2758f6e07678b270ca6dd2c3abe36df28c038759dcb4eb44ab5c08e667093a1f

Reason

Machine shutdown

General

Target
2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe
Size 318KB
Sample260504-dkhaesft3j
SHA256 2758f6e07678b270ca6dd2c3abe36df28c038759dcb4eb44ab5c08e667093a1f
MD5 cd37be41aeb10b5b4bd9e368c0cc4a6f
SHA1 5eb72d6750adf2d54ea2784271bca0307199cfec
SHA512 d6e9aa21d9eb97bc62d3eba9a20190fc40d55a630c4edfa9eceff28b9a7d685eef5a14705251559b972ea28cfa7ed2d0e2c9864bda03cc474e8b3c1a9a3f3c9f
SSDEEP 6144:dX8xo4awH8+bC9WumkB7B+L4fgHF+suBX9FT36wx1mM:dsCS8lWu37B+E4HluNKwSM
TLSH
T1AD643801B7E48172F6B62A706D728765893BBC562B35C6CF93803E0DAD317D2DA3135A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery evasion persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1340	bcdedit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*aswClear = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe"	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "79"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3996	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe
Token: SeRestorePrivilege	3996	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe
Token: SeShutdownPrivilege	3996	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1340	3996	2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_cd37be41aeb10b5b4bd9e368c0cc4a6f_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\system32\bcdedit.exe
  C:\Windows\system32\bcdedit.exe /set safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1340

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a11855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2684