Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe
- Size 16KB
- Sample260810-p84dcaygla
- SHA256 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a
- MD5 f2dcdf5a00247dbb484fc876712f5cb7
- SHA1 505706f5dc9a5ea27afdc34bebe3d7b2bc1eb0dc
- SHA512 495ce56f0ee6f1884bd8c2b115f29e3ba2eeaf0f3f879aaf149c4f218c5c470d291766f0e23835c1691d47f5fec8012fd52726f9aac7cca622f396f2c2a54922
- SSDEEP 192:EDTo0+oj7DcKL0YDBXem7kt3hZQ75ExzJpHGBHoYBE/Br6dq3Q5tfkG7T:ED7GYVXNkKExzJpHGtFE/BCq3W
- TLSH T152724B47FB424CE5EA25413A89F3696DE033F1358BB653EF8B6012250D9A7D06D3A389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5168 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe 5168 65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1616 Process not Found 5700 Process not Found 5636 Process not Found 6024 Process not Found 3576 Process not Found 4776 Process not Found 4348 Process not Found 5860 Process not Found 4724 Process not Found 6088 Process not Found 3420 Process not Found 4384 Process not Found 1292 Process not Found 464 Process not Found 5408 Process not Found 5240 Process not Found 3376 Process not Found 3716 Process not Found 3848 Process not Found 4868 Process not Found 4596 Process not Found 4920 Process not Found 4180 Process not Found 2752 Process not Found 3920 Process not Found 1268 Process not Found 6080 Process not Found 6084 Process not Found 4880 Process not Found 3496 Process not Found 4676 Process not Found 3028 Process not Found 4332 Process not Found 5008 Process not Found 1756 Process not Found 3352 Process not Found 1084 Process not Found 2776 Process not Found 4236 Process not Found 5404 Process not Found 5812 Process not Found 2024 Process not Found 2864 Process not Found 1964 Process not Found 4356 Process not Found 4604 Process not Found 4132 Process not Found 2852 Process not Found 4664 Process not Found 1064 Process not Found 1060 Process not Found 2812 Process not Found 2664 Process not Found 6036 Process not Found 1140 Process not Found 3932 Process not Found 2348 Process not Found 904 Process not Found 772 Process not Found 3788 Process not Found 1992 Process not Found 1172 Process not Found 5932 Process not Found 1764 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 800 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe"C:\Users\Admin\AppData\Local\Temp\65854e9e491b543d5142b33ca70c0eb8f19efed5fe4c51f940d5b1c880a9ba0a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5168
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a23855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:940