ee574003a1bc93cd2f55e664b0800bd88f7416f832fb887e1c37036c7b0df957

Analysis

user interaction
yes
max time kernel
6s
max time network
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 17:36

Reason

Machine shutdown

Target
baritone.1.21.11v2.jar
Size 3.2MB
Sample260813-v6qmcsvfja
SHA256 ee574003a1bc93cd2f55e664b0800bd88f7416f832fb887e1c37036c7b0df957
MD5 19bad29ce86d1ae15f87623bf972cdfb
SHA1 e14c3ecb854fd3abcc355de74bb48e984fd51bb7
SHA512 841d3f6df352526fb0a71afa249133625fdf70593c98f8ffb82394389eddfa6e2929f31bde39ebfdbeb4986d2cb78b6cbde55ccd22cfbab8598691799ba73fb1
SSDEEP 98304:l1ufx6Q2S0ZAJUmYur1K2wxMir9pFOcfJUqziP:l1s6QQAJUmT5K2wOcc6JUEO
TLSH
T17CF533169218C52DE7434638A092680C6EECD7E7BA20BD4D7FA5C3D1F59FFE6628801C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6068	LogonUI.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\baritone.1.21.11v2.jar
1⤵
PID:4900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1504

memory/4900-2-0x000001E84A350000-0x000001E84A5C0000-memory.dmp

Download

memory/4900-12-0x000001E848A90000-0x000001E848A91000-memory.dmp

Download

memory/4900-13-0x000001E84A350000-0x000001E84A5C0000-memory.dmp

Download