362e1bb732d0b49d0c412a9ec8aed6cc280a270a3adcb02d025013ef63b35eb9

Analysis

user interaction
yes
max time kernel
26s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:46

Reason

Machine shutdown

Target
users.exe
Size 164KB
Sample260809-xevhcabh92
SHA256 362e1bb732d0b49d0c412a9ec8aed6cc280a270a3adcb02d025013ef63b35eb9
MD5 9f70c4988587c301c872d469d692bc47
SHA1 375e526917e33b635e9d649ac4ede5487277f842
SHA512 5d31b9db3c5307c1567ed54c9c4cca107afcad0217a6a3bedefb7f15ecb682ae73266bca955d9c70602830790bf59f9d95e9841de9aa144e57f43f9a85b9bdf3
SSDEEP 3072:2grUPoWUjj3YsdUccxLIK3XtI74PvGf8DKv+4nV:OdUjjYsk7kcvGf8DKv1
TLSH
T121F36B55B3A600F6E0B79238C9655A06E672FC1207209BDF43A447762F733E19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4384	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\users.exe
"C:\Users\Admin\AppData\Local\Temp\users.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3696