ada6f4bcaf623156e8d9d340ef0b3f8c7d45f06958f77152895d568fa47c1ad0

Resubmissions

03/07/2026, 03:54

260703-egjvhsbs4w1

03/07/2026, 03:51

260703-eesdwabs211

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
8s
max time network
10s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/07/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
do you hate me.bat
Size 324B
Sample260703-eesdwabs21
SHA256 ada6f4bcaf623156e8d9d340ef0b3f8c7d45f06958f77152895d568fa47c1ad0
MD5 faead1a33a1729d5c96e317fd1c3cf53
SHA1 4c20acc5faf5e8e4a86f1e14c6d2fd94cd5a81e8
SHA512 419e8cd8d39207355f6b2bca07a0fdb27da205c24977e23d7c03fe170d623fd99df0ba1ef128b6de11718292dd3f4d6add039705402f406344be2cfefebc9937
TLSH
T1C9E0264CB267D04A80109E5717A6702BB602D053BC58AE38333635323BD05C4292E9AA
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3464	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "116"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5072	shutdown.exe
Token: SeRemoteShutdownPrivilege	5072	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3464	4288	cmd.exe	81
PID 4288 wrote to memory of 5072	4288	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\do you hate me.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:3464
- C:\Windows\system32\shutdown.exe
  shutdown -s -t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5072

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a14055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1060

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads