Analysis
- user interaction
yes - max time kernel
148s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-de - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
gta_check.zip
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
gta_check/Xenos64.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
gta_check/YimMenuV2.dll
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target gta_check/Xenos64.exe
- Size 1.3MB
- Sample261030-b9tnmsgv91
- SHA256 922163713b973cf8c4ad80f16cf69305ed0ca319b314e7ec8ae1982ed5f2a9ed
- MD5 e2be25ec1c860b98ea99a835cc981d28
- SHA1 cd0498ef91cd6c7ce9ebf78b3ee43032d65deee2
- SHA512 355f1ec630268ae41e5740592697d1e9d6b05001b71a1e8dc29206c59ff59d9cf23200f8755fb9d7ce639d27d0fd03ca1f203da70a652bb9a30587b5a93146a6
- SSDEEP 24576:iSBsKAhjPTMl1xPiZvL9IyK4LEaDnmfSVgPCS3tMrMyj3F9hIF1SqY5cbaF:iSBsvPTMlLqR6N4waDWSVE3tMx3FE1Sr
- TLSH T16A556D4A77A841F8D076D175C9A78A56E7B2B8060B3187EF07D0A21A1F77AF05E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Colors Xenos64.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gta_check\\Xenos64.exe --load %1" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Xenos64.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4" Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\ = "XenosProfile64" Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\ = "Run" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 19002f433a5c000000000000000000000000000000000000000000 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64 Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gta_check\\Xenos64.exe,-135" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\ = "Xenos 64-bit injection profile" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Xenos64.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 98003100000000002c5da606110050524f4752417e320000800009000400efbe8158443b2c5d37122e00000026050000000001000000000000000000560000000000b85fa100500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000 Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Xenos64.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic" Xenos64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Xenos64.exe Set value (data) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Xenos64.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command Xenos64.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5896 Xenos64.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5896 Xenos64.exe Token: SeLoadDriverPrivilege 5896 Xenos64.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5896 Xenos64.exe 5896 Xenos64.exe 5896 Xenos64.exe 5896 Xenos64.exe 5896 Xenos64.exe 5896 Xenos64.exe