Analysis
- user interaction
yes - max time kernel
50s - max time network
42s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Xeno.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Xeno.exe
- Size 164KB
- Sample260930-e6vy3ss15k
- SHA256 ae6fc5ba07dc314423a518f93b8ad69a5730df780669fd3b40283c32b24a56fc
- MD5 6156707c90644ea4edb71f3044d1c8d9
- SHA1 237a4262696840719021a53e9322ca1fd0d6fb0d
- SHA512 8fc14005a4ec1cc372e7be1d64c12899a9f304f6002ef1c87bf510697c3ee9fb8753a042e6d2ef5dde6805f349b96847f09a19ab0fa5385ea7e7ee915054d13d
- SSDEEP 3072:520jWfVKLer59aSpfO9D/87jXEkeFZA4nsSyU3i4w:MIhSpfO9jC/44Uhw
- TLSH T189F34B07A6A840BEE1B7D679C9924941FB723C558B71A6CF03507AB60F777D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1244 taskmgr.exe Token: SeSystemProfilePrivilege 1244 taskmgr.exe Token: SeCreateGlobalPrivilege 1244 taskmgr.exe Token: 33 1244 taskmgr.exe Token: SeIncBasePriorityPrivilege 1244 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe - Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe 1244 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"1⤵PID:3120
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244