24b18b7b93a88582a82faf30c6957a59c968f9da3ded19a95eb5785dda360262

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
welcome.vbs
Size 1KB
Sample260620-psyg6aez6p
SHA256 24b18b7b93a88582a82faf30c6957a59c968f9da3ded19a95eb5785dda360262
MD5 48d698f47d3ce44787626b2a1fc87571
SHA1 aa23071de939bb519bbe39c2abeb6c8178ea4db8
SHA512 2a1e3644a0e2fb8fc8d67a95e6d2256b37a5e904cb42fe6c7b3f8fae2631a873c02805340d07e2d8694bd2eb48b6e6147a14cbaff24945eb5e56706801ed0344
TLSH
T1E741B85AF4D5DEA413B8A1534C1B51BCE99254B3A64A587CB38C810CFF3F205EA1243B
MD5 SHA1 SHA512 TLSH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	bootim.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	bootim.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6012	bootim.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5372	LogonUI.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcome.vbs"
1⤵
PID:5844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3352

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a22855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:524

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 22adac51640465199fc66ae02328f1d54d65d76cdf70c975b4eac49611d6e0d0
MD5 5e8317bb3609b1fdfb4840ad17bfef7a
SHA1 02de6f5b2aa7e126c145abd3e89b354df7e82359
SHA512 eef94eb5c465e486a7d9baae519ffa13ec5dd526ce96dfc80898e3274642adfc14315c16d8819cc8e38cccd018762b6a719f39c14610a335689fa10b5a356480
TLSH
T17C21594681B408A6DBB1C366F0F8BD60863FF0DD12E08A5CA029F7D39447462879F9B0
MD5 SHA1 SHA512 TLSH

Submit Download