449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8

Analysis

user interaction
yes
max time kernel
135s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
madcausebad cracked by tank230.exe
Size 3.8MB
Sample260727-x2eqeazzct
SHA256 449438b41b213155444d0da11c270dea561322d89d06b181a8ad09a86da81bd8
MD5 0c6ada7da5c25a7b346b407d58730f75
SHA1 0c0b0033c9c7166c3d0eb09c0ec3abc74419f2f3
SHA512 a539c4de7745859aba002a2ccece46199fcdabfd26c7f06e408bc1d85f34811f60bc3fb8d4140066cebee17332f2b8d0b191918374c9f78c04868af8c7c79fb8
SSDEEP 49152:oXwV0MMbHgy4I9YnDvuHJZgkD0P4fITbl9nfq9smbYlo:aUBvIJ/Dy2IT5tbmbYl
TLSH
T17E06E046636EC1E8D92A813C54B66BC7B6F13D3DD3108FEF22D04CA81E9B6D15AB56C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RuhENNGniJhaFghOtQiATdXx\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\RuhENNGniJhaFghOtQiATdXx"	madcausebad cracked by tank230.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	madcausebad cracked by tank230.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	madcausebad cracked by tank230.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	madcausebad cracked by tank230.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	madcausebad cracked by tank230.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "213"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	madcausebad cracked by tank230.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
2240	madcausebad cracked by tank230.exe
2240	madcausebad cracked by tank230.exe
2240	madcausebad cracked by tank230.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	madcausebad cracked by tank230.exe
Token: SeLoadDriverPrivilege	2240	madcausebad cracked by tank230.exe
Token: SeDebugPrivilege	2240	madcausebad cracked by tank230.exe
Token: SeLoadDriverPrivilege	2240	madcausebad cracked by tank230.exe
Token: SeDebugPrivilege	2240	madcausebad cracked by tank230.exe
Token: SeLoadDriverPrivilege	2240	madcausebad cracked by tank230.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	madcausebad cracked by tank230.exe
1280	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\madcausebad cracked by tank230.exe
"C:\Users\Admin\AppData\Local\Temp\madcausebad cracked by tank230.exe"
1⤵
- Sets service image path in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3970855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1280