04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

Analysis

max time kernel
10s
max time network
15s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 20:17

Reason

Machine shutdown

Target
04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
Size 14.1MB
Sample260709-y2vbjaas4y
SHA256 04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d
MD5 308621b5aeefc538843dbc3d379c90d3
SHA1 6aebdcb0835149e8b0430881add6730fa1f22c62
SHA512 5b104e0d78aca7716ab291b1c9f34a4ebbb1aa17a0426f81a4d2fa49917cdf83787d73d929cd5854dd3559ee53fb25692ee6a060400bbdf3cf54cf30ade997ac
SSDEEP 393216:MB6rBtb9jeYWWSyw8F+q5Z5618WqBYdxNhaCxRvrK8:MCBtxj9f+e76LqedxNr/
TLSH
T1D9E633EC7288331DC02AC9349513AE58F3B5482E1BD598AF75D7FF806B6B465E602F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1500-0-0x0000000140000000-0x0000000141D9E000-memory.dmp	vmprotect

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
Token: SeDebugPrivilege	1500	04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
Token: SeRestorePrivilege	5832	MdSched.exe
Token: SeShutdownPrivilege	5832	MdSched.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3244	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe
"C:\Users\Admin\AppData\Local\Temp\04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500
- C:\Windows\System32\MdSched.exe
  "C:\Windows\System32\MdSched.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1532

memory/1500-0-0x0000000140000000-0x0000000141D9E000-memory.dmp

Download