56b445c890323ee627b79ae87201ce1b49bc044626b4e6775a9f6a6ce1607bad

Analysis

max time kernel
6s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kacperuxz#7373 opti pack/optymalizacja windows by kacperuxz#7373/3. Windows Debloat/2. Windows Deblo.bat
Size 35B
Sample240222-lkbfwafg86
SHA256 a6db677174d9a427e5582db26ec71be1372b3467faca91ff2e082f48ece0db30
MD5 14b4e3937bbb6560bf853ff651684b67
SHA1 916231f6c56a7265eabe84d9e7f527f4f564038f
SHA512 2a51497266d281d5f4b1a9c0fda50a65d83a69856bf5237ee703b63d06ec01ae842fd57d6349ddc62c729956798f84c1dddb8243522ffdf608c5ee57e8b6dacd
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "50"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3304	shutdown.exe
Token: SeRemoteShutdownPrivilege	3304	shutdown.exe
Token: SeSystemEnvironmentPrivilege	4764	bootim.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1468	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3304	2808	cmd.exe	87
PID 2808 wrote to memory of 3304	2808	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kacperuxz#7373 opti pack\optymalizacja windows by kacperuxz#7373\3. Windows Debloat\2. Windows Deblo.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\shutdown.exe
  shutdown /o /r /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3304

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads