Analysis
- user interaction
yes - max time kernel
598s - max time network
455s - platform
windows10-2004_x64 - resource
win10v2004-20260513-es - resource tags
arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
22/07/2026, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
XenoUI.runtimeconfig.json
Resource
win10v2004-20260513-es
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
XenoUI.runtimeconfig.json
Resource
win11ltsc2024-20260709-es
windows11-ltsc_2024-x64
4 signatures
600 seconds
General
- Target XenoUI.runtimeconfig.json
- Size 429B
- Sample260722-xdcadasdka
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2276 cmd.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\鰀䆟縀䆁 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\edit OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.json OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.json\ = "json_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\鰀䆟縀䆁\ = "json_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\json_auto_file\shell\open OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2792 NOTEPAD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4428 OpenWith.exe - Suspicious use of SetWindowsHookEx 39 IoCs
pid Process 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe 4428 OpenWith.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4428 wrote to memory of 2792 4428 OpenWith.exe 93
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\XenoUI.runtimeconfig.json1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2276
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\XenoUI.runtimeconfig.json2⤵
- Opens file in notepad (likely ransom note)
PID:2792
-