cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38

Analysis

max time kernel
18s
max time network
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Risxn's Process Lowering Pack V4/2. System Configuration.lnk
Size 1KB
Sample260715-cb3dkab14x
SHA256 cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38
MD5 e602273d1838007a65f3f9cb356f48fe
SHA1 580df21aefd12f983fddfb3768d8edc7457ee3a3
SHA512 af661631d4c7205f2e7018c2cbed28481af65f424f8537353d4edecf5d371c8b70377ece530a9184925aa1c521c5b89ae56fbdbe0f9afeb0df24474ebf02f7a7
TLSH
T18B210D2B05C00B36C2B14E7784B7F3038F21FE26A8939EAE84C062C458A1516FC35E2F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4888	msconfig.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4888	msconfig.exe
4888	msconfig.exe
4208	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4888	3004	cmd.exe	88
PID 4888 wrote to memory of 5044	4888	msconfig.exe	89

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Risxn's Process Lowering Pack V4\2. System Configuration.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System32\msconfig.exe
  "C:\Windows\System32\msconfig.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\winver.exe
    "C:\Windows\system32\winver.exe"
    3⤵
    PID:5044

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a22855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads