c8dc1871607ec507ec355088f1a38867a17c46546a02c40a89167299bd801e38

Analysis

user interaction
yes
max time kernel
58s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
pedalsko sie czuje.reg
Size 2KB
Sample260810-mtkxcafp91
SHA256 c8dc1871607ec507ec355088f1a38867a17c46546a02c40a89167299bd801e38
MD5 fbca757267b58ff4f0f5a980a8081642
SHA1 af2a917d2328e83570eb32d195d0c5f5dbab3a41
SHA512 dcc50e367cd2e8084b7b1c4c134ca75e1a4f82a3e5cd35768f0abaedb14d3feab8493d0720f8dadf9876c37b521de6288465cbff1cdf8fe68c26af6be6f35757
TLSH
T17D513F329C25D307C59ABC0D50369DF4B679E78AA01DEFE2E31C5E849882BC5C485ACF
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Windows.PowerShell.Run	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin\ = "Run with PowerShell as Admin"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\03_edit	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Edit	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\ = "open"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open\ = "Run with PowerShell"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open\command\ = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"-Command\" \"if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit\ = "Edit"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "Microsoft.PowerShellScript.1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\01_open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\01_open\Icon = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\01_open\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\01_open\command\ = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"-Command\" \"if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & '%1'\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin\command\ = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -WindowStyle Hidden -Command \"Start-Process powershell.exe -ArgumentList '-Command \"\"if((Get-ExecutionPolicy ) -ne ''AllSigned'') { Set-ExecutionPolicy -Scope Process Bypass }; & ''%1''\"\"' -Verb RunAs\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\03_edit\ = "Edit"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\03_edit\command\ = "notepad.exe \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\ = "PowerShell Script"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit\command\ = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe\" \"-file\" \"%1\""	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\DefaultIcon\ = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe,1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin\HasLUAShield	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\03_edit\command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\Edit	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\Shell\Open\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\02_admin\Icon = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe,0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\EditFlags = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\DefaultIcon	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\open	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\ = "01_open"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.PowerShellScript.1\shell\01_open\ = "Run with PowerShell"	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Edit\Command	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ps1\Shell\Windows.PowerShell.Run\Command	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1844	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2240	LogonUI.exe

C:\Windows\regedit.exe
regedit.exe "C:\Users\Admin\AppData\Local\Temp\pedalsko sie czuje.reg"
1⤵
- Modifies registry class
- Runs .reg file with regedit
PID:1844

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2056

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads