fd690b004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	XzpTool 2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c517b100041646d696e003c0009000400efbee95c2b72ee5c1c102e0000005400000000000200000000000000000000000000000010db5300410064006d0069006e00000014000000	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2b721100557365727300640009000400efbe8158a93aee5c1c102e000000880600000000010000000000000000003a0000000000234ef80055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	XzpTool 2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	XzpTool 2.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	XzpTool 2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	XzpTool 2.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe
876	XzpTool 2.exe

C:\Users\Admin\AppData\Local\Temp\XZP-Tool-v2.0\XzpTool 2.exe
"C:\Users\Admin\AppData\Local\Temp\XZP-Tool-v2.0\XzpTool 2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-0-0x0000000001180000-0x0000000001190000-memory.dmp

Download

memory/876-1-0x0000000074942000-0x0000000074944000-memory.dmp

Download

memory/876-2-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-3-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-4-0x0000000001180000-0x0000000001190000-memory.dmp

Download

memory/876-5-0x0000000074942000-0x0000000074944000-memory.dmp

Download

memory/876-6-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-7-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-8-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-9-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-10-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

memory/876-11-0x0000000074940000-0x0000000074F61000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads