29db0210d424a4cb8adb1102e215a4a74aa29e27c3cc3a934ea8ecad14cfeaac

Resubmissions

09/07/2026, 11:38

260709-nr5dmsav7v6

09/07/2026, 11:36

260709-nqw1waav516

Analysis

user interaction
yes
max time kernel
129s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
GhostyLite.exe
Size 2.8MB
Sample260709-nr5dmsav7v
SHA256 29db0210d424a4cb8adb1102e215a4a74aa29e27c3cc3a934ea8ecad14cfeaac
MD5 86c1418b4794b9c38b5e115e40f25681
SHA1 829c237f9debb669595640f699a764b9c5d1382f
SHA512 00a1b0995f6e779561bee750695e268f28edb2a35b6e4c8a9ea6c48b60536749d69ed13f43026c64b82aa845cd9b955e5aa0c9efc2fda4457589de927a4b9b7d
SSDEEP 49152:ElKOLVCGr/FMfZmC+uMCAKKVSC+uMhun6Ta:wVlrac7KKPchC
TLSH
T15ED5E145F2A701D8C5A78138872AA31BEB723045073257CF6BE51A567F27EE22B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "110"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	GhostyLite.exe
4268	GhostyLite.exe
3488	GhostyLite.exe
3432	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe
"C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:812

C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe
"C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4268

C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe
"C:\Users\Admin\AppData\Local\Temp\GhostyLite.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a36055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a19c331faab57eef.bin

Path C:\Users\Admin\AppData\Local\GhostyBootstrapper3\image-cache\a19c331faab57eef.bin
Size 7KB
SHA256 d2b44f242275ae1a692dde93b9b27b04a75fee34153ea46e777e48cc4a375c52
MD5 932c3d236b5a697155cf7201a34f5a8e
SHA1 ab5d5f798fff6a7688693995376cb30083562b8e
SHA512 819601b2c10eaeccb7e586672a7eb1dc37e64817358e2ec8ce4dbbc27109ae6c02c968d12aa84644a0382e5a27baf4fb69f1df5107832b756c81ddebed75f724
SSDEEP 192:wLUiiiiiiiiiiiiiykiiiiiiiiiiiiioiiiiiiiiiiiiiCiiiiiiiiiiiiiPiiia:w4iiiiiiiiiiiii1iiiiiiiiiiiiioiD
TLSH
T1DDF1283A4C68A51DDBF26CB7F2E8DE9BAD965C81707BEB91F0E5F0560B03BC4110A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\GhostyBootstrapper3\settings.ini
Size 96B
SHA256 6e69828d1c98a16cff28e6c11e43f55173b540a8f19039deb5a4deab2bd0f6a1
MD5 073c9b27132083a356c6cbcabea90c62
SHA1 f6b2dd29525b8f95c78daf7cc2dce4c035ea65d6
SHA512 15a1bcdcf72ad85f7a77eaf0116caef00ef3c837f0ff735e74a1fdaf5c7451f82a6f2990a892c883994fa1a7641048c97bcaacfa8efdb6c9d0a2631c7bd63f1c
TLSH
T196B0122351B9D56B01169823215A404C4050444A6549A324C6A0474D1EB3C0AAAC2503
MD5 SHA1 SHA512 TLSH

Submit Download

a66725fa20ee875d.txt

Path C:\Users\Admin\AppData\Local\GhostyBootstrapper3\text-cache\a66725fa20ee875d.txt
Size 5B
SHA256 f0b8c77d978d7b4aebeb1df5a2c0a6aa70393689819dd4060826ab6d36b5ea90
MD5 c7ba27130f956748671e845893fd6b80
SHA1 86f389089f8cb6f58aa87561bcf7bec9d700c40b
SHA512 f2170cb5d554ef10a286c0754d0ef8acac4a47317c98e315ad092261f39935db861719a29ad1e8235806753619c975c1748572a0c49a1ef784088cd31d8d98a5
MD5 SHA1 SHA512

Submit Download

e63a07656ee90cb1.txt

Path C:\Users\Admin\AppData\Local\GhostyBootstrapper3\text-cache\e63a07656ee90cb1.txt
Size 83B
SHA256 429a8eda9550225815dfe9775e1ad2a5d071dd828d7da84223d80aed99d76d3c
MD5 17b882c29544dbdb162e615d648fd458
SHA1 28819bd1b481dbbc114e9593cdb8bf578f057e3f
SHA512 06c55d3df2d5026add08b6e318916cafbfbde77759c1e14745a3441403ebb53f1281bbad8bf63acab9f5b5e54f189a9ad5a62e55df392d67170f92832fb7022a
TLSH
T1F7A0245F0331517D4131C557C5C0F33C03334315115FC31D4013C101130450C053F401
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads