Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
- Size 16KB
- Sample260810-p84dcaygla
- SHA256 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a
- MD5 f2dcdf5a00247dbb484fc876712f5cb7
- SHA1 505706f5dc9a5ea27afdc34bebe3d7b2bc1eb0dc
- SHA512 495ce56f0ee6f1884bd8c2b115f29e3ba2eeaf0f3f879aaf149c4f218c5c470d291766f0e23835c1691d47f5fec8012fd52726f9aac7cca622f396f2c2a54922
- SSDEEP 192:EDTo0+oj7DcKL0YDBXem7kt3hZQ75ExzJpHGBHoYBE/Br6dq3Q5tfkG7T:ED7GYVXNkKExzJpHGtFE/BCq3W
- TLSH T152724B47FB424CE5EA25413A89F3696DE033F1358BB653EF8B6012250D9A7D06D3A389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe 3036 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2460 Process not Found 2144 Process not Found 2004 Process not Found 2084 Process not Found 1944 Process not Found 4236 Process not Found 1520 Process not Found 4532 Process not Found 3144 Process not Found 228 Process not Found 116 Process not Found 1100 Process not Found 4808 Process not Found 1560 Process not Found 1400 Process not Found 3396 Process not Found 4800 Process not Found 3724 Process not Found 3268 Process not Found 2392 Process not Found 3368 Process not Found 4324 Process not Found 2968 Process not Found 4928 Process not Found 1316 Process not Found 4108 Process not Found 4604 Process not Found 4876 Process not Found 4120 Process not Found 2488 Process not Found 2400 Process not Found 4772 Process not Found 4708 Process not Found 4248 Process not Found 3464 Process not Found 2844 Process not Found 1432 Process not Found 3944 Process not Found 2304 Process not Found 4764 Process not Found 2920 Process not Found 3384 Process not Found 2200 Process not Found 408 Process not Found 2432 Process not Found 3316 Process not Found 1224 Process not Found 4052 Process not Found 2856 Process not Found 3092 Process not Found 3164 Process not Found 3196 Process not Found 4904 Process not Found 3284 Process not Found 512 Process not Found 3052 Process not Found 5024 Process not Found 4220 Process not Found 1788 Process not Found 4112 Process not Found 1760 Process not Found 4624 Process not Found 1468 Process not Found 1644 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 784 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe"C:\Users\Admin\AppData\Local\Temp\65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3036
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a0055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:784