0d92088225f8def668030ec98460107f6dbec6160c49de388d13bc060f2a95be

Resubmissions

24-01-2025 09:18

250124-k9qres1mfx 3

17-12-2024 05:00

241217-fndshs1pa1 7

21-11-2024 11:22

241121-ngwczssdmp 3

Analysis

max time kernel
148s
max time network
149s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-01-2025 09:18

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

test.exe
Size

10.7MB
MD5

04236e32abfe0a55c3b0383d54196e14
SHA1

794aef5bf46e508e5800af34279e0cb6e201543a
SHA256

0d92088225f8def668030ec98460107f6dbec6160c49de388d13bc060f2a95be
SHA512

a13b247d12bb5f7774fdb2d504336346dd08c7bae68219df4324eb9aaea1196a01e04f16a57e84761a3249ad6d4df3f4a5337afb495a7059bd264e0b51f4459c
SSDEEP

98304:SE4brn0EV1WUUHx2e/gyZp0oEApzTybeqK:T4XvbWUUH//gwuBA1W4

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3624	test.exe
700	test.exe
1588	test.exe
4560	test.exe
4688	test.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
956	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 700	2480	cmd.exe	98
PID 2480 wrote to memory of 700	2480	cmd.exe	98
PID 2480 wrote to memory of 2880	2480	cmd.exe	99
PID 2480 wrote to memory of 2880	2480	cmd.exe	99
PID 2480 wrote to memory of 1588	2480	cmd.exe	101
PID 2480 wrote to memory of 1588	2480	cmd.exe	101
PID 2480 wrote to memory of 5116	2480	cmd.exe	102
PID 2480 wrote to memory of 5116	2480	cmd.exe	102
PID 2480 wrote to memory of 4320	2480	cmd.exe	103
PID 2480 wrote to memory of 4320	2480	cmd.exe	103
PID 2480 wrote to memory of 4556	2480	cmd.exe	104
PID 2480 wrote to memory of 4556	2480	cmd.exe	104
PID 2480 wrote to memory of 4560	2480	cmd.exe	105
PID 2480 wrote to memory of 4560	2480	cmd.exe	105
PID 2480 wrote to memory of 4688	2480	cmd.exe	106
PID 2480 wrote to memory of 4688	2480	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe --help
  2⤵
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe -h
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe -c
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe -dfjghdkfjgh
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe dfjghdkfjgh
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\test.exe
  test.exe -pass kfj000000000000
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:956

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads