f2fd0f2ef17ebcbe8389d9efdc61cafccf587d6fcdab08a5760cf346401b9794

Analysis

max time kernel
51s
max time network
59s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
18-10-2024 08:58

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Graphs_V2.bat
Size

2KB
MD5

357d5768e2f7c4ec0c2a164a836174e1
SHA1

a5766c3cf5fac836f60a4663c3f0f0ab1b8cb280
SHA256

f2fd0f2ef17ebcbe8389d9efdc61cafccf587d6fcdab08a5760cf346401b9794
SHA512

bbf1fccfa50eeee15213e44803d2a77e49632be72c6f87be4a51a65e6ba5603559f0eca529d44aa0584040e8d2df724184e5217714ea1ce1f23869b7ab293ca3

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
4860	timeout.exe
4648	timeout.exe
2432	timeout.exe
3868	timeout.exe
4232	timeout.exe
4528	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4888	shutdown.exe
Token: SeRemoteShutdownPrivilege	4888	shutdown.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2244	notepad.exe
1048	notepad.exe
3664	notepad.exe
3228	notepad.exe
2696	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2128	1548	cmd.exe	71
PID 1548 wrote to memory of 2128	1548	cmd.exe	71
PID 1548 wrote to memory of 4820	1548	cmd.exe	72
PID 1548 wrote to memory of 4820	1548	cmd.exe	72
PID 1548 wrote to memory of 5068	1548	cmd.exe	75
PID 1548 wrote to memory of 5068	1548	cmd.exe	75
PID 1548 wrote to memory of 3816	1548	cmd.exe	77
PID 1548 wrote to memory of 3816	1548	cmd.exe	77
PID 1548 wrote to memory of 2040	1548	cmd.exe	79
PID 1548 wrote to memory of 2040	1548	cmd.exe	79
PID 1548 wrote to memory of 964	1548	cmd.exe	81
PID 1548 wrote to memory of 964	1548	cmd.exe	81
PID 1548 wrote to memory of 2696	1548	cmd.exe	82
PID 1548 wrote to memory of 2696	1548	cmd.exe	82
PID 1548 wrote to memory of 4384	1548	cmd.exe	83
PID 1548 wrote to memory of 4384	1548	cmd.exe	83
PID 1548 wrote to memory of 5028	1548	cmd.exe	84
PID 1548 wrote to memory of 5028	1548	cmd.exe	84
PID 1548 wrote to memory of 5032	1548	cmd.exe	85
PID 1548 wrote to memory of 5032	1548	cmd.exe	85
PID 1548 wrote to memory of 4628	1548	cmd.exe	86
PID 1548 wrote to memory of 4628	1548	cmd.exe	86
PID 1548 wrote to memory of 4608	1548	cmd.exe	87
PID 1548 wrote to memory of 4608	1548	cmd.exe	87
PID 1548 wrote to memory of 1828	1548	cmd.exe	88
PID 1548 wrote to memory of 1828	1548	cmd.exe	88
PID 1548 wrote to memory of 32	1548	cmd.exe	89
PID 1548 wrote to memory of 32	1548	cmd.exe	89
PID 1548 wrote to memory of 2012	1548	cmd.exe	90
PID 1548 wrote to memory of 2012	1548	cmd.exe	90
PID 1548 wrote to memory of 2404	1548	cmd.exe	91
PID 1548 wrote to memory of 2404	1548	cmd.exe	91
PID 1548 wrote to memory of 5024	1548	cmd.exe	92
PID 1548 wrote to memory of 5024	1548	cmd.exe	92
PID 1548 wrote to memory of 4576	1548	cmd.exe	93
PID 1548 wrote to memory of 4576	1548	cmd.exe	93
PID 1548 wrote to memory of 4520	1548	cmd.exe	94
PID 1548 wrote to memory of 4520	1548	cmd.exe	94
PID 1548 wrote to memory of 4548	1548	cmd.exe	95
PID 1548 wrote to memory of 4548	1548	cmd.exe	95
PID 1548 wrote to memory of 4036	1548	cmd.exe	96
PID 1548 wrote to memory of 4036	1548	cmd.exe	96
PID 1548 wrote to memory of 4372	1548	cmd.exe	97
PID 1548 wrote to memory of 4372	1548	cmd.exe	97
PID 1548 wrote to memory of 3228	1548	cmd.exe	98
PID 1548 wrote to memory of 3228	1548	cmd.exe	98
PID 1548 wrote to memory of 2360	1548	cmd.exe	99
PID 1548 wrote to memory of 2360	1548	cmd.exe	99
PID 1548 wrote to memory of 4232	1548	cmd.exe	100
PID 1548 wrote to memory of 4232	1548	cmd.exe	100
PID 1548 wrote to memory of 2352	1548	cmd.exe	101
PID 1548 wrote to memory of 2352	1548	cmd.exe	101
PID 1548 wrote to memory of 4844	1548	cmd.exe	102
PID 1548 wrote to memory of 4844	1548	cmd.exe	102
PID 1548 wrote to memory of 4516	1548	cmd.exe	103
PID 1548 wrote to memory of 4516	1548	cmd.exe	103
PID 1548 wrote to memory of 4528	1548	cmd.exe	104
PID 1548 wrote to memory of 4528	1548	cmd.exe	104
PID 1548 wrote to memory of 836	1548	cmd.exe	105
PID 1548 wrote to memory of 836	1548	cmd.exe	105
PID 1548 wrote to memory of 1048	1548	cmd.exe	106
PID 1548 wrote to memory of 1048	1548	cmd.exe	106
PID 1548 wrote to memory of 2244	1548	cmd.exe	107
PID 1548 wrote to memory of 2244	1548	cmd.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Graphs_V2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2128
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4820
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3816
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:2040
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:964
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2696
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4384
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5028
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5032
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4628
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4608
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1828
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:32
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2012
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2404
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5024
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4576
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4520
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4548
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4036
- C:\Windows\system32\msg.exe
  msg * Your computer has a virus!
  2⤵
  PID:4372
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3228
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2360
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4232
- C:\Windows\system32\msg.exe
  msg * I'm sorry for the inconvenience...
  2⤵
  PID:2352
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4844
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4516
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4528
- C:\Windows\system32\msg.exe
  msg * But your computer will die in one minute...
  2⤵
  PID:836
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1048
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2244
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4860
- C:\Windows\system32\msg.exe
  msg * don't Forget to save your files!
  2⤵
  PID:4164
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4108
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4648
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3552
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3664
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4848
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2432
- C:\Windows\system32\msg.exe
  msg * But your computer will still shutdown in a minute so please save your files!
  2⤵
  PID:2832
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3868
- C:\Windows\system32\msg.exe
  msg * okay bye!
  2⤵
  PID:672
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3008
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:5108
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3600
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:416
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4408
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4420
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:5012
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3112
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1148
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2280
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:768
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3652
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4896
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1520
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4256
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2284
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1136
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4540
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2296
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2292
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2232
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4308
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2776
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:616
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2608
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4392
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4280
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4288
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1004
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2152
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2044
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4640
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2428
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3088
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:5116
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1464
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2260
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4068
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4104
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4100
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2036
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2356
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4304
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4612
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:96
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3592
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4644
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3092
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3076
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2364
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3044
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1572
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3692
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2464
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4624
- C:\Windows\system32\shutdown.exe
  shutdown /s
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4888

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ae2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4316

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads