403862530acc8478d8a5dc8dd8827cdf2cf516ab1145d43c8dbe26f1a56a0fbf

Analysis

user interaction
yes
max time kernel
39s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evilmaid.exe
Size 1.5MB
Sample260425-bdymqagv6p
SHA256 403862530acc8478d8a5dc8dd8827cdf2cf516ab1145d43c8dbe26f1a56a0fbf
MD5 8f43e524a0b49d4da96bdc47cb2536bf
SHA1 d4e82910d81bc23be96fd0ab874ef6eeda438ba5
SHA512 6759320b16e171607d6ab550d2954a6fdc3c94b18e594f8a3f39e17c654c34ae8b2706df2924f24b67250a2b9cf75f9764f7c257f1cc3819a48da475bb09da86
SSDEEP 49152:0S2TIigvCURU7pfD2Dp+R+ikfm84fhxIMl0xtEK:dpPCURkQ4Rpw+hiI8EK
TLSH
T1127502C9D9A0C77CDF6A9530F1E3E4794BA70C695E7EF442CFE8345222328A5792D04A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\/test.png"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\/test.png"	reg.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evilmaid.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
4712	timeout.exe
2836	timeout.exe
4964	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "240"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Runs net.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4536	Process not Found
2100	Process not Found
1228	Process not Found
344	Process not Found
272	Process not Found
4432	Process not Found
4440	Process not Found
4448	Process not Found
4456	Process not Found
4472	Process not Found
4480	Process not Found
220	Process not Found
236	Process not Found
776	Process not Found
2300	Process not Found
3180	Process not Found
2700	Process not Found
3824	Process not Found
1124	Process not Found
1280	Process not Found
2444	Process not Found
1932	Process not Found
4292	Process not Found
5008	Process not Found
4408	Process not Found
2200	Process not Found
2312	Process not Found
1808	Process not Found
5072	Process not Found
3116	Process not Found
3896	Process not Found
1608	Process not Found
4892	Process not Found
1720	Process not Found
3092	Process not Found
888	Process not Found
4928	Process not Found
5016	Process not Found
4740	Process not Found
1580	Process not Found
4192	Process not Found
1556	Process not Found
4376	Process not Found
1148	Process not Found
3448	Process not Found
868	Process not Found
2160	Process not Found
2056	Process not Found
4296	Process not Found
5068	Process not Found
1284	Process not Found
2436	Process not Found
2164	Process not Found
4960	Process not Found
2640	Process not Found
4896	Process not Found
4276	Process not Found
792	Process not Found
2012	Process not Found
2336	Process not Found
4684	Process not Found
1684	Process not Found
4976	Process not Found
3460	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
408	LogonUI.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3940	1052	evilmaid.exe	81
PID 3940 wrote to memory of 4712	3940	cmd.exe	82
PID 3940 wrote to memory of 2940	3940	cmd.exe	83
PID 2940 wrote to memory of 4992	2940	net.exe	84
PID 3940 wrote to memory of 1592	3940	cmd.exe	85
PID 3940 wrote to memory of 708	3940	cmd.exe	86
PID 3940 wrote to memory of 2836	3940	cmd.exe	87
PID 3940 wrote to memory of 5036	3940	cmd.exe	88
PID 3940 wrote to memory of 4964	3940	cmd.exe	89
PID 3940 wrote to memory of 2276	3940	cmd.exe	90
PID 2276 wrote to memory of 3496	2276	net.exe	91
PID 3940 wrote to memory of 1380	3940	cmd.exe	92
PID 1380 wrote to memory of 1488	1380	net.exe	93
PID 3940 wrote to memory of 1096	3940	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\evilmaid.exe
"C:\Users\Admin\AppData\Local\Temp\evilmaid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3795.tmp\3796.tmp\3797.bat C:\Users\Admin\AppData\Local\Temp\evilmaid.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4712
- - C:\Windows\system32\net.exe
    net user Admin stupidlittlemaid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Admin stupidlittlemaid
      4⤵
      PID:4992
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\/test.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:1592
- - C:\Windows\system32\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:708
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2836
- - C:\Windows\system32\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\/test.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5036
- - C:\Windows\system32\timeout.exe
    timeout /t /3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4964
- - C:\Windows\system32\net.exe
    net user "Olivia" X3 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user "Olivia" X3 /add
      4⤵
      PID:3496
- - C:\Windows\system32\net.exe
    net localgroup administrators Olivia /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators Olivia /add
      4⤵
      PID:1488
- - C:\Windows\system32\shutdown.exe
    shutdown -l
    3⤵
    PID:1096

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a21855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

3797.bat

Path C:\Users\Admin\AppData\Local\Temp\3795.tmp\3796.tmp\3797.bat
Size 742B
SHA256 80bd0527bea6233c78477579d113bbde56eaae1b17806f5bcb824ac158b367e2
MD5 e7bc8b3dc833682c0c43fa25ca60e7a1
SHA1 6fff3e0ef39723a08cf6df0efd5d5374f4a54085
SHA512 83c90de3d0c9cb6899f43e0a0b969affefba27925db66526b706a616146553d268b19a4c77d4c3486e029cb3f7db9327ee114d6e0eb01973512b60a6b1939109
TLSH
T17601155AF0630945568095F8693B9C436F9C74C3ED97B7C254EB009516DD32A47358D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/2836-6-0x0000019D3FE00000-0x0000019D3FF20000-memory.dmp

Download

memory/4712-5-0x0000014132310000-0x0000014132430000-memory.dmp

Download

memory/4964-7-0x00000229EC2F0000-0x00000229EC410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads