790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df

Analysis

user interaction
yes
max time kernel
14s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
xhopeless.exe
Size 88KB
Sample260723-hmsldshf86
SHA256 790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df
MD5 c4ec42b0e7db443a0d0b0232bbf36214
SHA1 f294bd62bab7546f6ab830b5dc8c762dde637913
SHA512 59196d896f45f8f5449b46fc5911b2407441e370e32d5050838d60f64c1a6ed1c64080f2df4b089464e0f96870c55d33e197d9e7d3fcd98359ccec40495e5edc
SSDEEP 1536:y18h+W6sv5bhUnrNjVkwxk5OgkBjX5CM1cNmiR1JsWsf4aIaQ:W8h+W6sv5bhELkwxk5z0VONmYDsWsga9
TLSH
T15F93F906B2E324FCD66BCA7459B69A71AB32BC214830AF7E1350D9351E20E509F35F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery evasion execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "cmd.exe /c echo XHOPELESS_v1.0 && ping -n 1 127.0.0.1 && start /min C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\cmd.exe /c echo XHOPELESS_v1.0 && start /min C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	xhopeless.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xhopeless.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8F5D9E08-71EC-370E-BA96-36E6EF916DF2}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FEBEF00C-046D-438D-8A88-BF94A6C9E703}	xhopeless.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\g\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\s	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t\Debugger = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r\Debugger = "1"	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\m	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\m\Debugger = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\P	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\g	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\p\Debugger = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\e\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r	xhopeless.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 63006d0064002e0065007800650020002f00630020006500630068006f002000580048004f00500045004c004500530053005f00760031002e00300000006100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	xhopeless.exe

Executes dropped EXE 1 IoCs

pid	Process
4076	xhopeless.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	xhopeless.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XHopelessV1 = "C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XHopelessV1 = "C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xhopeless.exe

Indicator Removal: Clear Persistence 1 TTPs 52 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	xhopeless.exe

Modifies WinLogon 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ReportBootOk = "0"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}	xhopeless.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	xhopeless.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\xhopeless.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\xhopeless.exe	xhopeless.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4036	cmd.exe
2380	cmd.exe
4404	cmd.exe
3496	cmd.exe
1644	cmd.exe
1060	cmd.exe
4504	cmd.exe
4624	cmd.exe
3428	cmd.exe
960	cmd.exe
3916	cmd.exe
5032	cmd.exe
1672	cmd.exe
3204	cmd.exe
2584	cmd.exe
2696	cmd.exe
464	cmd.exe
5056	cmd.exe
3916	cmd.exe
4860	cmd.exe
2648	cmd.exe
5084	cmd.exe
3664	cmd.exe
2752	cmd.exe
3988	cmd.exe
3704	cmd.exe
3300	cmd.exe
3684	cmd.exe
3528	cmd.exe
4728	cmd.exe
4592	cmd.exe
4804	cmd.exe
4744	cmd.exe
960	cmd.exe
220	cmd.exe
3816	cmd.exe
3748	cmd.exe
64	cmd.exe
684	cmd.exe
1276	cmd.exe
4344	cmd.exe
3496	cmd.exe
4080	cmd.exe
2776	cmd.exe
3964	cmd.exe
1780	cmd.exe
2464	cmd.exe
4720	cmd.exe
4948	cmd.exe
2424	cmd.exe
2896	cmd.exe
3512	cmd.exe
1112	cmd.exe
2120	cmd.exe
2948	cmd.exe
4568	cmd.exe
3972	cmd.exe
3996	cmd.exe
3848	cmd.exe
1148	cmd.exe
1080	cmd.exe
4900	cmd.exe
1740	cmd.exe
1900	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4504	cmd.exe
1664	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1664	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5068	xhopeless.exe
5068	xhopeless.exe
5068	xhopeless.exe
5068	xhopeless.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	xhopeless.exe
Token: SeBackupPrivilege	5068	xhopeless.exe
Token: SeRestorePrivilege	5068	xhopeless.exe
Token: SeTakeOwnershipPrivilege	5068	xhopeless.exe
Token: SeLoadDriverPrivilege	5068	xhopeless.exe
Token: SeSystemEnvironmentPrivilege	5068	xhopeless.exe
Token: SeShutdownPrivilege	5068	xhopeless.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2852	5068	xhopeless.exe	86
PID 5068 wrote to memory of 2776	5068	xhopeless.exe	88
PID 5068 wrote to memory of 2424	5068	xhopeless.exe	90
PID 5068 wrote to memory of 4720	5068	xhopeless.exe	92
PID 5068 wrote to memory of 3648	5068	xhopeless.exe	94
PID 5068 wrote to memory of 636	5068	xhopeless.exe	96
PID 5068 wrote to memory of 5044	5068	xhopeless.exe	98
PID 5068 wrote to memory of 3704	5068	xhopeless.exe	100
PID 5068 wrote to memory of 4624	5068	xhopeless.exe	102
PID 5068 wrote to memory of 452	5068	xhopeless.exe	104
PID 5068 wrote to memory of 2120	5068	xhopeless.exe	106
PID 5068 wrote to memory of 3000	5068	xhopeless.exe	108
PID 5068 wrote to memory of 432	5068	xhopeless.exe	110
PID 5068 wrote to memory of 2968	5068	xhopeless.exe	112
PID 5068 wrote to memory of 4708	5068	xhopeless.exe	114
PID 5068 wrote to memory of 4900	5068	xhopeless.exe	116
PID 5068 wrote to memory of 4404	5068	xhopeless.exe	118
PID 5068 wrote to memory of 4244	5068	xhopeless.exe	120
PID 5068 wrote to memory of 1740	5068	xhopeless.exe	122
PID 5068 wrote to memory of 1900	5068	xhopeless.exe	124
PID 5068 wrote to memory of 2904	5068	xhopeless.exe	126
PID 5068 wrote to memory of 1060	5068	xhopeless.exe	128
PID 5068 wrote to memory of 1148	5068	xhopeless.exe	130
PID 5068 wrote to memory of 1968	5068	xhopeless.exe	132
PID 5068 wrote to memory of 4672	5068	xhopeless.exe	134
PID 5068 wrote to memory of 4036	5068	xhopeless.exe	136
PID 5068 wrote to memory of 220	5068	xhopeless.exe	138
PID 5068 wrote to memory of 5032	5068	xhopeless.exe	140
PID 5068 wrote to memory of 3964	5068	xhopeless.exe	142
PID 5068 wrote to memory of 4444	5068	xhopeless.exe	144
PID 5068 wrote to memory of 3816	5068	xhopeless.exe	146
PID 5068 wrote to memory of 1672	5068	xhopeless.exe	148
PID 5068 wrote to memory of 2872	5068	xhopeless.exe	150
PID 5068 wrote to memory of 3748	5068	xhopeless.exe	152
PID 5068 wrote to memory of 2948	5068	xhopeless.exe	154
PID 5068 wrote to memory of 3932	5068	xhopeless.exe	156
PID 5068 wrote to memory of 4860	5068	xhopeless.exe	158
PID 5068 wrote to memory of 2648	5068	xhopeless.exe	160
PID 5068 wrote to memory of 2696	5068	xhopeless.exe	162
PID 5068 wrote to memory of 3528	5068	xhopeless.exe	164
PID 5068 wrote to memory of 464	5068	xhopeless.exe	166
PID 5068 wrote to memory of 2896	5068	xhopeless.exe	168
PID 5068 wrote to memory of 3508	5068	xhopeless.exe	170
PID 5068 wrote to memory of 3300	5068	xhopeless.exe	172
PID 5068 wrote to memory of 4272	5068	xhopeless.exe	174
PID 5068 wrote to memory of 5084	5068	xhopeless.exe	176
PID 5068 wrote to memory of 1144	5068	xhopeless.exe	178
PID 5068 wrote to memory of 2980	5068	xhopeless.exe	180
PID 5068 wrote to memory of 3780	5068	xhopeless.exe	184
PID 5068 wrote to memory of 4728	5068	xhopeless.exe	186
PID 5068 wrote to memory of 4592	5068	xhopeless.exe	188
PID 5068 wrote to memory of 4080	5068	xhopeless.exe	190
PID 5068 wrote to memory of 4820	5068	xhopeless.exe	192
PID 5068 wrote to memory of 4804	5068	xhopeless.exe	194
PID 5068 wrote to memory of 4676	5068	xhopeless.exe	196
PID 5068 wrote to memory of 4568	5068	xhopeless.exe	198
PID 5068 wrote to memory of 1864	5068	xhopeless.exe	200
PID 5068 wrote to memory of 3428	5068	xhopeless.exe	202
PID 5068 wrote to memory of 3496	5068	xhopeless.exe	204
PID 5068 wrote to memory of 4952	5068	xhopeless.exe	206
PID 5068 wrote to memory of 2060	5068	xhopeless.exe	208
PID 5068 wrote to memory of 3664	5068	xhopeless.exe	210
PID 5068 wrote to memory of 4684	5068	xhopeless.exe	212
PID 5068 wrote to memory of 4744	5068	xhopeless.exe	214

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1"	xhopeless.exe

C:\Users\Admin\AppData\Local\Temp\xhopeless.exe
"C:\Users\Admin\AppData\Local\Temp\xhopeless.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Uses Session Manager for persistence
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Adds Run key to start application
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:1144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:3780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:4728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:4080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:3428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c c
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:3664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  - Executes a command shell one-liner
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  PID:3956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:1352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:5056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  - Executes a command shell one-liner
  PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  - Executes a command shell one-liner
  PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:1112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:64
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:3204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:2752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:1780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:3352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:2584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:1080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:3916

C:\Windows\system32\cmd.exe
cmd.exe /c echo XHOPELESS_v1.0 && ping -n 1 127.0.0.1 && start /min C:\Windows\System32\xhopeless.exe
1⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
PID:4504
- C:\Windows\system32\PING.EXE
  ping -n 1 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1664
- C:\Windows\System32\xhopeless.exe
  C:\Windows\System32\xhopeless.exe
  2⤵
  - Executes dropped EXE
  PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xhopeless.exe

Path C:\Windows\System32\xhopeless.exe
Size 88KB
SHA256 790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df
MD5 c4ec42b0e7db443a0d0b0232bbf36214
SHA1 f294bd62bab7546f6ab830b5dc8c762dde637913
SHA512 59196d896f45f8f5449b46fc5911b2407441e370e32d5050838d60f64c1a6ed1c64080f2df4b089464e0f96870c55d33e197d9e7d3fcd98359ccec40495e5edc
SSDEEP 1536:y18h+W6sv5bhUnrNjVkwxk5OgkBjX5CM1cNmiR1JsWsf4aIaQ:W8h+W6sv5bhELkwxk5z0VONmYDsWsga9
TLSH
T15F93F906B2E324FCD66BCA7459B69A71AB32BC214830AF7E1350D9351E20E509F35F76
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads