Analysis
- user interaction
yes - max time kernel
24s - max time network
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 11:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
gui.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
gui.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target gui.exe
- Size 1.6MB
- Sample260722-nph3maec42
- SHA256 e7eaba5487c734df97b23f59d7434483c2dfaf5d65d2956b5d17c598b5ee4c69
- MD5 7fa47bfdcbc0f5db006131fabb9888ea
- SHA1 9d7c8e4bec657b888cac1bb56685d80c6c2efc52
- SHA512 a16e2df8846cc4e5e006b9798022ec90b0656cea48a727a79494fe333048a6d68b3a4060fd5024f2662cbb094c1db5c44cf6790cdb4f6410c57d4456b02938ee
- SSDEEP 49152:sOyaK1hRXdnxZiyN+YQ0iTAnNwEj9tpUQIPLw1MrD/3hJL8S8eYKO8bFa21+C5V6:sOydRXNxZiyN+YQ0iTAnNwEj9tpUQIPr
- TLSH T1CA75B042E2A406F8C65FD1388656A72FE771341903209BDB67D44AAA3F53EE05F3E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3312 gui.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3312 gui.exe 2020 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gui.exe"C:\Users\Admin\AppData\Local\Temp\gui.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3312
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a25855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2288