dff29b6659f94422c9ad37ebcb9e2f7d149ba891cbdc4fde72fa42383edc8def

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
吾爱熄屏-一键锁屏熄屏.exe
Size 4KB
Sample260710-ex6dfses5z
SHA256 dff29b6659f94422c9ad37ebcb9e2f7d149ba891cbdc4fde72fa42383edc8def
MD5 6b89c3e7c0bf6bae7502c1b42c77a881
SHA1 5c5cccb7f6377a977c6fbe893db569fb9b4783d8
SHA512 dbcdf29087482f78481f6d104f59b40fec9410374f0493f5a7701ee00600480d78882cf61e4b8db68ce34238dc5477796733ff9af77c03eb8503616b4df78995
SSDEEP 48:6Wc63NeFTioBuJYbP688OuulGG9WFqvOYUQWrkEf4iII8SfbNtm:463UTioBTD6b4UG9WYOYUQWn4bIZzNt
TLSH
T1CB91E903D3C8467BE07643721DF387357BF9E2656AA7539F2D5802267D297500D23A71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5108	LogonUI.exe
Token: SeCreatePagefilePrivilege	5108	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5108	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\吾爱熄屏-一键锁屏熄屏.exe
"C:\Users\Admin\AppData\Local\Temp\吾爱熄屏-一键锁屏熄屏.exe"
1⤵
PID:4740

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa394f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-0-0x00000000003D0000-0x00000000003D8000-memory.dmp

Download