Analysis
- user interaction
yes - max time kernel
300s - max time network
183s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
18/08/2026, 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run_me.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
300 seconds
General
- Target run_me.exe
- Size 290KB
- Sample260818-ahs3csszaw
- SHA256 470688413d7e577376d733a2f6684abb65d226656e0611b498bcbd0d9dc5c15f
- MD5 fd9313048c6c38457c54d5a33e4a652d
- SHA1 4d5ba3cf6454b03e52d5951c87fae46502f6fa2a
- SHA512 7a546481346f0b410814db6b111d66d022aa8bd887272a799f1e86dee31d26f867a870fcf0a1578cf45c667f885df5b55ed97f8502b80112abd2baa6215b43b3
- SSDEEP 6144:WbJhs7QW69hd1MMdxPe9N9uA0hu9TBqInhR1Rn+SozRS+LRT6yOgdD1vM3a:WbjDhu9TwIhLhVyRlTxn7Qa
- TLSH T19854DE9BB2D01198DBF442F6D592174AEB7170761B15A3CB6BB853B21B1B4C68F3C3A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Control Panel\International\Geo\Nation run_me.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4324 cmd.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "191" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4712 WMIC.exe 4712 WMIC.exe 4712 WMIC.exe 4712 WMIC.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1912 Process not Found 2756 Process not Found 4764 Process not Found 5068 Process not Found 5080 Process not Found 1408 Process not Found 1080 Process not Found 4504 Process not Found 3372 Process not Found 3716 Process not Found 3276 Process not Found 4436 Process not Found 4292 Process not Found 676 Process not Found 3160 Process not Found 1380 Process not Found 4500 Process not Found 2056 Process not Found 3212 Process not Found 4340 Process not Found 4508 Process not Found 324 Process not Found 236 Process not Found 220 Process not Found 4308 Process not Found 4560 Process not Found 4416 Process not Found 5112 Process not Found 4564 Process not Found 4968 Process not Found 2924 Process not Found 4348 Process not Found 3020 Process not Found 3248 Process not Found 1924 Process not Found 1896 Process not Found 1968 Process not Found 1236 Process not Found 2944 Process not Found 4732 Process not Found 1428 Process not Found 1844 Process not Found 2316 Process not Found 4816 Process not Found 3024 Process not Found 3752 Process not Found 2516 Process not Found 2412 Process not Found 772 Process not Found 1732 Process not Found 3976 Process not Found 1716 Process not Found 1232 Process not Found 460 Process not Found 4460 Process not Found 4888 Process not Found 4516 Process not Found 4420 Process not Found 4756 Process not Found 3188 Process not Found 2932 Process not Found 1820 Process not Found 4556 Process not Found 4972 Process not Found - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4712 WMIC.exe Token: SeSecurityPrivilege 4712 WMIC.exe Token: SeTakeOwnershipPrivilege 4712 WMIC.exe Token: SeLoadDriverPrivilege 4712 WMIC.exe Token: SeSystemProfilePrivilege 4712 WMIC.exe Token: SeSystemtimePrivilege 4712 WMIC.exe Token: SeProfSingleProcessPrivilege 4712 WMIC.exe Token: SeIncBasePriorityPrivilege 4712 WMIC.exe Token: SeCreatePagefilePrivilege 4712 WMIC.exe Token: SeBackupPrivilege 4712 WMIC.exe Token: SeRestorePrivilege 4712 WMIC.exe Token: SeShutdownPrivilege 4712 WMIC.exe Token: SeDebugPrivilege 4712 WMIC.exe Token: SeSystemEnvironmentPrivilege 4712 WMIC.exe Token: SeRemoteShutdownPrivilege 4712 WMIC.exe Token: SeUndockPrivilege 4712 WMIC.exe Token: SeManageVolumePrivilege 4712 WMIC.exe Token: 33 4712 WMIC.exe Token: 34 4712 WMIC.exe Token: 35 4712 WMIC.exe Token: 36 4712 WMIC.exe Token: SeIncreaseQuotaPrivilege 4712 WMIC.exe Token: SeSecurityPrivilege 4712 WMIC.exe Token: SeTakeOwnershipPrivilege 4712 WMIC.exe Token: SeLoadDriverPrivilege 4712 WMIC.exe Token: SeSystemProfilePrivilege 4712 WMIC.exe Token: SeSystemtimePrivilege 4712 WMIC.exe Token: SeProfSingleProcessPrivilege 4712 WMIC.exe Token: SeIncBasePriorityPrivilege 4712 WMIC.exe Token: SeCreatePagefilePrivilege 4712 WMIC.exe Token: SeBackupPrivilege 4712 WMIC.exe Token: SeRestorePrivilege 4712 WMIC.exe Token: SeShutdownPrivilege 4712 WMIC.exe Token: SeDebugPrivilege 4712 WMIC.exe Token: SeSystemEnvironmentPrivilege 4712 WMIC.exe Token: SeRemoteShutdownPrivilege 4712 WMIC.exe Token: SeUndockPrivilege 4712 WMIC.exe Token: SeManageVolumePrivilege 4712 WMIC.exe Token: 33 4712 WMIC.exe Token: 34 4712 WMIC.exe Token: 35 4712 WMIC.exe Token: 36 4712 WMIC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2044 LogonUI.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4324 4072 run_me.exe 83 PID 4324 wrote to memory of 3660 4324 cmd.exe 85 PID 3660 wrote to memory of 1748 3660 net.exe 86 PID 4324 wrote to memory of 4712 4324 cmd.exe 87 PID 4324 wrote to memory of 3852 4324 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\run_me.exe"C:\Users\Admin\AppData\Local\Temp\run_me.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2D54.tmp\2D55.tmp\2D56.bat C:\Users\Admin\AppData\Local\Temp\run_me.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\system32\net.exenet user Admin FeetAreMyLife3⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin FeetAreMyLife4⤵PID:1748
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic useraccount where name=???Admin??? rename ???FeetSlut???3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\Windows\system32\logoff.exelogoff3⤵PID:3852
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a12855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2D54.tmp\2D55.tmp\2D56.bat
- Size 131B
- SHA256 f807dc152a1ee0fa1598a54e15a145758b8a02a32daac03e89813b1667e26fee
- MD5 58b720b5e80e83cb022a471f4770923c
- SHA1 b16faae791610c0ccc84a482e0411ccb95ed46c0
- SHA512 571f17fa5e04cd8511455d0720db29284f22551a62d350fe57e57771f2adec1cae2665a145500c741dbc08ad657a99a801c55878046540487652f6f84340b007
- TLSH T186C09BF6697D045205229D4431D7905531EED1F703C3A1583DF14285D6841899744567
- MD5 SHA1 SHA512 TLSH