447c835a547af986138d50c27e70f4daf7bdd2dfaef7b628a9ab41b9a686b6c1

Analysis

user interaction
yes
max time kernel
6s
max time network
11s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 13:10

Reason

Machine shutdown

Target
67client.jar
Size 3.4MB
Sample260728-qephrsxdpg
SHA256 447c835a547af986138d50c27e70f4daf7bdd2dfaef7b628a9ab41b9a686b6c1
MD5 686637b453ff7c26d2303a272441acbe
SHA1 6c12c05756a4c0cc802e007b07e5f059e20f588f
SHA512 1856ab157a00a9c685f549e9700089aff9870d18902229f00d34275b223a6cc6f0527f7f73d2250bd20c934162f600e612d241f32cb1ad6874f3a8e7ebfad5b9
SSDEEP 98304:qGrjR4XsLGw+qEcSyP+wjYHygKwt3O57/MtnQXk:nfR4XsLGQEcSgVkU0xQXk
TLSH
T1EAF523B72ED8986DE923613C9B59E4033EB69188D1CA9C33489C74D72D29DB41F07BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
948	LogonUI.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\67client.jar
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3036

memory/1392-2-0x000001C5A2E10000-0x000001C5A3080000-memory.dmp

Download

memory/1392-11-0x000001C5A1460000-0x000001C5A1461000-memory.dmp

Download

memory/1392-12-0x000001C5A2E10000-0x000001C5A3080000-memory.dmp

Download