2a0bb4cb7b32fbfc6a6ca6d538a8d48dca2869e41f8b8c4e5d1843bed701cfee

Analysis

user interaction
yes
max time kernel
26s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Basic Improvements/RunMeAsAdmin.bat
Size 84B
Sample260709-sm3fpscx3j
SHA256 2a0bb4cb7b32fbfc6a6ca6d538a8d48dca2869e41f8b8c4e5d1843bed701cfee
MD5 2021b78c172ee3563e600831738a3522
SHA1 cc32b648fd9e048dd86d299a0712b6d9efa49242
SHA512 bbfd0a7d0b40cfcc2e3a02b4c6e81fa082bde4ad7f17bf6d0c6381de1c9dcf7b24e90b3cfadf156befd681ec21d9cffb097b9f11494a3420b599af5bf706ce5d
TLSH
T17CA01201110987DE35538C2560DD9070182F50021240458A302203396408114C1B41C5
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution ransomware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Basic Improvements\\wallpaper.png"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
960	powershell.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
960	powershell.exe
960	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	powershell.exe
Token: SeShutdownPrivilege	960	powershell.exe
Token: SeIncreaseQuotaPrivilege	960	powershell.exe
Token: SeSecurityPrivilege	960	powershell.exe
Token: SeTakeOwnershipPrivilege	960	powershell.exe
Token: SeLoadDriverPrivilege	960	powershell.exe
Token: SeSystemProfilePrivilege	960	powershell.exe
Token: SeSystemtimePrivilege	960	powershell.exe
Token: SeProfSingleProcessPrivilege	960	powershell.exe
Token: SeIncBasePriorityPrivilege	960	powershell.exe
Token: SeCreatePagefilePrivilege	960	powershell.exe
Token: SeBackupPrivilege	960	powershell.exe
Token: SeRestorePrivilege	960	powershell.exe
Token: SeShutdownPrivilege	960	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeSystemEnvironmentPrivilege	960	powershell.exe
Token: SeRemoteShutdownPrivilege	960	powershell.exe
Token: SeUndockPrivilege	960	powershell.exe
Token: SeManageVolumePrivilege	960	powershell.exe
Token: 33	960	powershell.exe
Token: 34	960	powershell.exe
Token: 35	960	powershell.exe
Token: 36	960	powershell.exe
Token: SeIncreaseQuotaPrivilege	960	powershell.exe
Token: SeSecurityPrivilege	960	powershell.exe
Token: SeTakeOwnershipPrivilege	960	powershell.exe
Token: SeLoadDriverPrivilege	960	powershell.exe
Token: SeSystemProfilePrivilege	960	powershell.exe
Token: SeSystemtimePrivilege	960	powershell.exe
Token: SeProfSingleProcessPrivilege	960	powershell.exe
Token: SeIncBasePriorityPrivilege	960	powershell.exe
Token: SeCreatePagefilePrivilege	960	powershell.exe
Token: SeBackupPrivilege	960	powershell.exe
Token: SeRestorePrivilege	960	powershell.exe
Token: SeShutdownPrivilege	960	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeSystemEnvironmentPrivilege	960	powershell.exe
Token: SeRemoteShutdownPrivilege	960	powershell.exe
Token: SeUndockPrivilege	960	powershell.exe
Token: SeManageVolumePrivilege	960	powershell.exe
Token: 33	960	powershell.exe
Token: 34	960	powershell.exe
Token: 35	960	powershell.exe
Token: 36	960	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5640	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 960	3904	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Basic Improvements\RunMeAsAdmin.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Basic Improvements\TheFun.ps1"
  2⤵
  - Disables RegEdit via registry modification
  - Sets desktop wallpaper using registry
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-0-0x00007FF98350F000-0x00007FF983510000-memory.dmp

Download

memory/960-4-0x000002D1FD590000-0x000002D1FD5B2000-memory.dmp

Download

memory/960-3-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-5-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-6-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-8-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-7-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-9-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-10-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-11-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-12-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-13-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-14-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-15-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-16-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-17-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

memory/960-20-0x00007FF983380000-0x00007FF983D24000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads