Overview

overview

5

Static

static

3

XPFix.exe

windows11-21h2-x64

5

Resubmissions

23/10/2026, 23:26

261023-3ez1qav12k8

23/10/2026, 23:16

261023-288paaev7s5

Analysis

  • user interaction
    yes
  • max time kernel
    235s
  • max time network
    237s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-es
  • resource tags

    arch:x64arch:x86image:win11-20260911-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    23/10/2026, 23:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XPFix.exe
  • Size 286KB
  • Sample261023-288paaev7s
  • SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discovery

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 41 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XPFix.exe
    "C:\Users\Admin\AppData\Local\Temp\XPFix.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5184
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3548
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4132
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4232
    • C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:952
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5608
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3904

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
          • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
          • Size 64KB
          • SHA256 2f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
          • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
          • Size 4B
          • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
          • MD5 SHA1 SHA512
          Submit Download

          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
          • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
          • Size 960B
          • SHA256 69f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          volume.PNF
          • Path C:\Windows\INF\volume.PNF
          • Size 6KB
          • SHA256 923810350d8ebe587d14675b8e4df15d0417e39be4c3cf2cffbb1a899e48d81f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4132-12-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-13-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-11-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-10-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-9-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-8-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-7-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-3-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-2-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/4132-1-0x000001C38CD70000-0x000001C38CD71000-memory.dmp
          Download

          memory/5184-0-0x0000000000A60000-0x0000000000A61000-memory.dmp
          Download