Analysis
- user interaction
yes - max time kernel
22s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ViaFabricBypass.jar
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ViaFabricBypass.jar
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target ViaFabricBypass.jar
- Size 25.5MB
- Sample260731-v2aqcaea65
- SHA256 8d4dade242f65ec15be5ba8463eee319d0d2a2a89be337fc1d6cc13b7d628770
- MD5 e4daedfd60373a7282fce97c60cab1e9
- SHA1 2015e5d36aa45fc4579bea9e4329614695021838
- SHA512 165eb6016c3ba5a1a7aa7e3b0146c83cfd6f493ebc185efc4130910657abf5e5cd7f58820b9253d33f2c49167c0b9075b6ffec3cb98e7e28e10a38e2525b8545
- SSDEEP 786432:wMUrV/DyfTBcuTATghUk0euA5J+xclDlx9oJRjV6:98+f9cuc0qk0eZ50x8DV8RY
- TLSH T17B4733C73F98963EE8D78A3285C1B076EB7A44D1A545C44BB820954E09E7CCF33768AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2020 LogonUI.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ViaFabricBypass.jar1⤵PID:1004
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a22055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2020
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:928