4b81c8bfac907f37355a309a93014fe6fc2b3344ea3493cb8b306edc405439b7

Resubmissions

01/07/2026, 17:20

01/07/2026, 17:18

max time kernel
4s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:18

Reason

Machine shutdown

Target
infshutdown.bat
Size 282B
Sample260701-vvfysaa16q
SHA256 4b81c8bfac907f37355a309a93014fe6fc2b3344ea3493cb8b306edc405439b7
MD5 ce5e4af6cf214e7acd4127e478aa657b
SHA1 31e4d86fa1b4ae0d5b9dbdfc0a474b65ed4f577c
SHA512 596239944b83dc1a2d8a25b782cbebc341695a25d105dd9f678906c047415bdacab884033bcbe6fb67a91769af586f67dd42fe9cf71b080da976177ca011a3e3
TLSH
T158D0EB02103F2080D0482A52093BFB9DF24FD2C72810FE896008C8BB660B4C4C82098E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shutdown.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shutdown.bat	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5108	timeout.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4368	shutdown.exe
Token: SeRemoteShutdownPrivilege	4368	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 5108	3508	cmd.exe	89
PID 3508 wrote to memory of 4368	3508	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\infshutdown.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5108
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1288