f03ca339230c5edbf59333cc688ce8ee0def5ce280b01ef50e63903bc8721b22

Analysis

user interaction
yes
max time kernel
113s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:51

Reason

Machine shutdown

Target
expensive-cracked.jar
Size 22.2MB
Sample260730-tapjra1fma
SHA256 f03ca339230c5edbf59333cc688ce8ee0def5ce280b01ef50e63903bc8721b22
MD5 d9e9690344b050d41fe535ce268a5899
SHA1 a523ce8b545f6ddca02d0a35e46707c426bc175e
SHA512 0a95f820e9c014d4d08e2f888161dd8f8ba672e2367d6d433330680465bca19fb97ca6f891732d1f50d404d2c8c4e105d4631b43b757a794febf92f8b8cb56c7
SSDEEP 393216:9i26G6KyLX5Bko2a2oRv2d3ZC9XJRoX1Qha2ZgEtI72Gj5BTU5I8HSN5BiJBpRGJ:x6GJyzko92y+itzk1F2ZgEtI75zr8jB2
TLSH
T14437021E7DAC89ADD91390F2D081C896655C12CAF059A09FDAE50A8AD8F5C8F0707FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1392	LogonUI.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\expensive-cracked.jar
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3688

memory/3124-2-0x000001E7CC6C0000-0x000001E7CC930000-memory.dmp

Download

memory/3124-11-0x000001E7CADF0000-0x000001E7CADF1000-memory.dmp

Download

memory/3124-12-0x000001E7CC6C0000-0x000001E7CC930000-memory.dmp

Download