790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df

Analysis

max time kernel
14s
max time network
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
xhopeless.exe
Size 88KB
Sample260723-hmsldshf86
SHA256 790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df
MD5 c4ec42b0e7db443a0d0b0232bbf36214
SHA1 f294bd62bab7546f6ab830b5dc8c762dde637913
SHA512 59196d896f45f8f5449b46fc5911b2407441e370e32d5050838d60f64c1a6ed1c64080f2df4b089464e0f96870c55d33e197d9e7d3fcd98359ccec40495e5edc
SSDEEP 1536:y18h+W6sv5bhUnrNjVkwxk5OgkBjX5CM1cNmiR1JsWsf4aIaQ:W8h+W6sv5bhELkwxk5z0VONmYDsWsga9
TLSH
T15F93F906B2E324FCD66BCA7459B69A71AB32BC214830AF7E1350D9351E20E509F35F76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "cmd.exe /c echo XHOPELESS_v1.0 && ping -n 1 127.0.0.1 && start /min C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\cmd.exe /c echo XHOPELESS_v1.0 && start /min C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	xhopeless.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	xhopeless.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5B6D2D20-5526-3D07-B39E-2D9080CEE1BE}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{FEBEF00C-046D-438D-8A88-BF94A6C9E703}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	xhopeless.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d\Debugger = "1"	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\e	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\m	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\s	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\s\Debugger = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\e\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\g\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	xhopeless.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\P	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "1"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	xhopeless.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 63006d0064002e0065007800650020002f00630020006500630068006f002000580048004f00500045004c004500530053005f00760031002e00300000006100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	xhopeless.exe

Executes dropped EXE 1 IoCs

pid	Process
3304	xhopeless.exe

Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	xhopeless.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify = "1"	xhopeless.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xhopeless.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XHopelessV1 = "C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\XHopelessV1 = "C:\\Windows\\System32\\xhopeless.exe"	xhopeless.exe

Indicator Removal: Clear Persistence 1 TTPs 56 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	xhopeless.exe

Modifies WinLogon 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{16be69fa-4209-4250-88cb-716cf41954e0}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C34B2751-1CF4-44F5-9262-C3FC39666591}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ReportBootOk = "0"	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}	xhopeless.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}	xhopeless.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	xhopeless.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\xhopeless.exe	xhopeless.exe
File opened for modification	C:\Windows\System32\xhopeless.exe	xhopeless.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1380	cmd.exe
5980	cmd.exe
2556	cmd.exe
4788	cmd.exe
2900	cmd.exe
1576	cmd.exe
5324	cmd.exe
1944	cmd.exe
5828	cmd.exe
2804	cmd.exe
4456	cmd.exe
3464	cmd.exe
3696	cmd.exe
1388	cmd.exe
4268	cmd.exe
4152	cmd.exe
5452	cmd.exe
3560	cmd.exe
2192	cmd.exe
4364	cmd.exe
4744	cmd.exe
5804	cmd.exe
5972	cmd.exe
5872	cmd.exe
3052	cmd.exe
3652	cmd.exe
5216	cmd.exe
5808	cmd.exe
5276	cmd.exe
6024	cmd.exe
596	cmd.exe
5984	cmd.exe
4736	cmd.exe
5556	cmd.exe
5648	cmd.exe
5756	cmd.exe
1700	cmd.exe
600	cmd.exe
2892	cmd.exe
2032	cmd.exe
1240	cmd.exe
2652	cmd.exe
5020	cmd.exe
3296	cmd.exe
2768	cmd.exe
1252	cmd.exe
3996	cmd.exe
4196	cmd.exe
4376	cmd.exe
3248	cmd.exe
1388	cmd.exe
3296	cmd.exe
2820	cmd.exe
3760	cmd.exe
5076	cmd.exe
4688	cmd.exe
2784	cmd.exe
832	cmd.exe
2376	cmd.exe
5960	cmd.exe
4620	cmd.exe
3124	cmd.exe
1088	cmd.exe
4556	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3268	xhopeless.exe
3268	xhopeless.exe
3268	xhopeless.exe
3268	xhopeless.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	xhopeless.exe
Token: SeBackupPrivilege	3268	xhopeless.exe
Token: SeRestorePrivilege	3268	xhopeless.exe
Token: SeTakeOwnershipPrivilege	3268	xhopeless.exe
Token: SeLoadDriverPrivilege	3268	xhopeless.exe
Token: SeSystemEnvironmentPrivilege	3268	xhopeless.exe
Token: SeShutdownPrivilege	3268	xhopeless.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4152	3268	xhopeless.exe	88
PID 3268 wrote to memory of 2900	3268	xhopeless.exe	91
PID 3268 wrote to memory of 4196	3268	xhopeless.exe	93
PID 3268 wrote to memory of 1944	3268	xhopeless.exe	95
PID 3268 wrote to memory of 2412	3268	xhopeless.exe	97
PID 3268 wrote to memory of 2032	3268	xhopeless.exe	99
PID 3268 wrote to memory of 3708	3268	xhopeless.exe	101
PID 3268 wrote to memory of 5452	3268	xhopeless.exe	103
PID 3268 wrote to memory of 1724	3268	xhopeless.exe	105
PID 3268 wrote to memory of 5960	3268	xhopeless.exe	107
PID 3268 wrote to memory of 4688	3268	xhopeless.exe	109
PID 3268 wrote to memory of 4708	3268	xhopeless.exe	111
PID 3268 wrote to memory of 5756	3268	xhopeless.exe	113
PID 3268 wrote to memory of 3216	3268	xhopeless.exe	115
PID 3268 wrote to memory of 1700	3268	xhopeless.exe	117
PID 3268 wrote to memory of 3884	3268	xhopeless.exe	119
PID 3268 wrote to memory of 4200	3268	xhopeless.exe	121
PID 3268 wrote to memory of 6000	3268	xhopeless.exe	123
PID 3268 wrote to memory of 5808	3268	xhopeless.exe	125
PID 3268 wrote to memory of 2768	3268	xhopeless.exe	127
PID 3268 wrote to memory of 4528	3268	xhopeless.exe	129
PID 3268 wrote to memory of 596	3268	xhopeless.exe	131
PID 3268 wrote to memory of 3124	3268	xhopeless.exe	133
PID 3268 wrote to memory of 460	3268	xhopeless.exe	135
PID 3268 wrote to memory of 2152	3268	xhopeless.exe	137
PID 3268 wrote to memory of 2192	3268	xhopeless.exe	139
PID 3268 wrote to memory of 4244	3268	xhopeless.exe	141
PID 3268 wrote to memory of 4364	3268	xhopeless.exe	143
PID 3268 wrote to memory of 2784	3268	xhopeless.exe	145
PID 3268 wrote to memory of 5828	3268	xhopeless.exe	147
PID 3268 wrote to memory of 1576	3268	xhopeless.exe	149
PID 3268 wrote to memory of 2956	3268	xhopeless.exe	151
PID 3268 wrote to memory of 2804	3268	xhopeless.exe	153
PID 3268 wrote to memory of 600	3268	xhopeless.exe	155
PID 3268 wrote to memory of 4680	3268	xhopeless.exe	157
PID 3268 wrote to memory of 5276	3268	xhopeless.exe	159
PID 3268 wrote to memory of 4744	3268	xhopeless.exe	161
PID 3268 wrote to memory of 3652	3268	xhopeless.exe	163
PID 3268 wrote to memory of 4620	3268	xhopeless.exe	165
PID 3268 wrote to memory of 4376	3268	xhopeless.exe	167
PID 3268 wrote to memory of 5132	3268	xhopeless.exe	169
PID 3268 wrote to memory of 1588	3268	xhopeless.exe	171
PID 3268 wrote to memory of 5648	3268	xhopeless.exe	173
PID 3268 wrote to memory of 3248	3268	xhopeless.exe	175
PID 3268 wrote to memory of 3052	3268	xhopeless.exe	177
PID 3268 wrote to memory of 3560	3268	xhopeless.exe	179
PID 3268 wrote to memory of 1388	3268	xhopeless.exe	181
PID 3268 wrote to memory of 3628	3268	xhopeless.exe	183
PID 3268 wrote to memory of 5804	3268	xhopeless.exe	185
PID 3268 wrote to memory of 3264	3268	xhopeless.exe	187
PID 3268 wrote to memory of 5020	3268	xhopeless.exe	189
PID 3268 wrote to memory of 3296	3268	xhopeless.exe	191
PID 3268 wrote to memory of 1252	3268	xhopeless.exe	193
PID 3268 wrote to memory of 3688	3268	xhopeless.exe	195
PID 3268 wrote to memory of 1380	3268	xhopeless.exe	197
PID 3268 wrote to memory of 1088	3268	xhopeless.exe	199
PID 3268 wrote to memory of 5972	3268	xhopeless.exe	201
PID 3268 wrote to memory of 6024	3268	xhopeless.exe	203
PID 3268 wrote to memory of 5324	3268	xhopeless.exe	205
PID 3268 wrote to memory of 6136	3268	xhopeless.exe	207
PID 3268 wrote to memory of 2820	3268	xhopeless.exe	209
PID 3268 wrote to memory of 4556	3268	xhopeless.exe	211
PID 3268 wrote to memory of 4716	3268	xhopeless.exe	213
PID 3268 wrote to memory of 1944	3268	xhopeless.exe	215

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xhopeless.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1"	xhopeless.exe

C:\Users\Admin\AppData\Local\Temp\xhopeless.exe
"C:\Users\Admin\AppData\Local\Temp\xhopeless.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Uses Session Manager for persistence
- Impair Defenses: Safe Mode Boot
- Windows security modification
- Adds Run key to start application
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:3884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:6000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:4244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:2784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:1576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:2956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:5648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:3248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:3560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:1388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:3264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c a
  2⤵
  - Executes a command shell one-liner
  PID:1380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:5972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:6024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c c
  2⤵
  - Executes a command shell one-liner
  PID:5324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  PID:1944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c e
  2⤵
  PID:2844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  - Executes a command shell one-liner
  PID:3760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c d
  2⤵
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c m
  2⤵
  - Executes a command shell one-liner
  PID:5872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  PID:5072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  - Executes a command shell one-liner
  PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c b
  2⤵
  PID:3340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:5676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:1240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:4788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:5300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:1608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:3008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:1080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:3220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:2628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:5904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  - Executes a command shell one-liner
  PID:2892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:3052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  - Executes a command shell one-liner
  PID:5556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c w
  2⤵
  PID:3656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  - Executes a command shell one-liner
  PID:1388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c r
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c s
  2⤵
  PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c v
  2⤵
  - Executes a command shell one-liner
  PID:5020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  - Executes a command shell one-liner
  PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c f
  2⤵
  PID:1252

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c echo XHOPELESS_v1.0 && start /min C:\Windows\System32\xhopeless.exe
1⤵
PID:4916
- C:\Windows\System32\xhopeless.exe
  C:\Windows\System32\xhopeless.exe
  2⤵
  - Executes dropped EXE
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xhopeless.exe

Path C:\Windows\System32\xhopeless.exe
Size 88KB
SHA256 790cc87a425c563af56d042624b2b04ea222e01fd6607d35b9017443b43dd5df
MD5 c4ec42b0e7db443a0d0b0232bbf36214
SHA1 f294bd62bab7546f6ab830b5dc8c762dde637913
SHA512 59196d896f45f8f5449b46fc5911b2407441e370e32d5050838d60f64c1a6ed1c64080f2df4b089464e0f96870c55d33e197d9e7d3fcd98359ccec40495e5edc
SSDEEP 1536:y18h+W6sv5bhUnrNjVkwxk5OgkBjX5CM1cNmiR1JsWsf4aIaQ:W8h+W6sv5bhELkwxk5z0VONmYDsWsga9
TLSH
T15F93F906B2E324FCD66BCA7459B69A71AB32BC214830AF7E1350D9351E20E509F35F76
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads