b413d50267648544d6d9a01f9bca7a4635904e786b9aeea03c1a686733fa0438

Analysis

max time kernel
16s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
system_purge.bat
Size 1KB
Sample260630-wheqmacw5k
SHA256 b413d50267648544d6d9a01f9bca7a4635904e786b9aeea03c1a686733fa0438
MD5 f405b671737434ba6b8caca3a111f8b3
SHA1 cb8d339ba38bde88fc24ca82842f76194eca8f73
SHA512 efb80f5710ea40caed78750655cf271b5a42f949cd53caffe838fcce6da2c17cab4556093422a8fc794274464822b1a8f5add091ca6e28e0779dbca7932bd692
TLSH
T194310C227C28466AE66DD2377425C44BD727E79E7800EB8F7084211910BA9CD863DBE3
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\RedCortex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\red_protocol.bat"	reg.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Control Panel\Desktop\Wallpaper = "0"	reg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5004	timeout.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2208	shutdown.exe
Token: SeRemoteShutdownPrivilege	2208	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	PickerHost.exe
5648	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 980	4060	cmd.exe	88
PID 4060 wrote to memory of 1440	4060	cmd.exe	89
PID 1440 wrote to memory of 2428	1440	net.exe	90
PID 4060 wrote to memory of 2908	4060	cmd.exe	91
PID 4060 wrote to memory of 3528	4060	cmd.exe	92
PID 4060 wrote to memory of 5168	4060	cmd.exe	93
PID 4060 wrote to memory of 3848	4060	cmd.exe	94
PID 4060 wrote to memory of 5004	4060	cmd.exe	95
PID 4060 wrote to memory of 2208	4060	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\system_purge.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RedCortex" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\red_protocol.bat" /f
  2⤵
  - Adds Run key to start application
  PID:980
- C:\Windows\system32\net.exe
  net volume 100
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 volume 100
    3⤵
    PID:2428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskmgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:2908
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "0" /f
  2⤵
  - Sets desktop wallpaper using registry
  PID:3528
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Colors" /v Cursor /t REG_SZ /d "255 0 0" /f
  2⤵
  PID:5168
- C:\Windows\system32\msg.exe
  msg * "SYSTEM POLICE DETECTED INTRUSION"
  2⤵
  PID:3848
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:5004
- C:\Windows\system32\shutdown.exe
  shutdown /r /f /t 10 /c "SYSTEM CRITICAL FAILURE. REBOOTING."
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2208

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2852

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a13855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads