Analysis
- max time kernel
29s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xora_1_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xora_1_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Xora_1_.exe
- Size 2.2MB
- Sample260808-pag3fswend
- SHA256 b8fb90b050aa3228c501490470a04fadc65ff910c24aeac689f98dc231f97407
- MD5 1d204bc4efc7eb02ed34433f8fa5d7ca
- SHA1 7b5554d7de9f6f00d7ba37b32706f51ab28df4f2
- SHA512 b37614ebb8de900ff0553489ee23efc92b0978e2c3a3e8ed314921213ad1dd75e59079d767c2fd6877883db6ab56578bccd773dc3977ff523d28173c178daeb0
- SSDEEP 49152:+ow3BdFbOP7vPhgvSblBi20OZtRZx45nemHpelt6moYlkEkIuJArB+O93+x:Lv7vPhgvSblBi20NIt6JjEkorBru
- TLSH T15CB5BF5B677811E4C1B7C13DC142561BFAB2346903709BEB23D09A6B1F637E4AA3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" reg.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 1 api.ipify.org - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win11.ini Xora_1_.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3044 cmd.exe 4860 cmd.exe 3868 cmd.exe 5832 cmd.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3200 wmic.exe 3200 wmic.exe 3200 wmic.exe 3200 wmic.exe 3020 wmic.exe 3020 wmic.exe 3020 wmic.exe 3020 wmic.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe 3552 Xora_1_.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3200 wmic.exe Token: SeSecurityPrivilege 3200 wmic.exe Token: SeTakeOwnershipPrivilege 3200 wmic.exe Token: SeLoadDriverPrivilege 3200 wmic.exe Token: SeSystemProfilePrivilege 3200 wmic.exe Token: SeSystemtimePrivilege 3200 wmic.exe Token: SeProfSingleProcessPrivilege 3200 wmic.exe Token: SeIncBasePriorityPrivilege 3200 wmic.exe Token: SeCreatePagefilePrivilege 3200 wmic.exe Token: SeBackupPrivilege 3200 wmic.exe Token: SeRestorePrivilege 3200 wmic.exe Token: SeShutdownPrivilege 3200 wmic.exe Token: SeDebugPrivilege 3200 wmic.exe Token: SeSystemEnvironmentPrivilege 3200 wmic.exe Token: SeRemoteShutdownPrivilege 3200 wmic.exe Token: SeUndockPrivilege 3200 wmic.exe Token: SeManageVolumePrivilege 3200 wmic.exe Token: 33 3200 wmic.exe Token: 34 3200 wmic.exe Token: 35 3200 wmic.exe Token: 36 3200 wmic.exe Token: SeIncreaseQuotaPrivilege 3200 wmic.exe Token: SeSecurityPrivilege 3200 wmic.exe Token: SeTakeOwnershipPrivilege 3200 wmic.exe Token: SeLoadDriverPrivilege 3200 wmic.exe Token: SeSystemProfilePrivilege 3200 wmic.exe Token: SeSystemtimePrivilege 3200 wmic.exe Token: SeProfSingleProcessPrivilege 3200 wmic.exe Token: SeIncBasePriorityPrivilege 3200 wmic.exe Token: SeCreatePagefilePrivilege 3200 wmic.exe Token: SeBackupPrivilege 3200 wmic.exe Token: SeRestorePrivilege 3200 wmic.exe Token: SeShutdownPrivilege 3200 wmic.exe Token: SeDebugPrivilege 3200 wmic.exe Token: SeSystemEnvironmentPrivilege 3200 wmic.exe Token: SeRemoteShutdownPrivilege 3200 wmic.exe Token: SeUndockPrivilege 3200 wmic.exe Token: SeManageVolumePrivilege 3200 wmic.exe Token: 33 3200 wmic.exe Token: 34 3200 wmic.exe Token: 35 3200 wmic.exe Token: 36 3200 wmic.exe Token: SeIncreaseQuotaPrivilege 3020 wmic.exe Token: SeSecurityPrivilege 3020 wmic.exe Token: SeTakeOwnershipPrivilege 3020 wmic.exe Token: SeLoadDriverPrivilege 3020 wmic.exe Token: SeSystemProfilePrivilege 3020 wmic.exe Token: SeSystemtimePrivilege 3020 wmic.exe Token: SeProfSingleProcessPrivilege 3020 wmic.exe Token: SeIncBasePriorityPrivilege 3020 wmic.exe Token: SeCreatePagefilePrivilege 3020 wmic.exe Token: SeBackupPrivilege 3020 wmic.exe Token: SeRestorePrivilege 3020 wmic.exe Token: SeShutdownPrivilege 3020 wmic.exe Token: SeDebugPrivilege 3020 wmic.exe Token: SeSystemEnvironmentPrivilege 3020 wmic.exe Token: SeRemoteShutdownPrivilege 3020 wmic.exe Token: SeUndockPrivilege 3020 wmic.exe Token: SeManageVolumePrivilege 3020 wmic.exe Token: 33 3020 wmic.exe Token: 34 3020 wmic.exe Token: 35 3020 wmic.exe Token: 36 3020 wmic.exe Token: SeIncreaseQuotaPrivilege 3020 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3292 LogonUI.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3552 wrote to memory of 3200 3552 Xora_1_.exe 89 PID 3552 wrote to memory of 3020 3552 Xora_1_.exe 92 PID 3552 wrote to memory of 4860 3552 Xora_1_.exe 94 PID 4860 wrote to memory of 4736 4860 cmd.exe 95 PID 3552 wrote to memory of 3868 3552 Xora_1_.exe 96 PID 3868 wrote to memory of 4904 3868 cmd.exe 97 PID 3552 wrote to memory of 5832 3552 Xora_1_.exe 98 PID 5832 wrote to memory of 2024 5832 cmd.exe 99 PID 3552 wrote to memory of 3044 3552 Xora_1_.exe 100 PID 3044 wrote to memory of 820 3044 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xora_1_.exe"C:\Users\Admin\AppData\Local\Temp\Xora_1_.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f3⤵PID:4736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f3⤵
- Modify Registry: Disable Windows Driver Blocklist
PID:4904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f3⤵PID:2024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 0 -f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\shutdown.exeshutdown -r -t 0 -f3⤵PID:820
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a24855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4076
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:3396