Analysis
- user interaction
yes - max time kernel
35s - max time network
39s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Shiba.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shiba.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Shiba.exe
- Size 195KB
- Sample260802-3x4fvshe94
- SHA256 4d9482f3827f5b5d3e73ca3149a66516f4ae48b79e359e004f9cc770075b1989
- MD5 2dc1adaa600ad492e1966c2cf6ffe3e3
- SHA1 6cfd5e774b9b738f2e65b474941423c34302dfb8
- SHA512 bf30d2d9b027ea04477d364f047df3f28b81389550cd54549e8880f6e23cc91675974cefa5c0fc140152e2f5c9651fb56003834c82d96e5315e61171ec9fb90b
- SSDEEP 3072:n5S8EyjGIhz3kRFPGDd1TlAfYfXQenk1w2eNSz3kRFPGDd1TlAfYfXQenk1w2eNy:hl3kHPGPT04AHw2J3kHPGPT04AHw2
- TLSH T131149D0077E8460EF9FF2FB159BA10810A777E6AA970D74C1189215E1BF3B849922F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2524 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shiba.exe"C:\Users\Admin\AppData\Local\Temp\Shiba.exe"1⤵PID:1256
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a27055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2196
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:592