Analysis
- user interaction
yes - max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 11:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Xeno1.3.60.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xeno1.3.60.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target Xeno1.3.60.exe
- Size 209KB
- Sample261107-n5fbnsbv2v
- SHA256 e5fbd1bad368c020674bfe7286eeba9e0ebcf97497f1818a58575c0617c8c6e0
- MD5 9db7aa3c60d925cf151e4b6adfe9bf28
- SHA1 b20c21977e590f394d0f55061c9f0b892eb8099a
- SHA512 17b36ef7371986548788af502f1e5633aa1fe0015b4289ed4b9ebc314395f1a09b446a4e2854427f09b3f30068e62aac0b166c6a500ce202a385565b6a5e39b9
- SSDEEP 6144:P+W7DBkjQsmQVvgqTYYHgFEbbc00Xtpi2IaD:tWc7qHHdc00Xtpi2IaD
- TLSH T1A224089D726072DFC85BD472DEA82CA8FA6174BB831F4213942715EDAA4D897CF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\read_it!!.txt
Ransom Note
- OPPS! All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $40. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Once you payed email the transaction ID to [email protected] then very soon we will send the softwhare Payment informationAmount: 40 dollars worth of BTC Bitcoin Adress: bc1q7cudcg9mmj592t2r6kyyr8ducg04lt79xyjw0l
Emails
Signatures
- Creates a file in the Startup directory 1 TTPs 3 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.url WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini WindowsUpdate.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it!!.txt WindowsUpdate.exe - Executes dropped EXE 1 IoCs
pid Process 4560 WindowsUpdate.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 63 IoCs
description ioc Process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Music\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WindowsUpdate.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4280978039-528710165-233981602-1000\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Searches\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Videos\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Documents\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Videos\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Links\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Music\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Downloads\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Desktop\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Libraries\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\Pictures\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini WindowsUpdate.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini WindowsUpdate.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000e00000001c47b-14.dat ConfuserEx - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dlv4yurze.jpg" WindowsUpdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings WindowsUpdate.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4560 WindowsUpdate.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4536 Xeno1.3.60.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe 4560 WindowsUpdate.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4536 Xeno1.3.60.exe Token: SeDebugPrivilege 4560 WindowsUpdate.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4536 wrote to memory of 4560 4536 Xeno1.3.60.exe 89 PID 4560 wrote to memory of 5216 4560 WindowsUpdate.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno1.3.60.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it!!.txt3⤵PID:5216
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\read_it!!.txt
- Size 853B
- SHA256 994bc57956763a958d8b6a7170257dbd2e4daf04ea5c204a62fc87b1fa6c7f76
- MD5 0090689e4fdd6e8db48df1dce364c5ec
- SHA1 02a9592fd8815bb7d3dadf2ef0ec640768034f7d
- SHA512 a5c9085602d7c34c7644e1287cf6fbe4b874f35077f9f84e432ab6198f8ee68cc7c3c36e8fc4a06b02ee47a07a8d339776c67d299c6112356800d8247605ffeb
- TLSH T10E01E30F7594670815B06381325E6073BE07675D81264A9A1C99913823F099B1DF8C6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\JoinConfirm.xls
- Size 1B
- SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
- MD5 d1457b72c3fb323a2671125aef3eab5d
- SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
- SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe
- Size 209KB
- SHA256 e5fbd1bad368c020674bfe7286eeba9e0ebcf97497f1818a58575c0617c8c6e0
- MD5 9db7aa3c60d925cf151e4b6adfe9bf28
- SHA1 b20c21977e590f394d0f55061c9f0b892eb8099a
- SHA512 17b36ef7371986548788af502f1e5633aa1fe0015b4289ed4b9ebc314395f1a09b446a4e2854427f09b3f30068e62aac0b166c6a500ce202a385565b6a5e39b9
- SSDEEP 6144:P+W7DBkjQsmQVvgqTYYHgFEbbc00Xtpi2IaD:tWc7qHHdc00Xtpi2IaD
- TLSH T1A224089D726072DFC85BD472DEA82CA8FA6174BB831F4213942715EDAA4D897CF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\CompareUnprotect.xls
- Size 1B
- SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
- MD5 d1457b72c3fb323a2671125aef3eab5d
- SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
- SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\CompareUnprotect.xls.o7dh
- Size 569KB
- SHA256 fb0cc3cc43d0f3586d36de51cbe13ea4ceddc92498853c01666f706c0768bd9c
- MD5 95ee361fc9f156cde9ad1431ba86aa72
- SHA1 cedbe47fc694c4339bddc7a40a313644f00065d4
- SHA512 cb22f3bd3bd6d7ccaf7d8433eae9a5c801233bc5eabe4c7a7c52395b39a16d2f3ea3aca1d2eb1eb033c4813ead922717e00d1943c570ba6cfd477cbaec6c17a1
- SSDEEP 12288:DpvV8aUVJZBjWT9S/sUScUF7JhzxBvCYWyQtD3ApKhGVjLi17:RV83o9S/sUScUF3rvCjyp7c17
- TLSH T1ADC423D7C1CCE66D9C5ECE03B7F58FA514FC8093276B077EA1413E96794109A4DCA2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\CompareUnprotect.xls.o7dh
- Size 569KB
- SHA256 fb0cc3cc43d0f3586d36de51cbe13ea4ceddc92498853c01666f706c0768bd9c
- MD5 95ee361fc9f156cde9ad1431ba86aa72
- SHA1 cedbe47fc694c4339bddc7a40a313644f00065d4
- SHA512 cb22f3bd3bd6d7ccaf7d8433eae9a5c801233bc5eabe4c7a7c52395b39a16d2f3ea3aca1d2eb1eb033c4813ead922717e00d1943c570ba6cfd477cbaec6c17a1
- SSDEEP 12288:DpvV8aUVJZBjWT9S/sUScUF7JhzxBvCYWyQtD3ApKhGVjLi17:RV83o9S/sUScUF3rvCjyp7c17
- TLSH T1ADC423D7C1CCE66D9C5ECE03B7F58FA514FC8093276B077EA1413E96794109A4DCA2A1
- MD5 SHA1 SHA512 SSDEEP TLSH