f2fd0f2ef17ebcbe8389d9efdc61cafccf587d6fcdab08a5760cf346401b9794

Analysis

max time kernel
44s
max time network
45s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18/10/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Graphs_V2.bat
Size

2KB
MD5

357d5768e2f7c4ec0c2a164a836174e1
SHA1

a5766c3cf5fac836f60a4663c3f0f0ab1b8cb280
SHA256

f2fd0f2ef17ebcbe8389d9efdc61cafccf587d6fcdab08a5760cf346401b9794
SHA512

bbf1fccfa50eeee15213e44803d2a77e49632be72c6f87be4a51a65e6ba5603559f0eca529d44aa0584040e8d2df724184e5217714ea1ce1f23869b7ab293ca3

Score

1^/10

Malware Config

Signatures

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
2012	timeout.exe
5004	timeout.exe
656	timeout.exe
1780	timeout.exe
1148	timeout.exe
5032	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3600	shutdown.exe
Token: SeRemoteShutdownPrivilege	3600	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4660	2856	cmd.exe	74
PID 2856 wrote to memory of 4660	2856	cmd.exe	74
PID 2856 wrote to memory of 1836	2856	cmd.exe	76
PID 2856 wrote to memory of 1836	2856	cmd.exe	76
PID 2856 wrote to memory of 696	2856	cmd.exe	77
PID 2856 wrote to memory of 696	2856	cmd.exe	77
PID 2856 wrote to memory of 936	2856	cmd.exe	80
PID 2856 wrote to memory of 936	2856	cmd.exe	80
PID 2856 wrote to memory of 3632	2856	cmd.exe	81
PID 2856 wrote to memory of 3632	2856	cmd.exe	81
PID 2856 wrote to memory of 3628	2856	cmd.exe	82
PID 2856 wrote to memory of 3628	2856	cmd.exe	82
PID 2856 wrote to memory of 196	2856	cmd.exe	83
PID 2856 wrote to memory of 196	2856	cmd.exe	83
PID 2856 wrote to memory of 312	2856	cmd.exe	84
PID 2856 wrote to memory of 312	2856	cmd.exe	84
PID 2856 wrote to memory of 888	2856	cmd.exe	85
PID 2856 wrote to memory of 888	2856	cmd.exe	85
PID 2856 wrote to memory of 884	2856	cmd.exe	87
PID 2856 wrote to memory of 884	2856	cmd.exe	87
PID 2856 wrote to memory of 928	2856	cmd.exe	88
PID 2856 wrote to memory of 928	2856	cmd.exe	88
PID 2856 wrote to memory of 2500	2856	cmd.exe	89
PID 2856 wrote to memory of 2500	2856	cmd.exe	89
PID 2856 wrote to memory of 764	2856	cmd.exe	90
PID 2856 wrote to memory of 764	2856	cmd.exe	90
PID 2856 wrote to memory of 4196	2856	cmd.exe	92
PID 2856 wrote to memory of 4196	2856	cmd.exe	92
PID 2856 wrote to memory of 3840	2856	cmd.exe	93
PID 2856 wrote to memory of 3840	2856	cmd.exe	93
PID 2856 wrote to memory of 716	2856	cmd.exe	94
PID 2856 wrote to memory of 716	2856	cmd.exe	94
PID 2856 wrote to memory of 1332	2856	cmd.exe	95
PID 2856 wrote to memory of 1332	2856	cmd.exe	95
PID 2856 wrote to memory of 3604	2856	cmd.exe	96
PID 2856 wrote to memory of 3604	2856	cmd.exe	96
PID 2856 wrote to memory of 3336	2856	cmd.exe	97
PID 2856 wrote to memory of 3336	2856	cmd.exe	97
PID 2856 wrote to memory of 4588	2856	cmd.exe	98
PID 2856 wrote to memory of 4588	2856	cmd.exe	98
PID 2856 wrote to memory of 2336	2856	cmd.exe	99
PID 2856 wrote to memory of 2336	2856	cmd.exe	99
PID 2856 wrote to memory of 4740	2856	cmd.exe	100
PID 2856 wrote to memory of 4740	2856	cmd.exe	100
PID 2856 wrote to memory of 5104	2856	cmd.exe	101
PID 2856 wrote to memory of 5104	2856	cmd.exe	101
PID 2856 wrote to memory of 4180	2856	cmd.exe	102
PID 2856 wrote to memory of 4180	2856	cmd.exe	102
PID 2856 wrote to memory of 656	2856	cmd.exe	103
PID 2856 wrote to memory of 656	2856	cmd.exe	103
PID 2856 wrote to memory of 2172	2856	cmd.exe	104
PID 2856 wrote to memory of 2172	2856	cmd.exe	104
PID 2856 wrote to memory of 4472	2856	cmd.exe	105
PID 2856 wrote to memory of 4472	2856	cmd.exe	105
PID 2856 wrote to memory of 352	2856	cmd.exe	106
PID 2856 wrote to memory of 352	2856	cmd.exe	106
PID 2856 wrote to memory of 1780	2856	cmd.exe	107
PID 2856 wrote to memory of 1780	2856	cmd.exe	107
PID 2856 wrote to memory of 1924	2856	cmd.exe	108
PID 2856 wrote to memory of 1924	2856	cmd.exe	108
PID 2856 wrote to memory of 1956	2856	cmd.exe	109
PID 2856 wrote to memory of 1956	2856	cmd.exe	109
PID 2856 wrote to memory of 1556	2856	cmd.exe	110
PID 2856 wrote to memory of 1556	2856	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Graphs_V2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:4660
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:1836
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:696
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  cmd
  2⤵
  PID:3632
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3628
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:196
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:312
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:888
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:884
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:928
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2500
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:764
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4196
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3840
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:716
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1332
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3604
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3336
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4588
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:2336
- C:\Windows\system32\msg.exe
  msg * Your computer has a virus!
  2⤵
  PID:4740
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5104
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4180
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:656
- C:\Windows\system32\msg.exe
  msg * I'm sorry for the inconvenience...
  2⤵
  PID:2172
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4472
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:352
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1780
- C:\Windows\system32\msg.exe
  msg * But your computer will die in one minute...
  2⤵
  PID:1924
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1956
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1148
- C:\Windows\system32\msg.exe
  msg * don't Forget to save your files!
  2⤵
  PID:4932
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5016
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:4436
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:5032
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2088
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:5024
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  PID:3312
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2012
- C:\Windows\system32\msg.exe
  msg * But your computer will still shutdown in a minute so please save your files!
  2⤵
  PID:2352
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:5004
- C:\Windows\system32\msg.exe
  msg * okay bye!
  2⤵
  PID:1108
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2416
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2916
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3880
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1064
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4956
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2296
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1000
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2644
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4944
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4872
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4848
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4628
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4532
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2816
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2548
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2408
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4232
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2516
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4844
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1932
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3744
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2536
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4148
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2920
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:656
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2172
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1780
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1924
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1148
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4932
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4912
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3440
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3812
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4100
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2256
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2672
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3488
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2416
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4940
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:772
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2092
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3856
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2296
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4208
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:3012
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4944
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4292
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4868
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:1936
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2900
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:832
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4480
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2408
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:2404
- C:\Windows\system32\msg.exe
  msg * You just got pranked XD!
  2⤵
  PID:4092
- C:\Windows\system32\shutdown.exe
  shutdown /s
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3600

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ae6855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4912

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads