77b481b33f1b7387299f3c384e03f14217c4bb8ab729a3a59389c07b2575204e

Analysis

user interaction
yes
max time kernel
93s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
frr.exe
Size 1.3MB
Sample260706-ny66taev4w
SHA256 77b481b33f1b7387299f3c384e03f14217c4bb8ab729a3a59389c07b2575204e
MD5 9da1ecece77113c59599c6ec0b45222e
SHA1 93120a8af623127e20f396a413b1bbff52801f6c
SHA512 aabf92bfe58db5bdf1d7b6b2bd8c232cef3bf802208ffe7f117da1aedca3b3910d6025150c6face3448c9a385439b68113e398b8a67aeda62566c4ed8197b64c
SSDEEP 24576:wgx4QmkBvQsSXS1DSiqpuTFaHnd7mOUNm4UPMfvV2zJDvKjLN:TasSXoWiqwaHnx7kf92zJvY
TLSH
T18255AF4373E6C1E5CFBBC1B6C9114626EA717854073897DB25A4892EEFA3BD00E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3796	frr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5744	shutdown.exe
Token: SeRemoteShutdownPrivilege	5744	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3796	frr.exe
3796	frr.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3796	frr.exe
3796	frr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3796	frr.exe
3796	frr.exe
2520	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 5744	3680	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\frr.exe
"C:\Users\Admin\AppData\Local\Temp\frr.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\shutdown.exe
  shutdown /p
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5744

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a17055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\Documents\HorribleBaseMacros\config.ini
Size 1KB
SHA256 271e524758bbd1eb1600671cc3a408d4b80cb917946504026913f82620bfd4cb
MD5 4d0f2f74570b81f3aa1faebe8dd7ae85
SHA1 65cd1576d450e723989c59f06184ec9e0cf8cc94
SHA512 b7df96c37747c9f330597b52dca3a1264fa6dc1643e25bb33da2a74ce6cdef6b2affa35d53037225f31955169d24fe4d0748e66182fb4ff1961d1984b011aaf9
TLSH
T1DE31F11797F89644F5F26B80EAB411F14F267DAAB93DD14E96C0414D8CE1EC089723B3
MD5 SHA1 SHA512 TLSH

Submit Download