2ad99a411bafb45295d89b1ea0a31a411e094095e4ffbcfde3bff2b1a9d90c0b

Analysis

user interaction
yes
max time kernel
81s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
177 Skins _ Merry Mint Axe _ 177 skins.png
Size 4.5MB
Sample260727-2m13basfle
SHA256 2ad99a411bafb45295d89b1ea0a31a411e094095e4ffbcfde3bff2b1a9d90c0b
MD5 aa4069aec61a064d8d06fec9a2d4a822
SHA1 c60ef57a65bec02e9318ac36ff0206d500bac966
SHA512 cffbcb7e39815407f8a4074eb4ef711b8996989083438c99112ab2762063eb653f1cb14f091a4439d11d22724526fe5679b0462e2b819d8326b3838c960b6e45
SSDEEP 98304:nVOJwEwAPaee51vuO7JjaZr9TpLZKA5oclcLwXxIBXBPRVO:R12O7JuZ9p4dclcMKXBPRk
TLSH
T1D7263347FACC8A72C55E6075DE778DC980D23A7523B648A9618BCDC172FD86CE001B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Modifies boot configuration data using bcdedit 2 IoCs

pid	Process
4112	bcdedit.exe
980	bcdedit.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2148	mspaint.exe
2148	mspaint.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2148	mspaint.exe
2148	mspaint.exe
2148	mspaint.exe
2148	mspaint.exe
5096	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4112	3088	cmd.exe	102
PID 3088 wrote to memory of 4188	3088	cmd.exe	104
PID 3088 wrote to memory of 4060	3088	cmd.exe	105
PID 3088 wrote to memory of 980	3088	cmd.exe	106

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\177 Skins _ Merry Mint Axe _ 177 skins.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3824

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\system32\bcdedit.exe
  bcdedit /delte {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4112
- C:\Windows\system32\format.com
  format C: /y /q
  2⤵
  PID:4188
- C:\Windows\system32\bootsect.exe
  bootsect /nt60 SYS /mbr
  2⤵
  PID:4060
- C:\Windows\system32\bcdedit.exe
  bcdedit /delte {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:980

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bd055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5096

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads