725bdd6423fe9ab5f2bc7e1186e9619e723d26e353f96c5c6d1929bc7e72fa9d

Analysis

max time kernel
2s
max time network
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
香蕉支付1.0.exe
Size 312KB
Sample260810-pm2mmagb34
SHA256 725bdd6423fe9ab5f2bc7e1186e9619e723d26e353f96c5c6d1929bc7e72fa9d
MD5 5bfac163f513b87b51952c3ece9240a6
SHA1 59e96c962dc0c9152674ff73daeb74900ec23a00
SHA512 39dab3bb205d5a80eb188a1d3147f36aa7c7596d76626706b12faa12d6f6a6d3bb668521e8d1bcb8ad597282336a85272dda314479893ea6a2d0b1cac1942829
SSDEEP 6144:2sCwu+mWhJifvtNP/7YXSLB80PRNCFqbhR3pQ:LxmIJQvPkit19R3pQ
TLSH
T12464AE02BAC284F3D5321931492DBB14A57C7D311E159AAFFBD43EAD9A30091A336E77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	香蕉支付1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2680	shutdown.exe
Token: SeRemoteShutdownPrivilege	2680	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 4660	5576	香蕉支付1.0.exe	90
PID 4660 wrote to memory of 300	4660	cmd.exe	92
PID 300 wrote to memory of 5496	300	net.exe	93
PID 4660 wrote to memory of 2680	4660	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\香蕉支付1.0.exe
"C:\Users\Admin\AppData\Local\Temp\香蕉支付1.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\香蕉支付.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\net.exe
    net user administrator gaizhangyu7355608
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user administrator gaizhangyu7355608
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -s -f -t 0
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2680

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a25855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

香蕉支付.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\香蕉支付.bat
Size 61B
SHA256 8d2b1a0370d3581984f5b03430d48994f177ef15d5fda07e1205eac00c5cb20f
MD5 4926a36ae9fc3604c4c0bdaae197818b
SHA1 620e284e5a46ee5fd6e902a04e45604c33d1109d
SHA512 7a1c7b41a62befd914e3d707362b472c9267f3b74edabb68cff286cbae7150dcc7af1ca79bbd412051570b2116c2a435ef33cbbfe2c50f590b1885f30d5b625f
TLSH
T1B2A022233BAAFB30C2C88A800B220B00000330082C8A00A0E2B802B0BBA20800C300F8
MD5 SHA1 SHA512 TLSH

Submit Download