Analysis
- user interaction
yes - max time kernel
78s - max time network
83s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Corrupted-Studios-Virus-Safety.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Corrupted-Studios-Virus-Safety.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Corrupted-Studios-Virus-Safety.exe
- Size 276KB
- Sample260820-cvm3zsba53
- SHA256 ad6d823ad827e217ca271a2b6d3689f5494da71553e8b88b0aaaa5cdf14b19b3
- MD5 f0456900416479c3e029a4857e027771
- SHA1 0b4da914598331c9654bc019fcec76e4088a9af0
- SHA512 8d4bf26d572bd4779ec22edba13e61f10e6ff2d2af253564f14fb4d37ddea13516a10c12b2a082d053a65288887ade6c61d0683296d8d65d96ecc9d0f0d3fbfc
- SSDEEP 3072:FyZ61ETP1BiMeGNfBZP5pHQpYR95WPNpq:401ETjeGNJZPPHQpY35WPNp
- TLSH T1D1546C01B354A1F3F8788135A85785523BB23D3997600BCF305477BE2E722F6693AB5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml bootim.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\rescache\_merged\705687830\2595941394.pri LogonUI.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log bootim.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log bootim.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml bootim.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml bootim.exe File created C:\Windows\rescache\_merged\1190018277\1293781730.pri LogonUI.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting ctfmon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions\Pinned LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions\Pinned\ LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings ctfmon.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Colors LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409" LogonUI.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4972 LogonUI.exe Token: SeCreatePagefilePrivilege 4972 LogonUI.exe Token: SeShutdownPrivilege 4972 LogonUI.exe Token: SeTakeOwnershipPrivilege 260 bootim.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4972 LogonUI.exe 4972 LogonUI.exe 4972 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Corrupted-Studios-Virus-Safety.exe"C:\Users\Admin\AppData\Local\Temp\Corrupted-Studios-Virus-Safety.exe"1⤵PID:5732
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a25055 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4972
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4512
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000288;000000000000028C;1⤵
- Modifies data under HKEY_USERS
PID:3428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2548
-
C:\Windows\system32\bootim.exebootim.exe /startpage:11⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\Recovery\ReAgent.xml
- Size 1KB
- SHA256 c71d240cbd0f43bdb1ee636ddb333a43cf41ac63fe306293e4cf2e3d4bb1c116
- MD5 24c2d556bf1a106cfb949ec9f3183d30
- SHA1 4343fdfc2beda52a264c2e2f87f2817649565657
- SHA512 9b440023f2e64e9b9fc160fb62e5a6e0a7be6fca295e94f57c145d8a6bf6f4aa773804d8a5b628fd6fb2e8779673cc82dcccb1bcd02e90872f2235a69a53f34e
- TLSH T12221E44681B448A6D7B1D366F0F8BD60863FF1DD12E08A5CA02AF6D394474628B5F9B0
- MD5 SHA1 SHA512 TLSH