39d98890cd86a653c0562c96cc108dc14d6ae2711bd63f6cef73e3b2a585994d

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nuevo Archivo WinRAR.rar
Size 1.0MB
Sample260722-xe5cjssdnb
SHA256 39d98890cd86a653c0562c96cc108dc14d6ae2711bd63f6cef73e3b2a585994d
MD5 4e8d80679bd814c104e62c46f4ebb685
SHA1 8b4b560528da4d13395733a511ccf726ad27445d
SHA512 7596a82305b968fae28268b8ee6bfb258342ee17777c983466a0dffab6b648e3dd6556e07dc4cf352f9b4f9441c40bcb6dae9608896d97dd690c28f2a909639a
SSDEEP 24576:uvt9AsdKflETuQ5TZ+/IPtc+0RUbkT7kNStvYWY:QA08uF5TZGWbkT7jtAWY
TLSH
T1E6353358A7112FBA72722BC000CF554A0BE1F4BED8F50039371046F85B56D5BAA7FAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2508	Xeno.exe
584	Xeno.exe

Loads dropped DLL 4 IoCs

pid	Process
2508	Xeno.exe
2508	Xeno.exe
584	Xeno.exe
584	Xeno.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4372	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4372	7zFM.exe
Token: 35	4372	7zFM.exe
Token: SeSecurityPrivilege	4372	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4372	7zFM.exe
4372	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nuevo Archivo WinRAR.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1796

C:\Users\Admin\Desktop\Nueva carpeta\Xeno.exe
"C:\Users\Admin\Desktop\Nueva carpeta\Xeno.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508

C:\Users\Admin\Desktop\Nueva carpeta\Xeno.exe
"C:\Users\Admin\Desktop\Nueva carpeta\Xeno.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Xeno.exe

Path C:\Users\Admin\Desktop\Nueva carpeta\Xeno.exe
Size 160KB
SHA256 098e0ddda1fa6cec7def5be97f6cd85df891324b5ccd52e001cf415e09ee557b
MD5 06c6c8928a5f9f32ad4778ece45176f3
SHA1 69941334c19ff637e65acf791b74600a76455842
SHA512 e22018318c674426a2550fdad3ea2c80252b81eb9aedd58c0ff597fe7c82344c0274bda2b8b2814d6a3098a859756ab1747cc150ecc2bfff5fdf42b7ada9e558
SSDEEP 3072:IqeXA/4yIg9vkNPNu6H6xCYOihUE265AJw41V0:IvgvkNFNaxmpEgJ1V0
TLSH
T1D4F34C07A6A851BDE1B6C678CD924D41FB727C598B71A6CF03507AB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XenoUI.deps.json

Path C:\Users\Admin\Desktop\Nueva carpeta\XenoUI.deps.json
Size 2KB
SHA256 21ef27edf8ab68d5228a8d5380f6024cd062937595e0f025ff02cced07ad88b0
MD5 9f9ff7bfc655b11e416903251d2c21f9
SHA1 49138920ac9999c1989947eed59daf7fef80f73d
SHA512 209acd1782175e9b657d0694376f366ac926795f011cc3743f53c34f22310e48f29a90b48b28ebb2bb261093aef07ff2f2cc7f03f422855147c0c715a6986b7b
TLSH
T14D512315E9404EA748B02BFA657943C9F721136F6002594BB8BD289CCFB7F766581F38
MD5 SHA1 SHA512 TLSH

Submit Download

XenoUI.dll

Path C:\Users\Admin\Desktop\Nueva carpeta\XenoUI.dll
Size 145KB
SHA256 d12e9318898f2aff7494fe89a2a8d3e55b2b7cf45ff74e66e152f4ced2012aab
MD5 35352486776cd68ba3d38c79655fe145
SHA1 4c287dd2db5b4f62637881c74ec0b0031e85d1fd
SHA512 f8dbeb062dd4cd8e2117702c835ed580164f4dbb1485cd37f7dfcd7e9d327dcaf92722ded76a8b81690746304607b4fc1437ccf2b848ba5c3495131555b53b70
SSDEEP 3072:91gdAO0a8Uw+2TbyG1XOQd7Pby6SgV9Sj0LC55dVPOdXmh94VM:4AnaC+2HyGBBby6p9Sj0Uh2dWAVM
TLSH
T112E3AF41376CCA12CABF0FBD64B152955A71BE17A5A3E70E14CC349C6CF738286523AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XenoUI.pdb

Path C:\Users\Admin\Desktop\Nueva carpeta\XenoUI.pdb
Size 43KB
SHA256 a68b1133e5838878715e6190f5dc2bf5080cd055a0221ed849b18c13f449ebf3
MD5 9c7f64f54ff2351f8ef41495adf595ad
SHA1 b728711c983e9cf74884867170b45827963664e0
SHA512 7eb32182fd6009b6ee5d729e51d930a7922eede2cb6d958497c74fdd3ea611c81b1ae63b08d8e6f81a368546c97e820a3db13eba708bc170e37c9b3c3ed8ab17
SSDEEP 768:9RwlK3Vdp3MOgZTP2Pew4biSutot7Fd1We1uJUJKs5eBbeZs7GnM/noVL:rwlsVT3MOiTFw4HjvWeMY5CWMqM/6
TLSH
T1A9137B3B9388C625C625147698B7C38C7774C3642686EF32F1E62A18ECBF3684777618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XenoUI.runtimeconfig.json

Path C:\Users\Admin\Desktop\Nueva carpeta\XenoUI.runtimeconfig.json
Size 429B
SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
MD5 1043e1e5e960609d014e56f638202c24
SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
TLSH
T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads